Shadow AI risks at a dealership start with AI nobody reviewed: personal ChatGPT or Claude accounts, browser extensions, and features inside the CRM. Finding them takes a staff survey, an extension and app review, network logs, and expense records.
Last updated: November 9, 2026
A salesperson called our help desk one day with a request. Erik Nachbahr, our president and founder, told the story on a DealersEdge webinar in October, and I’ll give you the caller’s words the way he told them: “I need you to install it on every computer and help me sign into every computer as me.”
“It” was a personal ChatGPT account. One login. The plan was to share it with the whole sales floor.
I don’t read that as somebody trying to get away with something. I started on a sales floor in the late ’90s, and I recognize a salesperson who found a tool that works and wants everybody to have it. What gets me is the part where they called. That one, we heard about. Nobody calls about the ones who just open a browser tab.
I said on one of our planning calls that “the topic is about eliminating shadow AI in dealerships,” and I’d still put it that way. But you can’t eliminate what you haven’t found. Nobody can. My own estimate, and it’s only an estimate, is that at least half the time the dealer doesn’t know salespeople are using AI at all. This post is about the finding part, and then what to allow once you’ve got a list. If you already know what’s out there and want it run for you, that’s what Managed AI for dealerships is. The tools are in the building either way.
What Are the Shadow AI Risks at a Dealership?
Shadow AI is any AI tool staff use for dealership work without the store’s approval, on an account the store doesn’t control. The risks are practical: nobody can see what went in, nobody can shut it off, and whatever was uploaded leaves with the employee who owns the account.
Erik put the first two in one line. “So there’s no audit trail, there’s no off switch, and we’ve had several examples where we’ve seen employees actually uploading customer data.” The third one any dealer will understand right away. If a salesperson uploads their customer list to a personal account to work it over, “now those belong to them and they can take it with them when they go.”
Nothing has to be installed, either. “You can use it via website,” Erik said. “You don’t even need to install the application.” No install. No ticket. That’s why I wouldn’t start this job by looking for software.
Now the numbers, with a warning on them. Cox Automotive’s AI in Auto Retail Tracker from August 2026 says 82% of dealers report using AI. That’s the use they know about, and it doesn’t tell you what’s on anyone’s personal account. IBM’s 2025 breach report, which is based on breaches at 600 organizations around the world and not dealerships in particular, found one in five organizations reported a breach due to shadow AI. Those with high levels of shadow AI saw an average of $670,000 more in breach costs than those with low levels or none. Only 37% have policies to manage AI or detect shadow AI. Global numbers, not ours. The FTC made a related point in 2024, in a post aimed at AI companies: customers “may reveal sensitive or confidential information” when they use these models. At a store, that’s a credit application. It’s a payoff amount. It’s somebody’s cell number.
Erik also said something I’d want you to hear before anybody panics: “personal AI is definitely out there, but it’s not actually out there as much as you think it is yet.” He sees it with power users so far. Good news. It has an expiration date, though, because he also said it’s going to “trickle down to everyone in the dealership.”
Early is cheaper than late.
How Do You Find the AI Tools Your Staff Already Uses?
Start by asking staff, because the people using AI can tell you things no report will. Then check store browsers, your Microsoft 365 or Google admin records, network logs, expense reports, help desk tickets, and your vendors. Each check catches something the others miss, so plan on running all of them.
- Ask first, and say nobody’s in trouble this round. I’d give each department one page with three questions on it: what do you use, on which account, and what have you put in it? A BDC rep will tell you things a firewall can’t.
- Then I’d go look at the browsers on the sales floor and in the BDC, since that’s where I’d expect to find add-ons first. Where Chrome is enrolled in Chrome Enterprise Core with reporting turned on, the apps and extensions usage report lists what’s installed and on how many browsers. Where it isn’t, somebody walks the floor.
- Somebody who used “Sign in with Microsoft” or “Sign in with Google” on an AI app, with their work account, leaves a trail. On Microsoft 365, the User consent tab for an enterprise application in Entra shows the permissions granted to a specific user or group. On Google Workspace, it’s the accessed apps list, which shows apps that have accessed Google data and how many users are accessing each one.
