AI Compliance and Governance Foundations Policy

Policy Summary

Organization: [Dealership Group Name]

Applies To: All rooftops, employees, contractors, and vendors

Policy Owner: [Insert Name / Title]

Approving Authority: [Insert Executive Sponsor / Governance Team]

Effective Date: [Insert Date]

Last Review Date: [Insert Date]

Next Review Date: [Insert Date]

Version: 1.0

Policy Classification: Internal Use Only

1. Purpose

• 1.1 The purpose of this Policy is to establish the minimum requirements for the responsible, ethical, secure, and lawful use of artificial intelligence and AI-enabled tools across the Organization.
• 1.2 This Policy is intended to protect customer trust, employee trust, confidential information, and business operations while allowing limited and controlled use of AI where appropriate.
• 1.3 The Organization’s approach to AI is intentionally conservative. AI may be used only where there is a legitimate business need, a defined business owner, a review process, and controls sufficient to reduce risk to a level acceptable for the Organization.

2. Policy Statement

• 2.1 The Organization will use AI only in ways that are lawful, ethical, transparent, and consistent with Company policy, vendor agreements, and all applicable privacy, security, and consumer protection obligations.
• 2.2 AI is a tool to assist employees. It does not replace human judgment, legal compliance, or employee responsibility for customer outcomes. Any AI use that may affect customer credit, pricing, financing, service recommendations, employee decisions, or customer privacy must be reviewed and approved before use.

3. Scope

• 3.1 This Policy applies to all employees, temporary staff, contractors, and vendors who use, administer, support, or access AI-enabled systems on behalf of the Organization.
• 3.2 This Policy applies to all rooftops and all departments, including Sales, BDC/Internet, F&I, Service, Parts, Accounting, HR, Marketing, and IT.
• 3.3 This Policy covers AI tools and features used for drafting communications, automating workflows, lead scoring, customer support, reporting, pricing support, risk detection, content generation, and decision support, whether embedded in another business system or used as a stand-alone application.

4. Definitions

• 4.1 Artificial Intelligence (AI): Software that uses data to generate predictions, recommendations, classifications, summaries, or content.
• 4.2 AI-Enabled Tool: Any software product or feature that uses AI or machine learning in its operation.
• 4.3 High-Risk AI: AI that may affect credit, pricing, financing, employment, customer access, or other materially significant decisions.
• 4.4 Customer Information: Any information about a customer or prospect, including contact data, credit data, payment data, browsing history, vehicle preferences, service history, or health related information i.e. vehicles altered for accessibility etc.
• 4.5 Approved AI Tool: An AI tool that has been reviewed and authorized by the Governance Team for a specific business purpose.
• 4.6 Public AI Tool: A general-purpose AI service not formally approved by the Organization for business use.

5. Governance and Accountability

• 5.1 The Organization shall maintain an AI & Data Governance Team to oversee AI use and related risks. Because the Organization has no in-house attorney and limited IT resources, governance must be streamlined, documented, and practical.
• 5.2 The Governance Team shall include, at minimum:
  • 5.2.1 An executive sponsor, such as the Owner, COO, CFO, or Controller.
  • 5.2.2 The senior IT representative or IT Manager.
  • 5.2.6 An external legal or compliance advisor as needed.
• 5.3 The Governance Team shall be responsible for approving or rejecting new AI use cases, reviewing high risk uses, confirming vendor expectations, responding to incidents, and updating this Policy as needed.

6. Ethical Principles

• 6.1 Transparency. Employees shall not use AI in a manner that misleads customers or hides material facts. If AI influences a customer facing communication or workflow, the use must be understood by the responsible employee and handled consistently with this Policy and applicable law.
• 6.2 Fairness. AI may not be used in a manner that creates unlawful bias or unequal treatment in lending, pricing, service, employment, or customer communication. Any system that may influence those outcomes requires careful review and human oversight.
• 6.3 Privacy. AI shall not be used to collect, share, or expose customer information beyond what is necessary for the approved purpose. Customer data must be handled according to privacy notices, consent requirements, retention rules, and vendor obligations.
• 6.4 Security. AI use shall support the Organization’s information security program, including access control, logging, vendor oversight, and secure offboarding. Unapproved AI use shall not weaken safeguards or expand access to sensitive data.
• 6.5 Human Oversight. A trained person must review AI output before it is used in customer facing, regulated, or business-critical contexts. Employees remain accountable for the accuracy, fairness, and appropriateness of what they send, approve, or rely on.

