🔥 The AI Drop

Your dealership is running AI blind, and CDK just proved it with a number you can't un-read.

Eighty-seven percent of dealers use AI in daily operations. Six percent have a complete policy governing it. Read that again, slower: 87% in, 6% supervised. Eight in ten dealers have a chatbot or an AI agent touching customer conversations, credit applications, deal terms — and fewer than one in sixteen of them can tell you who signed off on what that tool is allowed to say or do.

That's CDK Global's sixth annual cybersecurity study, and the twist is what moved and what didn't. Email phishing just passed ransomware as the threat dealers fear most — 78% now cite it as their top concern. Employee training is up to 76%. But endpoint protection and real-time monitoring both fell to four-year lows. Translate that: dealers are training people to spot a bad email while the actual technical guardrails around their networks — and around the AI tools plugged into those networks — are getting thinner, not thicker. You added a new front door (AI) and took the deadbolt off the old one at the same time.

Here's the opinion only this newsletter will print: governance isn't a compliance checkbox, it's the desk log you already run for every other department. You wouldn't let a green F&I manager quote an APR without a manager's signature on the four-square. You wouldn't let a salesperson promise a trade value over the phone without a used-car manager's sign-off. But right now your BDC rep is pasting a customer's phone number into ChatGPT on her lunch break, your service advisor is "just checking something" on Claude before calling a customer back about a declined warranty claim, and nobody in your building has written down whether that's allowed, logged, or reviewed. That's not innovation. That's a $750,000-deal PII exposure waiting for a plaintiff's attorney to find it first.

The fix isn't another vendor. It's a list. Pull the actual AI tools your team is logging into this week — not the vendor contracts sitting in your GM's inbox, the real logins: ChatGPT, Claude, the chatbot widget, the voice-AI BDC tool, whatever your F&I desk is quietly using to draft adverse-action letters. Put one name on the line who owns the policy for each one. If you can't produce that list by Friday, you already have your answer about how exposed your store is.

Forward this to your GM. In your next manager meeting, ask one question: "Who in this room can name every AI tool touching a customer's data right now — and who approved it?" If the room goes quiet, you found your Monday project.

Source: CDK Global sixth annual cybersecurity study, cited via CBT News, Oct. 2026 — https://www.cbtnews.com/email-phishing-tops-cybersecurity-threats

📋 Prompt of the Week

Use this to build the AI accountability list your GM meeting needs before Friday.

Act as my dealership's operations director. I'm going to list every AI tool 
currently used in my store by department. For each one, help me build an 
accountability table with these columns: Tool Name, Department, What It 
Touches (customer data / pricing / deal terms / none), Who Approved It, 
Who Reviews Its Output, and Escalation Path If It's Wrong.

Here's my list so far:
[TOOL 1 - e.g., ChatGPT used by BDC for text replies]
[TOOL 2 - e.g., chatbot widget on website]
[TOOL 3 - e.g., voice AI for service scheduling]
[ADD MORE AS NEEDED]

Flag any row where "Who Approved It" or "Who Reviews Its Output" is blank 
— those are my exposure points. Then draft a one-page policy memo I can 
send to my team by [DATE] that assigns an owner to each blank.

Why it works: it forces the one output CDK's data says 94% of dealers don't have — a named owner per tool — instead of another AI strategy deck nobody reads.

🛠️ Tool of the Week + ⚡ Three Fast Finds

Tool of the Week: IgniteUps.ai NEXUS

What it does: sits on top of the AI tools you've already bought — BDC bot, service scheduler, ad-content generator — and lets a manager coordinate them through plain-language requests instead of logging into five dashboards.

How to actually run it: don't buy this as your first AI tool. Buy it as your second move, after you've run the Prompt of the Week above and have an actual list of what's live in your building. NEXUS is the layer that makes "who owns what" answerable in one screen instead of five logins — which is exactly the gap CDK's governance number just exposed.

Price: not publicly listed — verify at igniteups.ai before you buy.

Who it's NOT for: a single-rooftop store running one chat tool. You don't need a conductor for a one-man band — fix your first tool and write your first policy before you pay for a layer to manage tools you don't have yet.

⚡ Three Fast Finds — not endorsements, just on the radar:

  • Numa — fixed-ops-first AI answering missed service calls across 1,300+ rooftops; built for groups whose advisors can't keep up with peak-hour phones. (coxautoinc / wardsauto briefs, Oct. 2026)
  • Vini AI (Spyne) — conversational AI now live at 115 U.S. dealerships, freshly integrated with CDK via Fortellis. (prnewswire.com, Oct. 8, 2026)
  • DriveCentric Acquire Agent — new AI agent for real-time vehicle sourcing, launched Oct. 1, 2026 inside DriveCentric's existing platform. (cbtnews.com, Oct. 11, 2026)

🗣️ From the Lot

[Manual insert: 2–3 real, role-anonymized dealer quotes, or delete this section before send. Do not fabricate quotes.]

📰 Bits & Bytes

📊 The Number

87% vs. 6%. Eighty-seven percent of dealers use AI in daily operations today. Six percent have a complete governance policy covering it — oversight, approvals, accountability, all written down. Everything in between is a store running a tool nobody supervises. Pull your own list this week: count the AI tools actually logged into across every department, then count how many of them have a name attached to "who's accountable when it's wrong." If that second number is zero, you're not in the 6% — and now you know it.

Source: CDK Global sixth annual cybersecurity study, via CBT News, Oct. 2026 — https://www.cbtnews.com/email-phishing-tops-cybersecurity-threats

❓ Ask the AI Guy

"We've got three AI tools running — chatbot, service scheduler, review responder. Do we really need a written policy, or is that overkill for a single rooftop?"

One principle: if a tool touches a customer's name, phone number, credit data, or a price quote, it needs an owner and a rule — size of the store doesn't matter, exposure does. A single rooftop with three tools and zero oversight carries the same risk per tool as a 20-store group; you just have fewer people to catch the mistake before it hits a customer or a regulator.

  1. List it. Every AI tool touching customer data or pricing — not vendor contracts, actual logins.
  2. Name it. One person per tool who reviews output and owns the escalation if it's wrong.
  3. Limit it. Write down what each tool is and isn't allowed to say on price, financing, or warranty coverage.
  4. Log it. Keep a record of who approved the tool and when — the same way you'd log a desk approval on a deal.
  5. Review it monthly. Treat it like your aged-inventory report: if nobody's checking it, it's not a policy, it's a hope.

Do This Monday

Pull the actual list of AI tools your team is logging into — not vendor contracts, real usage — and put one name next to each one who owns it. If you can't finish that list by Friday, you've found your first governance gap. Fix that before you sign another AI contract.

Free dealer AI tools

Start with the foundation: install Dealer AI Skills, then run Dealer Website Grader to find technical website leaks and DealerAEOAudit to see whether AI assistants recommend your dealership.

See all free tools →

Reading about AI won't train your team

The stores pulling ahead aren't the ones with the most tools — they're the ones whose people know how to use them. That takes a strategy, a readiness baseline, and real training.