AI Agents for Auto DealershipService Departments in 2026

Fixed operations is where the AI pitch decks land hardest in a franchise dealership. Book more appointments. Draft the repair order. Chase declined work. Catch warranty claims before they bounce. Every one of those is a real workflow with real hours attached to it, and every one of them runs into the same wall within about two weeks of a pilot starting.

The wall is the dealer management system. The DMS holds the customer, the vehicle, the repair order, parts inventory and pricing, the accounting ledger and the warranty claim. Nothing in fixed ops is real until it is an RO in the DMS. Your scheduling tool, your CRM, your texting platform and your inspection app all sit above it and all eventually have to reconcile to it. So the question that decides whether an agent ships is not whether a model can draft a good three-C story. It is whether anything the agent produces can get into the DMS, who is contractually permitted to put it there, and what that permission costs.

This is the sentence the whole cluster hangs on, and dealerships are its clearest illustration: an agent can only be as autonomous as its write path allows. In a dealership the write path is governed by an agreement between your DMS vendor and your integration vendor to which you, the dealer, are generally not a party — even though the data is about your customers and your vehicles.

The vendor landscape matters here because it is concentrated. The dominant DMS providers to franchise dealers are CDK Global, owned by Brookfield since 2022, and The Reynolds and Reynolds Company, alongside Dealertrack DMS from Cox Automotive and Tekion, with smaller players including Autosoft, Dominion, PBS and DealerSocket, now part of Solera. The Federal Trade Commission, in its 2018 challenge to CDK's proposed acquisition of Auto/Mate, described CDK and Reynolds as the two largest providers of DMS software to new-vehicle dealers in the United States.

Here is the map of fixed ops as a set of write paths rather than as a set of features. Read the third column first — it is the one that decides your architecture.

Fixed-ops systems of record as of August 2026. The write-control column reflects certified-integration programme structure as described in vendor materials and in public litigation and forum artefacts; no DMS vendor publishes a certification or fee schedule.

Notice the last row. The deepest published write path in service scheduling belongs to a product inside the same corporate family as the DMS it writes to: Cox's Xtime markets bi-directional repair-order management — opening and editing ROs from Xtime — and parts lookup and writeback of labor and parts from service appointments, specifically into Dealertrack DMS. That is Cox writing into Cox. We could not source a comparable statement of write depth for Xtime against CDK or Reynolds, and we do not assume one exists. The asymmetry is the story: the vendor that owns the system of record can grant itself a write path it does not have to sell to anyone else.

Across this cluster we use a five-rung ladder to describe integration options, defined in the pillar on integrating agents with legacy and closed systems: documented public API, certified partner programme, EDI or batch file, screen scraping and RPA, and no path at all. Each rung down means less vendor cooperation, more fragility and more contractual exposure.

Dealership fixed ops sits, for practical purposes, on rung two — with rung three doing a lot of quiet, unglamorous work and rung four doing more than anyone likes to admit.

The integration ladder applied to dealership fixed operations, August 2026.

Rung four deserves an honest treatment rather than a euphemism, because in this industry it is frequently what is actually happening behind the word "integration." A robot driving your DMS interface with a real user's credentials is technically possible almost everywhere. It is also structurally fragile — you are consuming a presentation layer the vendor may change without notice or versioning — and it is contractually exposed in a way that public-web scraping is not.

The case everyone cites for the legality of scraping does not say what it is usually said to say. In hiQ Labs v. LinkedIn (9th Cir., No. 17-16783, filed 18 April 2022) the Ninth Circuit was reviewing a preliminary injunction under its sliding-scale standard, and what it actually concluded was narrow. In the panel's own words: "HiQ has therefore raised serious questions about whether LinkedIn may invoke the CFAA to preempt hiQ's possibly meritorious tortious interference claim." A serious question is not a holding that something is legal.

