At ASOTU CON, Eric Davis, Director of Strategic Accounts at Tekion,  and Kristen Shaffer, Account Exec at Tekion, discussed the common AI security risks taking place in dealerships right now. Salespeople, service advisors, and BDC teams often feed customer information into personal ChatGPT accounts to assist with tasks like pitching upsells, drafting emails, or summarizing customer history.

According to studies Davis cited, 77% of AI usage in businesses today happens through personal accounts with no corporate oversight. In a dealership, that unmonitored AI use results in one personal data breach every two to three weeks at minimum.

"So dangerous," Davis said. "It's really about the responsibility of how you're deploying AI in your organization."

Where Unified Data Changes Everything

The bigger problem isn’t individual team members; it’s that most dealerships are feeding AI from fragmented sources—their DMS, CRM, third-party applications. When data is scattered across multiple systems, AI can't see the complete picture. And even more critical: dealerships can't govern it.

Tekion's approach is different—one platform, one data layer, and one place to audit and control how AI is actually being used. "With native embedded AI, it gets the entire picture, not just pieces of the puzzle that it has to figure out how to work together," Shaffer explained.

ISO 42001: What It Means

Tekion became one of the first automotive companies to secure ISO 42001 certification—an independent audit of how the company governs responsible AI use. This certification covers how Tekion governs responsible use of AI within its own business and within its platform.

"If you're using embedded Tekion AI in your platform, you're doing it in literally the most secure way possible, independently audited," Davis said.

The Real Question

You can't prevent your team from using AI. But you can choose a platform that forces governance into the architecture from day one—not bolted on after the fact. Before you adopt any new AI capability, ask your vendor one question: Can you govern it? That's the difference between responsible AI and AI risk.

‍