Dealership AI Acceptable Use Policy Template

Your team is already using these tools. A written policy decides whether that is an asset or an incident.

Every store already has AI in it, whether or not anyone approved it. A salesperson is rewriting follow up emails in a chatbot on their phone. Somebody in the business office is pasting a document into a summarizer to save fifteen minutes. A marketing coordinator is generating vehicle descriptions. None of them are being reckless on purpose. They are doing what people do with a tool that saves time, which is use it before anyone tells them the rules.

The risk is not that the tool is bad. It is that customer information moves somewhere nobody decided it should go, or that output nobody checked reaches a customer with a number in it, or that a deal turns into a dispute and the store cannot say who wrote the message. All three are ordinary management problems, and all three are cheaper to prevent with a page of written rules than to explain afterward.

A dealership policy also needs to be short enough to actually be read. A twenty page document written for a bank will be signed and ignored. What follows is structured to fit on two pages, in language a floor manager can enforce without calling anyone.

One caveat stated up front and meant: this is a template and a starting point. Have your own counsel review it against your state's law, your franchise agreements and your existing employee handbook before you publish it.

Open by defining what the policy covers, because the vague version is unenforceable. Suggested language to adapt:

This policy applies to every employee, contractor and vendor acting on behalf of the dealership, and to any software that generates text, images, audio or recommendations, whether the store pays for it or an employee uses a free version on a personal device. It applies to work performed on personal devices and outside business hours when that work concerns dealership customers or dealership business.

Then maintain an approved tools list as an appendix rather than inside the policy body, because the list will change every few months and you do not want to reissue the whole document each time. Name the tool, name the business purpose it is approved for, and name the manager who owns it.

State the default clearly. Anything not on the list is not approved, and adding to the list goes through one named person. This single sentence is what turns a policy into something with teeth, and it is the sentence most dealership drafts leave out.

If you are still assembling the approved list, our page on evaluating an automotive AI vendor covers the diligence questions to ask before a tool goes on it.

This is the section that prevents the incident you would actually lose sleep over. Be specific rather than principled, because a rule that says use good judgment produces exactly the behavior you were worried about.

The following must never be entered into any tool that is not on the approved list: social security numbers, driver licence numbers, dates of birth, full account or card numbers, credit reports or scores, income or employment detail from a credit application, deal structure tied to a named customer, and photographs or scans of any identity or income document. Customer names, phone numbers and email addresses may be used only in tools the dealership has approved in writing for that purpose.

Add the practical version underneath, because staff follow examples better than categories. If you would not read it aloud in the showroom, do not paste it into a chatbot. If you need help writing a message to a specific customer, describe the situation without the identifiers.

Note that consumer financial information carries obligations independent of any AI policy, and those obligations do not move because a new tool appeared. Your safeguards program still applies to whatever the tool is, and your written information security program should list it. See FTC Safeguards Rule compliance and dealership data governance for the wider frame.

The failure mode here is not dramatic. It is a plausible sentence with a wrong number in it, sent to a customer, that the store then has to honor or argue about.

No output may be sent to a customer, published, or relied upon for a business decision without review by the employee who sends it. That employee is responsible for the content as if they had written it personally. Any figure, availability statement, payment, rate, term, fee, incentive or vehicle specification must be verified against the dealership's own system before it goes out.

The second sentence is the one to enforce. Ownership has to attach to a person, because a message that nobody owns is a message nobody checks.

Add a hard line for the categories where a mistake is expensive. Payment quotes, financing terms, rebate and incentive eligibility, warranty coverage and title or registration statements should never be sent from generated text without a manager or the responsible department confirming the figure. Numbers should come from the system that computes them. On our platform that means the desking engine, which handles loan and lease with a fifty state tax matrix, semimonthly payment frequency, trade credit caps and multiple lease tax methods, and produces a customer facing deal page the shopper opens on their own phone. A number from a calculator is defensible. A number from a paragraph is not. More on the desking tool page.

Generated marketing copy is confident by nature, and confidence is exactly what gets a dealership advertisement in trouble.

All customer facing marketing copy is subject to the dealership's existing advertising review. Generated text may not state or imply approval, credit terms, availability, savings or vehicle condition that the dealership has not verified. Required disclosures must be present in full and must not be shortened, summarized or reworded by any tool.

Add the fair lending line, because this is where a well meaning marketing person can create real liability without knowing it. Financing related campaigns cannot narrow an audience by age, gender, income, marital status, household size, education, language or ZIP. That is not a house preference, it is the rule, and it applies to an audience a tool suggests exactly as much as to one a person builds. If a vendor offers to help you target around it, treat that as disqualifying information about the vendor.

Guarantee language deserves its own sentence. No message may promise approval, a specific payment, a trade value or a sales result before the dealership has actually verified it. This is worth stating in the policy because generated copy reaches for that phrasing constantly, and one screenshot of a promise your store cannot keep is worth more to a complainant than a hundred careful pages.