And hiQ then lost. On remand, a November 2022 summary judgment held that hiQ had breached LinkedIn's user agreement through automated scraping and through hiring crowdsourced workers to create fake profiles, and that website terms prohibiting scraping and fake accounts are enforceable in a breach-of-contract claim. In December 2022 a stipulated consent judgment imposed $500,000 plus a permanent injunction requiring hiQ to stop scraping LinkedIn and to destroy source code, data and algorithms derived from scraped profile data. The CFAA claim was never decided on the merits.

The Supreme Court left the decisive question open. In Van Buren v. United States the Court held that an individual "exceeds authorized access" when he accesses a computer with authorization but then obtains information located in particular areas of the computer—such as files, folders, or databases—that are off limits to him." But it expressly reserved the part that matters to a dealer: "For present purposes, we need not address whether this inquiry turns only on technological (or 'code-based') limitations on access, or instead also looks to limits contained in contracts or policies."

One more thing this rung does not do: it does not get better because you put a modern protocol in front of it. The Model Context Protocol's current specification, dated 2026-07-28, is a stateless rewrite of the prior stable version — real engineering, genuinely useful, and completely orthogonal to your problem. MCP standardizes how a tool is described and called. It does not decide whether your agent may issue a write into a system whose access is governed by a certified-integration agreement. MCP is a wrapper around whatever rung you were already on.

CDK runs Third Party Access. Reynolds runs the Reynolds Certified Interface. Both are gated, contract-based programmes that a software vendor must join to obtain sanctioned DMS access, and both companies publicly justify them on security grounds. This is the rung where the real gatekeeping lives, and — as in every industry in this cluster — it is the rung where the costs are least visible before you commit.

Start with what is actually published. CDK's public API page lists a Data Extract API Bundle, Business Office APIs, Modern Retail APIs, Fixed Operations APIs and Parts APIs. On commercial terms it says only: "We offer pay-as-you-go options." There are no certification criteria on it, no approval requirements, no dealer-consent process, and no fees. Fortellisis CDK's developer marketplace.

On the Reynolds side we hold no fetched programme language at all — the RCI third-party page rendered as title-only to our fetcher — so we do not characterize its terms, and we do not put quotation marks around anything attributed to Reynolds. We can say only that the programme exists and that it is gated.

Because the vendors publish nothing, it is worth setting out every figure in circulation next to what it actually is. This is the sort of table that makes a vendor conversation shorter.

Every figure above is either practitioner testimony from a July 2017 DealerRefresh forum thread or an allegation pleaded in an antitrust complaint. None is a current published price, and we do not present any of them as one.

The most durable item in that table is the third row, and it is worth stating on its own because it drives your entire architecture: the 2017 forum thread contains images of a CDK pricing guide that distinguished Extract-Only Pricing from Data Writeback Packages, priced per dealer per month and marked subject to change. Reading is one commercial tier. Writing is another. Any plan that assumes a read integration entitles you to write is a plan with an unpriced line item in it.

There is a useful period detail on how thinly write access was available even for the most obvious fixed-ops use case. On a Fortellis community thread in April 2019, a CDK staff member wrote that the Appointments API had not yet been published and was in testing, and that its pricing would likely be released at the same time as the API. That is seven years old and we do not present it as the current state of anything. What it illustrates is that service scheduling — the single most commonly pitched fixed-ops integration — was not generally available at a published price at a point when the industry already assumed it was.

Model the certified-programme fee as per-interface, recurring, and forever. Then ask which party is paying it — you or your software vendor — and what happens to your price when their fee changes. In a market where neither DMS vendor publishes a schedule, the party that absorbs an unpublished, unilaterally variable cost is the party carrying the risk.

— Frenchy Digital procurement principle

Dealership data access has a longer and better-documented legal history than almost any integration question in this cluster. It is also the subject most often overstated in trade writing, usually in the direction of "the courts opened up DMS data." They did not. What follows is the record with the posture stated exactly, because a partial dismissal is not a denial, a vacated injunction is not a merits loss, and a settlement is not a finding.

Litigation record as of August 2026. Settlement figures and the FTC matter are trade-sourced; the Seventh and Ninth Circuit opinions are reported at 874 F.3d 1019 and 16 F.4th 1266 respectively.