7. Acceptable Use

• 7.1 Employees may use approved AI tools only for legitimate business purposes and only within the limits of this Policy.
• 7.2 Permitted uses include:
  • 7.2.1 Drafting internal summaries, notes, or first pass communications that will be reviewed by a person before use.
  • 7.2.2 Helping create non sensitive marketing ideas or internal training content.
  • 7.2.3 Supporting administrative workflow tasks that do not involve confidential, regulated, or customer sensitive information.
  • 7.2.4 Assisting with internal research or process improvement using public or non-sensitive information.

8. Prohibited Use

• 8.1 Employees may not use AI to:
  • 8.1.1 Make final decisions about credit, pricing, financing, lending eligibility, employment, discipline, or other high impact matters without approved human review and controls.
  • 8.1.2 Generate deceptive, misleading, unsupported, or discriminatory statements about vehicles, pricing, offers, warranties, financing, service, or dealership capabilities.
  • 8.1.3 Enter customer personal information, credit application data, payment data, passwords, employee confidential information, or health related information into any public or unapproved AI tool.
  • 8.1.4 Create content that violates privacy notices, consent requirements, retention rules, or vendor contract terms.
  • 8.1.5 Use AI in a manner that suggests a customer has been approved, denied, priced, or treated in a certain way unless a qualified human has verified the result.

9. Data Protection

• 9.1 Customer and employee data shall be protected at all times. AI tools may only access the minimum amount of data necessary to complete an approved business purpose.
• 9.2 Highly sensitive data may not be shared with unapproved AI tools, including:
  • 9.2.1 Credit application data.
  • 9.2.2 Social Security numbers or similar identifiers.
  • 9.2.3 Payment information.
  • 9.2.4 Health related information.
  • 9.2.5 Login credentials.
  • 9.2.6 Internal financial or nonpublic business information.
• 9.3 Employees shall assume that information entered into a public AI tool may be stored, reviewed, or reused outside the Organization’s control unless the tool has been formally approved and contractually restricted otherwise.

10. Human Review

• 10.1 AI output is not final by itself. A person must review AI generated content before it is sent to customers, used in F&I, relied on for business decisions, or retained as an official record.
• 10.2 Employees must review AI output for:
  • 10.2.1 Accuracy.
  • 10.2.2 Completeness.
  • 10.2.3 Bias or unfairness.
  • 10.2.4 Misleading or unsupported statements.
  • 10.2.5 Confidential or regulated information that should not be included.
• 10.3 If the output cannot be verified, it shall not be used.

11. Vendor Approval and Management

• 11.1 All AI tools and AI-enabled vendor features must be approved before use, including features embedded in existing systems such as CRM, DMS, marketing, website chat, call tracking, and lead management platforms.
• 11.2 Before approval, the Governance Team must confirm that:
  • 11.2.1 The business purpose is legitimate.
  • 11.2.2 The tool’s data access is limited and appropriate.
  • 11.2.3 The vendor has acceptable security and privacy practices.
  • 11.2.4 The contract addresses data use, confidentiality, deletion or return, incident reporting, and termination/offboarding.
• 11.3 No employee may independently enable or use an AI tool for dealership work without approval.

12. Access Control

• 12.1 Access to AI tools and related data must be limited to employees who need access to perform their duties.
• 12.2 The Organization shall use:
  • 12.2.1 Unique user accounts where possible.
  • 12.2.2 Strong passwords and multi-factor authentication where feasible.
  • 12.2.3 Role-based permissions.
  • 12.2.4 Logging and monitoring for sensitive systems.
  • 12.2.5 Timely removal of access when employees leave or change roles.
• 12.3 The Organization shall minimize the amount of data sent to AI tools by using de-identified, truncated, or summary information whenever possible.

