"An ounce of prevention is worth a pound of cure."

—Benjamin Franklin, Founding Father & Inventor

CDK's latest dealership study found that most stores use AI and almost none have written rules for it. In practice, that gap looks like a salesperson pasting a credit app into a free chatbot to tidy it up.

You can close most of it in an afternoon. List every AI tool your team actually uses, including the AI features inside your CRM, phone system, and chat vendor. Then run this prompt to turn that list into a one-page policy people will actually read.

None of this is legal advice. Loop in actual counsel before the policy goes live.

This prompt covers your people. For the AI agents your vendors run inside your systems, use the Agent Containment Playbook from our Sept. 29 issue.

Almost every store is using AI. Almost none have put rules around it.

CDK's State of Dealership Cybersecurity 2026 found that 87% of dealership leaders use AI in some capacity. Only 6% have a fully defined AI governance framework. Another 24% have no oversight at all, and 15% aren't sure whether a policy even exists.

The gap is widest at the biggest groups. Among leaders of 11+ rooftop groups, 44% say AI is widely used across their stores, but only 7% have full governance in place.

The study surveyed 218 dealership executives and department heads. Sixty-one percent said AI has made them more worried about cybersecurity.

At most stores, the likeliest AI slip comes from a well-meaning employee with a deadline.

A salesperson drops a credit app into a free chatbot to summarize it. A service advisor pastes a customer's history into a tool nobody vetted. An F&I manager asks AI to clean up a menu with the deal jacket still attached.

None of those feel like security decisions in the moment. Each one sends customer data somewhere the store doesn't control.

Dealers already sense this. Asked which AI risks worry them most, 47% named data leaks through AI tools and 40% named unauthorized AI use.

The outside threat is changing too. Email phishing has overtaken ransomware as dealers’ top cybersecurity concern, and 76% named AI-powered phishing as their biggest AI risk. Several dealers told CDK their staff had received convincing emails from someone posing as the store owner.

Even the people building this technology are cautious about it. Microsoft CEO Satya Nadella wants AI agents running on every PC, but he recently told NBC News he sees them as a security risk that shouldn’t be trusted by default. If the company selling Copilot is that wary, a dealership can manage a one-page policy.

On Oct. 13, Google made Gemini 4 Argon, its new flagship model, widely available. It first went to a small group of cybersecurity partners on Sept. 30.

Google AI Pro and Ultra subscribers can use it in the Gemini app and in AI Mode in Search. Businesses can reach it through Gemini for business and Google's API.

For stores that run on Google Workspace, the demo to watch shows Argon in the Gemini app taking a messy folder of project notes, turning it into a client proposal deck, emailing it, and setting up a scheduled task to handle future requests the same way. Swap the folder for a week of aged-inventory reports and the dealership version is easy to picture.

One caveat: the benchmark wins and customer results in the launch post come from Google and its early-access partners. Run Argon on your own work before you trust it with anything a customer will see.

Why it matters: if your store already lives in Gmail, Calendar, and Sheets, this is an assistant that comes with the keys already in hand. Google says it trained Argon to pause for human confirmation before irreversible steps. That’s Google’s safeguard. Your store still needs its own, so put Argon on the list from this week’s prompt.

Dealers are starting to build their own AI dashboards, reports, and automations, and Brian Pasch argues vendors should welcome it.

In a recent LinkedIn piece, Pasch says the real question for vendors is whether they’re ready for dealers who expect open APIs, MCP connectors, and easy access to their own data. His line worth stealing: “Education has to include both capability and responsibility.”

His workshop partner, Ai Dealer Labs founder Gray Scott, pushed it further. In the comments, he said it’ll be interesting to see who has the first data breach from self-built dealer tech. In his own repost, he argued that the vendors who win will be the ones who teach this new wave of builders the security basics they might skip: “how to test the software, house it, how to ensure privacy.”

That’s the same gap CDK found, now showing up in homemade tools.

Read Brian’s full take, then Gray’s, before your next vendor review.

Thanks for reading, Friend! Remember, if your AI can’t dance, you more than likely just need better prompts.