Three points from that table deserve to be pulled out.

• The duty-to-deal holding is the operative law: In Authenticom, decided 6 November 2017, Chief Judge Diane Wood wrote for a unanimous Seventh Circuit panel vacating a preliminary injunction that had ordered continued access. The panel held the injunction exceeded the proper scope of preliminary relief, did not preserve the status quo, and improperly imposed a duty to deal — and that the proper Sherman Act section 1 remedy is to set aside an offending agreement rather than to compel access. Note the date: the citation is 2017, not 2018, and November, not October. Both errors circulate.
• The $630 million settlement is the one about integration, and it is the one nobody quotes: The dealer-class figure of $129.5 million is the number that reached general trade coverage. The vendor-class settlement of $630 million is defined by a class of 243 companies that had purchased data integration services — meaning the price of access to the DMS is literally what that class bought and what that settlement is about. Lead with $630 million; mention $129.5 million as the separate dealer-side recovery. We could not verify which court entered the $630 million approval, with trade reports split between the Northern District of Illinois where the MDL sits and a federal court in Madison, Wisconsin, so we give the date and name no court.
• The FTC treated integration fees as a dimension of competition: In its March 2018 administrative complaint over the Auto/Mate acquisition, the FTC described the target as having won business on lower prices, flexible contract terms, free software upgrades and training, service quality — and modest fees to integrate third-party applications. That last item is the reason this matter belongs in an article about AI agents: a federal antitrust agency treated the level of third-party integration fees as a competitive dimension worth protecting. The parties abandoned the transaction rather than litigate. We note that ftc.gov returns a 403 to our fetcher, so we have not read the agency document directly; the characterization above is corroborated in contemporaneous trade coverage of the release and we paraphrase rather than quote it.

Then there is the legislative route, which turned out to be the more effective one. Arizona's Dealer Data Security Law, A.R.S. sections 28-4651 and following, enacted in March 2019, attacks the problem directly: it bars DMS providers from acting by contract, technical means or otherwise to prohibit or limit a dealer's ability to protect, store, copy, share or use DMS data; bars charges beyond direct costs incurred for database access; and requires DMS providers to adopt and publish a standardized data-exchange framework. Reporting also describes a right for dealers to terminate DMS contracts on ninety days' notice.

CDK and Reynolds sued, arguing preemption by the Copyright Act and the Computer Fraud and Abuse Act, plus Contracts Clause, Takings Clause and vagueness theories. A unanimous Ninth Circuit panel affirmed the denial of a preliminary injunction on 25 October 2021 in CDK Global LLC v. Brnovich, 16 F.4th 1266. Comparable statutes exist in Oregon at ORS 650.123, and in Montana and North Carolina among others.

With the write path understood, the workflow question becomes tractable. The pattern that works in fixed ops is the same one that works in every closed-system industry: the agent does the reading, the assembling, the cross-checking and the drafting, and a named human performs the act that has a consequence. Nearly all the labour saving lives in the first four verbs.

Fixed-ops agent workflows and their commit boundaries. Every write into the DMS assumes a sanctioned, dealer-authorized path.

A few notes on the ones that surprise people.

Scheduling is not one system. The appointment usually lives in a scheduling layer, the customer and vehicle live in the DMS, and shop capacity lives in whichever of the two your store actually trusts. An agent that books appointments has to reconcile all three, and in our experience the failure that ends a scheduling pilot is rarely a bad model — it is the agent booking against capacity the shop had already committed elsewhere. Build the capacity check as a hard gate, not as context in a prompt.

RO drafting is the highest-value read-only workflow in the department.An agent that produces a clean, complete three-C story from the customer's own words, with a suggested opcode and the parts likely to be required, saves advisor time on every single ticket and improves the downstream warranty claim without ever touching a write path. If you only do one thing, do this one, and do it in draft-only mode for a quarter before you argue about writeback pricing with anybody.