13. Security Requirements

• 13.1 AI use shall not weaken the Organization’s information security posture. The Organization shall maintain a written security program and risk assessment process appropriate to its size and risk exposure.
• 13.2 At a minimum, the Organization shall:
  • 13.2.1 Restrict access to customer information.
  • 13.2.2 Monitor for unusual access or misuse.
  • 13.2.3 Revoke access promptly when no longer needed.
  • 13.2.4 Review integrations and API connections regularly.
  • 13.2.5 Verify that former vendors no longer have data access.
  • 13.2.6 Confirm that former employees’ access is removed promptly and completely.

14. Fair Lending and Consumer Protection

• 14.1 AI may not be used in a manner that undermines the Organization’s obligations under FCRA, TILA, or other consumer protection laws. No AI tool may be relied on as the sole basis for adverse action, credit decisions, disclosures, or customer pricing decisions without required review and compliance controls.
• 14.2 Any AI use tied to finance, credit, or customer eligibility must be reviewed before deployment and monitored for unintended bias, inaccurate outputs, or incomplete disclosures.

15. Privacy and Customer Choice

• 15.1 The Organization shall use AI in a manner consistent with privacy notices, consent obligations, and customer rights. Customer data shall be used only for approved business purposes and shall not be repurposed without appropriate review.
• 15.2 The Organization shall honor applicable access, deletion, correction, opt-out, and notice obligations when AI tools process customer information. Vendors must be held to the same standard by contract and oversight.

16. Training and Awareness

• 16.1 To support employees across all roles and experience levels, training shall be practical and easy to understand. Employees shall receive training on:
  • 16.1.1 What AI is and how it is used in the dealership.
  • 16.1.2 What information may and may not be entered into AI tools.
  • 16.1.3 Why customer data and regulated data require special handling.
  • 16.1.4 How to identify questionable AI output.
  • 16.1.5 How to report concerns or ask for help.
• 16.2 Training shall be provided at hire, when duties change, and at least annually.

17. Incident Reporting

• 17.1 Employees must report immediately any suspected misuse of AI, unauthorized access, accidental disclosure, suspicious vendor behavior, or misleading AI-generated content.
• 17.2 The Governance Team and IT shall investigate and document incidents. Where legal or regulatory reporting may be required, the Organization shall use outside legal or compliance support as needed because no in house attorney is available.

18. Records and Retention

• 18.1 The Organization shall retain records of AI approvals, vendor reviews, risk assessments, training, and significant incidents according to its retention schedule and legal obligations.
• 18.2 When a tool or vendor relationship ends, access must be removed, data return or deletion must be confirmed, and any remaining records must be handled according to retention requirements.

19. Violations

• 19.1 Any violation of this Policy may result in retraining, removal of access, disciplinary action, vendor termination, or other corrective measures appropriate to the circumstances.
• 19.2 No employee is authorized to bypass this Policy because a tool is convenient, fast, or recommended by a vendor.

20. Review and Updates

• 20.1 This Policy shall be reviewed at least annually and updated sooner if business operations, AI tools, regulations, or risk conditions change.
• 20.2 The Policy should remain simple enough for non-technical staff to follow while still strong enough to protect customers, employees, and the business.

Appendix A: Employee Quick Guide

• Use only approved AI tools.
• Keep customer and employee information out of public AI tools.
• Have a person review AI output before using it.
• Ask if you are unsure.

• Paste credit applications, Social Security numbers, or payment data into AI tools.
• Use AI to make final credit, pricing, or employment decisions.
• Use AI to write something misleading or unsupported.
• Ignore access, privacy, or security rules.

Signature Lines

Approved by:

Name: _________________________________

Title: _________________________________

Signature: _____________________________

Date: _________________________________

Reviewed by:

Name: _________________________________

Title: _________________________________

Signature: _____________________________

Date: _________________________________

Policy Owner:

Name: _________________________________

Title: _________________________________

Signature: _____________________________

Date: _________________________________