- If you keep a software inventory for store PCs, check it for desktop AI apps. If you don’t have one, write that down too, because it’s a finding all by itself.
- Network logs. If your firewall or DNS filter keeps them, AI site traffic by device tells you where to go ask questions.
- Read the expense reports. Really. A paid AI subscription can show up as a small monthly line on a manager’s card.
- Search your help desk tickets for AI. You remember how this post started.
- What’s on in your account? Put that to your CRM and DMS vendors in writing, and ask what customer data each AI feature touches.
That list is discovery, by the way, not the whole program. I’ve called turning off training in ChatGPT “step one out of 10 steps,” and finding the tools sits in that same early stretch, which means you’re going to be doing this again, because new tools keep showing up and the person who answered your survey in the spring may have a new favorite by the fall.
Run the list. Write down what comes back. Then keep it.
What Each Check Won’t Show You
No single one of these gets you the whole picture. I’d rather you know that going in.
| Check | What it can show | What it can’t |
|---|---|---|
| Staff survey | Tools, accounts, and what people put in | Anything they leave out |
| Browser extension review | Add-ons on store PCs | Phones and home computers |
| Microsoft 365 or Google admin records | Apps connected to work accounts, and their permissions | Accounts opened with a personal email, or with a work email and a separate password |
| Network logs | Which store devices reached AI sites | What was typed, and traffic on cell data |
| Expense reports | Paid subscriptions the store reimbursed | Free accounts, and ones paid on a personal card |
| Vendor letters | AI features the vendor says are in your account | How your staff actually use them |
A log can tell you that a PC at the used car desk keeps reaching an AI site, but it usually can’t tell you what was typed or whose account it was, which is why the log is where the conversation starts and not where it ends. Now look down that right column and you’ll see phones in it. Phones again. They’re the reason blocking alone won’t finish this. When you do get to blocking, our guide to blocking ChatGPT at the dealership covers the controls. Erik compared it to the days when IT first blocked Facebook: “they would just sit there on their phones in the dealership and do it.”
Two Places People Forget to Look
Browser extensions are the first. Here’s why. In January 2026, SecurityWeek reported OX Security’s finding that two malicious Chrome extensions, with over 900,000 downloads between them, were taking users’ complete ChatGPT and DeepSeek conversations along with the URLs of their open Chrome tabs. They copied a legitimate extension and asked for consent to collect “anonymous, non-identifiable analytics data.” Think about what that looks like at a store. Somebody adds a free AI helper to their browser on a slow Tuesday, clicks yes, and has no idea what they agreed to, and from then on their AI chats in that browser could be going somewhere nobody at the dealership has ever heard of. Those two aren’t the point. The point is that a store where nobody reviews extensions has no way to catch one.
The second one isn’t sneaky at all. I want to be fair about that. Your software vendors are adding AI. VinSolutions announced in an August 2026 release that its new AI-powered tools, including a CRM-embedded assistant that engages leads and schedules appointments, are available to all its dealers. I spent five years selling CRM to dealers, so I’m the last person to tell you a CRM vendor shouldn’t build new things. A vendor’s AI feature isn’t shadow AI the way a personal account is. It’s on a platform you already picked. You signed a contract.
So who decided on it? That’s the question. The FTC Safeguards Rule tells you to oversee service providers, including “periodically assessing your service providers based on the risk they present,” and a new feature touching customer data is a fair reason to ask again. Get the answer in writing. File it.
Approved isn’t the same as reviewed.
What to Allow Once You Have the List
Brandon Dorsey, our VP of Technology Strategy, has a view here I agree with. He thinks the bigger risk isn’t shadow AI at all. It’s the other thing: enterprise AI bought and handed to staff with no rollout plan, no access controls, and no defined workflows. And he thinks blocking is the wrong fight, because people will go around a block for a tool that helps them, and they won’t bother if you’ve given them an approved way to do the same job. Hard to argue. If you’ve got a service advisor who’s been cleaning up customer emails in a personal account, the goal is that next month the same advisor does the same job in a tool you can see, and nobody had to sit through a lecture to get there. That’s the job.