Declined-work follow-up is where consent law bites. The list is easy to build and the outreach is where dealers get into trouble. Any automated voice outreach is governed by the TCPA position set out below, and the value of the workflow depends entirely on having a consent register that is real, current and honoured immediately on revocation.

Warranty is the sharpest boundary in the article, and it is worth understanding why the boundary is structural rather than a matter of caution.

Franchise dealers do not choose their warranty path. OEM certification of the DMS is a precondition, and the OEM-certified interfaces carry warranty claim submission, incentive reporting, parts ordering, inventory feeds and monthly financial-statement submission. That is a second layer of certification sitting on top of the DMS vendor's own programme — and it is one reason the FTC's Auto/Mate complaint mentioned both modest third-party integration fees and a full roster of OEM certifications as things the market was losing.

For an agent, this means the useful work sits entirely before submission.

Warranty workflow boundaries. Operational detail about labor operations, parts and fail codes is drawn from vendor-adjacent trade writing and is described here as practitioner observation, not as a published rule.

The retail warranty reimbursement side is quietly the most agent-shaped work in the whole department. State statutes generally require manufacturers to reimburse dealers for warranty parts and labor at retail rates, usually keyed to the dealer's declared non-warranty retail rate, and typically overriding contrary language in the dealer agreement. Parts reimbursement is commonly computed by multiplying dealer cost by one plus the dealer's average percentage markup derived from a sample of qualifying non-warranty repairs.

That is a data-assembly task with statutory exclusion rules, performed infrequently, usually by someone who has other things to do, and worth real money when it is done well. An agent can assemble the qualifying sample, apply the exclusions, compute the proposed rate and produce the evidence file. A controller reviews it and files it. Nobody automates the assertion.

Two regimes shape what an AI agent may do in a dealership, and both are frequently absent from vendor conversations until somebody's counsel joins the call.

The first is the GLBA Safeguards Rule, 16 CFR Part 314. Auto dealers are financial institutions under it because they arrange consumer credit. That framing surprises people who think of the rule as a bank obligation, and it has a direct consequence for AI procurement: every third party touching dealer customer data is a service provider you must select, contractually bind and oversee under 314.4(f). That subsection is the compliance hook for the entire question of who is allowed to write to your DMS.

Most of the 2021 amendments took effect on 9 June 2023. The breach-notification amendment took effect on 13 May 2024 and requires reporting to the FTC within 30 days of discovering unauthorized acquisition of unencrypted information of 500 or more consumers. Here is the rule mapped element by element onto an agent deployment.

Safeguards Rule element list compiled from practitioner guidance; the FTC's own dealer FAQ returned an HTTP 403 to our fetcher, so we cite it and treat the element list as secondary. Confirm the specifics with counsel.

The second regime is the TCPA, and it contains the single most load-bearing legal fact for any outbound AI voice in fixed ops. On 8 February 2024 the FCC adopted a Declaratory Ruling, FCC 24-17, holding that an AI-generated voice is an "artificial or prerecorded voice" under the statute. It took effect on adoption. Calls using one require prior express consent — and prior express written consent if the content is marketing.

One more moving part: the FCC's revoke-all rule, under which a single revocation ends future calls and texts from that caller on unrelated subjects, has had its effective date pushed twice. It was originally due on 11 April 2025; the Consumer and Governmental Affairs Bureau delayed it by a year on 7 April 2025, and on 6 January 2026 extended the effective date again to 31 January 2027. The right engineering response is not to wait. Build revocation handling that already behaves as though the rule is live, because that is the behaviour you will need and because the alternative is a data-model change under time pressure.

