This checklist is designed to help franchise new vehicle dealerships and dealer groups evaluate AI-powered and AI-enhanced vendor solutions across operational, financial, technical, legal, compliance, and strategic dimensions.

1. Business Outcome & ROI Validation

• What dealership process does this solve for?

  Expected Answer: A highly specific operational bottleneck, such as BDC after-hours lead follow-up, service scheduling, inventory pricing adjustments, or RO transcription. It should not be a "does-everything" vague promise.

• Which departments will use AI?

  Expected Answer: Clear identification of the end-users (e.g., BDC agents, Service Advisors, Sales Managers, or F&I).

• Is the solution designed specifically for automotive retail?

  Expected Answer: Yes. General AI tools often fail to grasp dealership nuances (lease vs. finance structures, OEM incentives, complex DMS workflows).

• Can the vendor provide dealership-specific ROI case studies?

  Expected Answer: Yes, backed by verifiable metrics (e.g., "Increased appointment show rates by 15% at a Toyota dealership of a similar size").

• How is ROI measured?

  Expected Answer: Through direct integration with your CRM/DMS to track hard metrics (e.g., Cost Per Lead, gross profit increase, hours of labor saved).

• What operational costs are reduced?

  Expected Answer: Concrete savings, such as reduced BDC staffing overhead, lowered third-party marketing spend, or consolidation of redundant software subscriptions.

• What Key Performance Indicators (KPI) will prove success?

  Expected Answer: Lead-to-appointment ratio, appointment show rate, service RO time, close rate, or customer acquisition cost (CAC).

2. Data Ownership, Privacy & Governance

• Does the dealer retain rights and ownership of their data?

  Expected Answer: Yes, absolutely. The contract must explicitly state that the dealership retains full ownership of its first-party data.

• Can we audit the API connections used?

  Expected Answer: Yes. Vendors should provide transparent technical documentation of all endpoints and data transfers.

• Can the vendor use dealership data to train its models?

  Expected Answer: Ideally, no. If yes, the data must be strictly anonymized and aggregated. First-party non-public information (NPI) should never be used to train foundational public models.

• If a vendor or product can use dealership data to train its models, can the dealership opt out of model training?

  Expected Answer: Yes. An opt-out mechanism must be legally written into the contract.

• If the AI system has access to nonpublic personal information (NPI), does the contract comply with all service provider requirements under the FTC Safeguards Rule?

  Expected Answer: Yes. This is a non-negotiable legal requirement for automotive compliance.

• Is customer data shared with third parties?

  Expected Answer: No, unless explicitly required to execute the service (e.g., an SMS routing gateway), and only if covered by a strict Data Processing Agreement (DPA).

• Is the vendor SOC 2 (cybersecurity audit) certified? Where are your servers located?

  Expected Answer: Yes, SOC 2 Type II is preferred. Servers should be located domestically (e.g., US-based AWS/Azure) to comply with local privacy laws.

• What kind of encryption is used?

  Expected Answer: Industry-standard AES-256 for data at rest and TLS 1.2+ for data in transit.

• What party is liable if there is a data breach?

  Expected Answer: The vendor must carry liability for breaches originating on their platform or through their APIs, backed by substantial cyber liability insurance.

• What party is liable if the AI generates a work product that is copyrighted?

  Expected Answer: The vendor should offer IP indemnification, protecting the dealership from any copyright infringement claims generated by the AI.

• What datasets is the AI trained on?

  Expected Answer: Transparent disclosure of base models (e.g., OpenAI, Anthropic) fine-tuned exclusively on verified, compliant automotive retail data.

3. AI Transparency & Trustworthiness

• Have you reviewed the development and performance history?

  Expected Answer: The vendor should eagerly provide a changelog, system uptime history, and a roadmap of model iterations.

• Can you confirm the accuracy of an output?

  Expected Answer: Yes, through accessible audit logs, chat transcripts, and system confidence scoring.

• How does the platform reduce hallucinations?

  Expected Answer: By utilizing Retrieval-Augmented Generation (RAG), strict prompt guardrails, and limiting the AI's knowledge base purely to approved dealership policies.

• Who is liable if there is a hallucination?

  Expected Answer: The vendor should take responsibility for systemic logic errors, though contracts often try to push liability to the dealer for "final oversight." This requires careful legal review.

• How do you protect against prompt injections?

  Expected Answer: Strict input sanitization, system-level guardrails, and role-based access control (RBAC). Customers should not be able to "trick" the AI into offering a car for $1.