Most dealerships now record calls, and transcription turns those recordings into searchable text. Both are useful and both need a written rule.

Call recording and transcription are permitted only through dealership approved systems, with the notices required in the states where the dealership operates. Recordings and transcripts are dealership records. They may not be copied, forwarded, or uploaded into any tool outside the approved list, and they may not be used for any purpose other than training, quality review and dispute resolution.

Two state law realities to build in. Consent requirements for recording vary, and several states require all parties to consent, so your notice language and your system settings need to match the states you actually call into rather than the one you sit in. And text messaging carries its own consent obligations that a policy about AI does not displace. Our page on TCPA compliance for dealership texting covers the messaging side.

The reason to allow transcription rather than discourage it is that it is genuinely useful for coaching. A manager reads a twelve minute call in thirty seconds instead of listening to it, which means calls actually get reviewed rather than being reviewed in theory. Conversation intelligence covers what that changes in practice.

Close the policy with the unglamorous operational parts, which are what make it survive an audit or a dispute.

Access to approved tools is granted by role and revoked on the day an employee's access to other dealership systems is revoked. Use of approved tools is logged. Employees must not share accounts or credentials. Violations are handled under the dealership's existing disciplinary process. Suspected exposure of customer information must be reported to the named responsible manager the same day it is discovered.

Two supporting habits are worth naming. First, access removal on the last day, not the following week, and it needs to include anything an employee could have signed up for with a work email. Second, a login and activity record you can actually pull, which is what turns a suspicion into a fact when a salesperson leaves for a competitor and someone asks what they had access to and when. Role based user management and a login log exist in the platform for exactly that.

Set a review cadence in writing, and make it short. Quarterly is right for the approved tools appendix, annually for the policy body. A policy nobody has reopened in two years is describing a store that no longer exists.

A policy that arrives as an email attachment gets skimmed and forgotten. A sequence that works better takes about a week of attention.

1. Find out what is already in use before you write the approved list. Ask, without a threat attached, and you will get an honest answer. Write the policy around reality rather than around what you wish were true.
2. Publish the two page version and the appendix separately. The appendix is the living document.
3. Train in fifteen minutes at a sales meeting, using two real examples: one message that would have been fine and one that would not.
4. Get a signature and file it with the handbook acknowledgment.
5. Name the owner out loud. One person approves new tools and receives incident reports. If that person is nobody, the policy is decoration.

If you want a broader operational checklist to sit next to this document, the AI compliance checklist for dealers covers the vendor and process side, and generative AI tools for dealerships covers what these tools are actually good at in a store.

For transparency about our own position, since we sell software in this space. What LeadLocate provides that touches this policy: call recording with transcription, document reading and VIN scanning through document AI, automations and follow up processes that run on rules you set, role based user management with a login log, and on the SecureWebX side a compliance module and a terms and consent gate with versioning, so you can tell which version of your disclosure language a specific customer accepted and when rather than only that they accepted something.

What no policy and no vendor can do is remove your obligations. Your safeguards program, your advertising review, your recording consent posture and your fair lending compliance stay yours. A written policy makes those obligations enforceable inside your store, and a platform that keeps records makes them provable. Neither substitutes for the other.

We cannot guarantee outcomes from any of this, and a vendor who tells you their tool makes you compliant is describing something that does not exist. Pricing on our side is month to month with no long term contract, from $199 on CRM Only, and full figures live on the pricing page. If you want to talk through how the record keeping side works before you finish your draft, contact us.

Is this template legal advice?

No. It is a practical starting point written from dealership operations experience. Have your own counsel review it against your state law, your franchise agreements and your existing employee handbook before you publish it to staff.

What should never be entered into an unapproved tool?

Social security and driver licence numbers, dates of birth, account or card numbers, credit reports or scores, income and employment detail from an application, deal structure tied to a named customer, and images of identity or income documents.

How long should a dealership AI policy be?

Two pages, with the approved tools list kept as a separate appendix. The appendix changes every few months; the policy body should not. A long document gets signed and ignored, which is worse than no document.

Can we let staff use free tools on their own phones?

That is your decision, but the policy has to address it explicitly, because it is already happening. Most stores allow it for general drafting while prohibiting any customer identifier or document from entering a tool that is not approved.

Does an AI policy satisfy the Safeguards Rule?

No. It supports your written information security program by defining where information may go, but the program, the risk assessment and the vendor oversight remain separate obligations that stay yours.

How often should the policy be reviewed?

Review the approved tools appendix quarterly and the policy body annually, and name the manager responsible for both. A policy nobody has reopened in two years describes a store that no longer exists.

See call transcription, role based access, a login log and versioned consent running in one platform. Month to month, no long term contract.