Two adjacent items are worth knowing so you do not plan around a rule that no longer exists. The FTC's CARS Rule — Combating Auto Retail Scams, promulgated in December 2023 — was vacated by the Fifth Circuit on 27 January 2025, two to one, on procedural grounds: the Commission proceeded under section 18(a)(1)(B) without the required advance notice of proposed rulemaking, depriving NADA and TADA of a procedural benefit. The rule is not in effect and the FTC would have to restart rulemaking. Separately, Massachusetts' right-to-repair and telematics law was upheld by a federal judge in February 2025; Auto Innovators appealed to the First Circuit, No. 25-1262; at oral argument on 3 February 2026 Auto Innovators conceded that its members could comply as the district court had construed the law; and on 25 February 2026 the Massachusetts Attorney General declined mediation. The case remains pending. Enforcement began on 1 June 2023, and Subaru and Kia responded to the earlier law by disabling telematics on Massachusetts-sold vehicles.

Certified access in this industry is, in practice, read-first. The read path is the one vendors sell readily and describe in their materials; the write path is a separate commercial decision, separately priced and separately gated, and in some places it does not exist for third parties at all. That means every write your agent performs is vendor-discretionary — permitted by an agreement that can be renegotiated, repriced or not renewed.

Which is why the most valuable hour in an agent programme is not spent with an engineer. It is spent on a call with your DMS representative and your software vendor together, working through the following list, and writing down the answers. Take the good-answer column as a script.

Write-path due diligence checklist. Ask both parties in the same meeting; the disagreements are the most informative part.

When you get the answers, three architectural decisions follow almost automatically. If writes are unavailable or unaffordable, you build a drafting agent and a good review surface, and you capture most of the value. If writes are available but narrow, you build to the narrow surface and you never let the agent improvise around a field it cannot write. And if writes are available and broad, you still put a human on the commit for anything with a financial, warranty or safety consequence — because the constraint there is not the contract, it is the consequence.

A note on identity while you are at it. Give the agent its own identity rather than running it as a member of staff. Microsoft's own agent-identity documentation makes the argument well: application identities carry "the expectation of long-term stability, known ownership, and managed lifecycle," whereas an agent "might exist for minutes during a specific task, or might be created and destroyed thousands of times per day."The practical dealership consequence is mundane and important — if the agent acts through a person's account, your audit log says a person did it, and you cannot answer a Safeguards question or an OEM warranty audit cleanly.

This is the table to print and put on the service director's wall. The principle underneath it is simple: an agent may act alone where the action is reversible, low-stakes and bounded by rules a human wrote in advance. Everything with a financial, warranty, legal or safety consequence gets a named human signature.

Human-in-the-loop boundaries for a dealership service department. Boundaries move down the table over time, never up by default.

The security literature arrives at the same boundary from a different direction, which is a good sign that it is the right one. The 2026 edition of the OWASP GenAI LLM Top 10, published on 4 August 2026, lists LLM01:2026 Prompt Injection, LLM03:2026 Excessive Agency and LLM10:2026 Improper Output Handling. For an agent with tool access to production systems, LLM03 and LLM10 are the priority pair, and the mitigations cited for excessive agency are exactly least privilege, confirmation for high-impact actions, and tool-usage logging — the three columns of the table above.

The dealership translation is direct. Your agent reads customer texts, forwarded emails, supplier PDFs and OEM bulletins — all content written by people outside your control. If that same session also holds a DMS write credential and can send outbound messages, you have assembled all three legs. Remove one. In practice that means the reading agent runs against a replica with no write credential, and the writing step happens in a separate, narrowly-scoped context that a human has approved.

It is worth being precise about what protocols do and do not contribute here. The MCP specification's security best-practices document contains genuine normative requirements — servers must not accept tokens that were not explicitly issued for them, proxy servers must obtain per-client consent before forwarding, redirect URIs must be validated by exact string matching rather than pattern matching, and scope minimization is called out by name with expanded blast radius, privilege chaining and audit noise as the risks. Every one of those is a blast-radius control. None of them prevents injection. That the specification's own security document is entirely about containment is the clearest possible signal about the state of the field.

This is the part most articles skip, and it is the reason this one exists. What follows is a phased path with an owner, an entry criterion, an exit criterion and a documented failure response for each phase. The failure responses matter more than the exits: a programme that has not decided in advance what it does when a phase fails will simply carry on into the next one.