• What safeguards prevent incorrect customer information?

  Expected Answer: Hard-coded logic rules (e.g., "Never promise a specific vehicle price or interest rate without DMS validation") and real-time CRM syncing.

• Has the AI been evaluated for discriminatory bias?

  Expected Answer: Yes. The vendor must have compliance checks against Fair Lending and Equal Credit Opportunity Act (ECOA) violations.

• Are humans kept in the loop for critical workflows?

  Expected Answer: Yes, especially for final pricing negotiations, financing approvals, or sensitive customer escalations. AI should tee up the deal, not finalize it unsupervised.

• Who carries the cyber insurance policy?

  Expected Answer: Both parties. The vendor covers their infrastructure and API endpoints; the dealership covers its own internal operations and endpoints.

4. Automotive Retail Integration Capability

• Which DMS systems are supported?

  Expected Answer: The major players (CDK, Reynolds & Reynolds, DealerTrack, Tekion, Auto/Mate, etc.).

• Which CRM platforms are integrated?

  Expected Answer: Key systems like VinSolutions, Elead, DriveCentric, DealerSocket, etc.

• Does the solution integrate with OEM systems? Which ones, by OEM?

  Expected Answer: Certified integrations with specific OEMs (e.g., GM, Ford, Toyota) for live incentives, build data, and inventory syndication.

• Are APIs open and documented?

  Expected Answer: Yes, standard REST or GraphQL APIs with easily accessible developer documentation.

• Can dealership data be exported easily?

  Expected Answer: Yes, via CSV, API, or automated SFTP drops, without exorbitant "ransom" or "data retrieval" fees.

• What data feeds are used, if applicable, and why?

  Expected Answer: Inventory feeds (vAuto, HomeNet) for accurate pricing/availability, and DMS/CRM feeds for service history and customer profiling.

• How does the AI read the stated system (DMS/CRM, etc.)?

  Expected Answer: Bi-directional, secure API integration (read/write). Avoid tools that rely on fragile "screen-scraping."

5. Operational Readiness

• What is implementation time?

  Expected Answer: 2 to 8 weeks, depending on the complexity of DMS/CRM integration approvals and OEM certification requirements.

• What dealership resources are required?

  Expected Answer: A dedicated project champion (usually a GSM, BDC Manager, or IT Director) required for a few hours a week during the onboarding phase.

• What training is provided?

  Expected Answer: Live virtual onboarding, on-demand video libraries, and role-specific training (e.g., a module for BDC, a module for Sales).

• How is user adoption measured?

  Expected Answer: Through login frequency, feature utilization rates, and task completion metrics visible on an admin dashboard.

• What are support SLA response times?

  Expected Answer: Under 1 hour for critical/system-down issues; under 24 hours for standard inquiries.

• How disruptive is implementation?

  Expected Answer: Minimal. It should run in parallel to existing systems in a sandbox environment until "flipped on."

• What personnel has access to the AI system?

  Expected Answer: Managed via Role-Based Access Control (RBAC). A BDC agent should only see their tasks; GMs should see global settings.

6. Financial & Contractual Review

• Is pricing subscription-based, usage-based, or performance-based?

  Expected Answer: Clearly defined. Flat subscription (SaaS) or performance-based (pay per shown appointment) is best. Avoid uncapped usage-based pricing which penalizes you for scale.

• Are there implementation or support fees?

  Expected Answer: A one-time setup fee is standard, but ongoing support and software updates should be included in the baseline monthly fee.

• What is the contract term?

  Expected Answer: Typically, 12 months. Be wary of 36-to-60 month lock-ins without a clear "out-clause" for non-performance.

• Is there auto-renewal?

  Expected Answer: Yes, usually with a 30-to-60 day opt-out window. Management must calendar this date.

• Is there a pilot or trial option?

  Expected Answer: Yes. A 30-to-90 day paid pilot or proof-of-concept (POC) with clear KPIs and easy cancellation.

• What happens if the vendor is acquired?

  Expected Answer: A successor clause stating your contract terms remain intact, with the right to terminate if service levels degrade under new ownership.

7. Department-Specific Evaluation

• Does AI improve lead response speed?

  Expected Answer: Yes, initial response times should drop to under 2 minutes, operating 24/7.

• Does AI improve appointment show rates?

  Expected Answer: Yes, via automated, conversational confirmation nudges and dynamic rescheduling abilities.

• Can the AI handle inbound and outbound calls autonomously?

  Expected Answer: Requires strict scrutiny. Text/Email AI is proven; Voice AI is emerging and requires rigorous review for TCPA compliance and customer experience quality.