Erik made the same point from another angle. “You can’t just say nobody’s allowed to use AI. You want them to use AI, but then you need to restrict how it’s used.”
There’s an order to this. On our November planning call Erik said dealers ask how to block these tools, “but they don’t have policies that even state what is or isn’t allowed. Certainly not when it comes to AI and PII.” So write the line before you buy the block: no customer PII in AI tools, above all in personal AI accounts. Our dealership AI use policy template gives you the wording, and our post on public AI and customer PII covers what’s at stake when it goes in anyway. The same line is rule 7.3 in our acceptable use policy template.
Then go down your list. One tool at a time.
| What you found | What I’d do |
|---|---|
| Personal AI account used for dealership work | Stop it, and move the work to an approved corporate account the same week if you can |
| One login shared by a department | Stop it today. Everybody can see everybody’s chats, and you can’t tell who did what |
| Browser extension that reads pages | Remove it unless someone can name the business reason and the publisher checks out |
| AI feature inside your CRM or DMS | Keep it if the vendor answers your data questions in writing and somebody at the store owns the decision |
| Paid AI subscription on an expense report | Take it as a sign the work is useful, and bring it onto a corporate account |
That last row is where some dealers balk at the cost. I get it. Erik’s answer on the webinar was that the governance board decides who should be using AI, “and if they’re using it for business, you pay for it.” The approved path we run is Secure AI Chat, a private workspace with access by role and a record of who used what. If you want the full governance setup first, the AI governance post has the webinar and the board structure.
Give people the better tool, and the workaround loses its reason.
What About the Personal Accounts Already Out There?
An attendee asked Erik exactly this: how do I wipe out all the personal accounts? Fair question. He didn’t dress it up. “That’s something that’s not simple to do,” he said, and he told them he’d have to get back to them.
Here’s the part I can tell you plainly. The store didn’t create those accounts. So the store has no admin login for them, and there’s no switch on your end that turns them off. On a personal account, the person who opened it is the one who can close it. Not you. On ChatGPT, for example, OpenAI’s help center has the account holder delete the account directly in ChatGPT, and says deleted chats are scheduled for permanent deletion within 30 days, unless they were already de-identified or OpenAI must keep them for security or legal obligations. Erik’s read on whatever was already uploaded is blunt: “at that point, it’s gone.”
So what do you do? I’d go in this order. Get the approved tool in people’s hands first, because asking someone to give up something useful for nothing doesn’t go well. Then set a date. Put it in the handbook. Erik’s first rule for that handbook is “no personal use of AI whatsoever in the dealership and no uploading any dealership data into any AI, right? That’s not corporate controlled.” Ask each employee to confirm in writing that they’ve stopped. Ask what customer information went in. Add the same question to your exit checklist, right next to the keys and the demo plate, so it comes up on the day a salesperson leaves and not six months later when you notice the customer list went with them.
I know that’s not the clean answer anybody wants, and if a tidier one comes along I’ll be the first to update this post, but I’d rather give you the honest version than promise you a switch that doesn’t exist. If what comes back includes customer information, take it to your Qualified Individual and your attorney. I’m not a lawyer. I won’t guess at what that does or doesn’t trigger. Neither should you.
You won’t get all of it back. You can stop adding to it.
What Dealers Ask After the First Look
Can’t we block ChatGPT at the firewall and call it done?
If someone turns off training, is their personal account fine?
Do we tell staff we’re looking?
Does the Safeguards Rule actually care about any of this?
Who should own the list once it exists?
Know What’s in the Building
“Whenever I feel like things aren’t going the way I want them, I always ask myself what am I not doing?” That’s my line, and it fits here. On shadow AI, the answer can be pretty simple. You haven’t looked yet.
We work with 2,000-plus dealerships. We manage the technology so they can sell and service cars and heavy trucks, and that now includes knowing where AI is running. If you want a second set of eyes, our complimentary IT and cybersecurity assessment looks at whether staff are using AI tools in personal accounts outside your security controls, along with your technology setup, security posture, vendor spend, and where you stand on the FTC Safeguards Rule. The findings come back in writing. If AI is the main concern, the AI readiness assessment goes deeper on what those tools can reach.
Start with the survey. It costs you one page.