A twenty-week path from contract review to narrow autonomy. Weeks are indicative; the criteria are not.

Two things about this sequence are deliberately unusual. The first is that Phase 0 is a legal and contractual phase, not a technical one, and it comes before workflow selection. In most industries you would pick the workflow first. In a dealership, the contract determines which workflows are even candidates, so doing it in the other order wastes a discovery cycle.

The second is that the shadow-mode threshold in Phase 2 is set in Phase 1, before anyone has seen a result. Thresholds chosen after the fact are not thresholds; they are rationalizations. Write the number down, in the statement of work, with the workflow owner's name next to it.

Every failure mode below has been chosen because it is specific to dealership fixed ops rather than generic to software. Each one gets a detection signal, because a failure you cannot see is a failure you discover from a customer.

Failure modes ranked roughly by how often we see them, not by severity.

The sixth row deserves expansion because it is the one dealers have lived through. In June 2024, BlackSuit ransomware hit CDK Global on 18 and 19 June, with a second intrusion on 19 June during recovery. Roughly 15,000 dealer locations in North America were affected, and phased restoration ran to about 4 July. CNN and others reported that CDK likely paid a ransom of around 25 million dollars.

Anderson Economic Group estimated $1.02 billion in direct losses to franchised dealers over the three calendar weeks including 19 June through 5 July 2024, revised up from an initial estimate of $944 million. Their methodology is published: roughly 56,200 lost new-unit sales plus lost used-vehicle earnings, lost parts-and-service earnings, added staffing and IT cost, and added floorplan interest, corroborated against public dealer groups' investor disclosures — and it explicitly excludes consumer damages, reputational damage and litigation costs.

The design conclusion from that episode is not about vendor selection. It is that your agent needs a documented degraded mode: what it does when the DMS is unreachable, what it captures offline, how a service department keeps writing ROs on paper, and how the agent reconciles that capture when service returns. Almost nobody builds this before they need it. We have no data on which departments recovered fastest in 2024 and we are not going to invent any — the argument for rehearsing a paper process is simply that a department that has never rehearsed one will be inventing it under maximum pressure.

Fixed ops attracts a lot of AI vendors, and the good ones are easy to distinguish from the rest with a short list of questions. Each red flag below is diagnostic rather than disqualifying — but each one tells you something specific about how the vendor will behave on the facts you cannot check.

Vendor selection red flags for dealership fixed-ops AI, August 2026.

The third row is the one we would defend hardest, because it is where our own approach differs from the market. There is no independent, methodologically-disclosed benchmark for service-agent accuracy, booking rate, containment or deflection in this category. Every figure in circulation is vendor-published, usually with no sample size, no baseline and no description of what counted as a success. We do not reprint them, we do not score vendors on them, and we would encourage you to treat their presence in a deck as information about the vendor rather than about the product.

The same discipline applies to the claim that a DMS vendor is difficult and a challenger is open. Openness is a contract, not a temperament. Ask for the agreement.

These are Frenchy Digital's published bands. They are the same across this cluster, because the engineering discipline is the same whatever the system of record happens to be called.

Frenchy Digital engagement bands, August 2026. These figures exclude any certified-integration programme fee charged by your DMS vendor, which is not published by any DMS vendor and must be quoted to you separately.

• Senior-led rates: $150–$225 per hour. There is no junior bench doing the work under a senior byline.
• Ongoing retainer: $2,500–$9,500 per month for operation, evaluation maintenance, model-version management and integration monitoring.
• Post-launch warranty: 30 days. If something we shipped is broken, we fix it inside the engagement.
• Proposal turnaround: A written, fixed-price phased proposal within 5 business days of discovery.
• Ownership: Full source-code and IP ownership transfers to you at delivery. No vendor lock-in, no hostage data model, and your evaluation set is yours.
• Who we are: A senior-led Black-owned Los Angeles agency. Reachable at +1 (424) 272-5601.