• Can campaigns be personalized automatically?

  Expected Answer: Yes, triggering intelligently off DMS data (e.g., lease maturity dates, equity mining, declined service follow-ups).

• How does AI improve the efficiency of the process?

  Expected Answer: By automating tedious data entry and initial follow-ups, allowing human staff to focus on high-value relationship building and closing.

• Share AI capabilities specifically related to inventory management.

  Expected Answer: Automated, SEO-friendly vehicle descriptions, dynamic pricing recommendations based on market days’ supply, or predictive stocking insights.

• Are scopes and permissions user based or blanketed?

  Expected Answer: User-based. Blanket permissions are a major security risk.

• Describe actionable AI capability of this solution.

  Expected Answer: The AI should act, not just analyze. (e.g., It should not just suggest calling a lead; it should autonomously text the lead and book the appointment directly into the CRM calendar).

• Does the AI create compliance risks in F&I?

  Expected Answer: It can. The vendor must prove the AI is hard-coded to never quote unauthorized rates or violate Truth in Lending (TILA) / Fair Lending laws.

8. Performance Measurement & Reporting

• Are dashboards customizable?

  Expected Answer: Yes, allowing dealer principals to see macro-ROI and department managers to view granular, user-level statistics.

• Can reports be exported?

  Expected Answer: Yes, easily to CSV, Excel, or via API into the dealership's enterprise business intelligence (BI) tool.

• How are conversions attributed?

  Expected Answer: Transparent multi-touch or first/last click attribution tied directly to CRM/DMS sales records, preventing the vendor from claiming false credit for sales.

• Are quarterly business reviews included?

  Expected Answer: Yes, a dedicated Customer Success Manager (CSM) should meet with

9. Risk Assessment

• What happens if the platform goes offline?

  Expected Answer: Automatic failover to human/legacy processes. No loss of CRM data or dropped customer communications.

• Is there disaster recovery?

  Expected Answer: A documented Disaster Recovery (DR) plan with a Recovery Time Objective (RTO) and Recovery Point Objective (RPO) measured in hours, not days.

• Can dealership management approve outbound messaging?

  Expected Answer: Yes. Tone, cadence, and baseline templates must be customizable and require management sign-off before deployment.

• Could the AI damage customer trust?

  Expected Answer: Yes, if poorly configured. The vendor must demonstrate seamless "human handoff" protocols if the AI cannot answer a question or if a customer becomes frustrated.

10. Final Executive Decision Questions

• Would we still buy this solution if it does not incorporate AI?

  Expected Answer: Yes. The underlying software and workflow must solve a real problem. "AI" should not be a buzzword masking a poorly built tool.

• Is the vendor solving a real operational problem?

  Expected Answer: Yes. (e.g., "We lose 30% of our weekend leads because the BDC is closed." -> The AI solves this by answering 24/7).

• Will this platform scale with our organization over 3–5 years?

  Expected Answer: Yes, the architecture should support adding rooftops, new franchises, and multi-store reporting.

• Does this strengthen or weaken customer relationship ownership?

  Expected Answer: It should strengthen it by removing administrative friction, allowing dealership personnel to spend more face-to-face or phone time with the customer.

• What measurable business outcome would justify renewal?

  Expected Answer: A predefined metric, such as: "The AI must generate enough incremental service appointments to cover 3x its monthly subscription cost."

Major Red Flags

• Vendor cannot clearly explain how the AI works, including what systems, APIs, etc.

  Expected Standard: Walk away. "Black box" AI is a massive operational and legal risk. If they cannot explain the tech stack simply, they likely do not own it.

• No dealership references available

  Expected Standard: Pause. Automotive retail is a highly specific, complex niche. You do not want your dealership to be their beta test.

• No automotive retail specialization

  Expected Standard: Proceed with extreme caution. Generalist platforms usually fail at handling complex DMS integrations, OEM incentives, and auto compliance.

• Weak compliance documentation

  Expected Standard: Dealbreaker. Violations of the FTC Safeguards Rule, TCPA, or ECOA carry massive federal fines and class-action lawsuits.

• Excessive long-term contract lock-in

  Expected Standard: Renegotiate. Never sign a 3-to-5-year agreement for rapidly evolving AI technology unless there are clear, performance-based out-clauses.

• AI outputs cannot be audited

  Expected Standard: Reject. If you cannot see exactly what the AI is texting or emailing your customers, you have zero control over your brand reputation or legal liability.