One budgeting note specific to this industry: leave a line for the interface fee and leave it unpriced. Because neither major DMS vendor publishes a schedule, you cannot responsibly estimate it, and putting a made-up number in a capital request is worse than putting a placeholder with a named owner and a date by which it will be resolved. Phase 0 exists to convert that placeholder into a written number before the build starts.

This section is the point of the article as much as any other. What follows is a specific list of things we chased and could not establish, because a vague acknowledgement that the evidence is mixed helps nobody making a budget decision.

• No published fee schedule exists for CDK 3PA or Reynolds RCI: Neither vendor's current published materials contain one. Every number in circulation is either July 2017 forum testimony or an allegation in an antitrust complaint. We label and date each and we do not present any as current.
• We hold no fetched Reynolds programme language at all: The RCI third-party page rendered as title-only to our fetcher. We therefore do not quote Reynolds, do not characterize RCI's terms, and do not compare its gatekeeping to CDK's.
• FTC-hosted documents returned HTTP 403: That includes the Safeguards Rule dealer FAQ and the March 2018 CDK/Auto/Mate press release. We cite the URLs and treat their contents as secondary, corroborated through contemporaneous trade coverage. We paraphrase rather than quote them.
• We could not verify the seventy-percent franchise DMS market share attributed to an FTC filing: Nor the roughly-fifteen-thousand-rooftop and roughly-half-the-market figures for CDK, which circulate from June 2024 outage coverage rather than from a primary filing. We use the FTC's own characterization and omit percentages.
• We could not verify which court entered the $630 million vendor-class approval: Trade reports split between the Northern District of Illinois, where MDL 2817 sits before Judge Rebecca R. Pallmeyer, and a federal court in Madison, Wisconsin, the original Authenticom venue. We give the approval date of 25 February 2025 and name no court.
• We could not verify whether certiorari was sought or denied in CDK Global v. Brnovich: Nor could we verify a complete, current list of states with dealer-data-access statutes. We name Arizona, Oregon, Montana and North Carolina because those appear in our sources, and we publish no state count.
• We could not verify which five states limited manufacturer rebuttal of declared warranty labor rates in 2025: The trend is documented; the state list is not, at least not to a source we would put our name next to. Ask your dealer-law counsel about your own states.
• We could not source a comparable Xtime write-depth statement against CDK or Reynolds: The bi-directional repair-order management and parts-writeback claims are sourced only to Cox's own materials and only against Dealertrack DMS. That is a vendor claim about a same-family integration, and we present it as one.
• We could not confirm any Fortellis marketplace listing fee: A monthly per-app listing fee is reported in secondary sources; the Fortellis pricing page 404s, so we do not print an amount. If a fee matters to your business case, get it in writing from CDK.
• We found no documented DMS API deprecation or version-pinning incident with dates: Version churn is a real risk in this category and we would rather say we could not evidence a specific incident than invent an illustrative one.
• There is no independent benchmark for service-agent accuracy in this category: Every accuracy, booking, containment and deflection figure in the market is vendor-published. We exclude them from evaluation by design, and that refusal is deliberate rather than an omission.
• There is no standard for idempotency keys: The IETF draft is expired at revision -07 and is not an RFC. Every vendor's semantics differ slightly, which is exactly why duplicate writes are a design problem rather than a library choice.
• Prompt injection is unsolved: Research-grade architectural defences exist in the literature — a privileged planner, a quarantined reader with no tool access, and a deterministic policy engine outside the model. Our reading of the field is that no production-grade implementation of that pattern is shipping in a mainstream agent harness today, and we state that as our own assessment rather than as an established finding. Design for blast-radius reduction.

None of this argues against building. It argues for building the measurement alongside the agent, choosing one workflow where you already own the baseline, and being straight with your own organisation about which numbers are yours and which are somebody else's marketing.

And the boundary holds throughout. These are administrative, documentation and preparation systems operating under human review. Estimates, authorizations, warranty attestations, ledger postings, recall communications and anything with a safety or legal consequence stay with a named person in your store. The DMS decides what your agent may write. You decide what it should.