The Claim Under Test
Every ranking of dealership AI agents scores the same four things — accuracy, appointment-set rate, containment and ROI — and every one of those numbers is published by the vendor about itself. That is the claim we set out to test, and it did not survive five minutes of checking. We looked at the public pages of fourteen candidate vendors on 23 August 2026. Not one published a methodology, a sample or a denominator behind a performance figure. Not one linked to a third-party evaluation of its own output. There is no referee in this market, and the listicles that rank on those numbers are ranking on marketing copy with a decimal point in it.
The second failure is more expensive, because it costs a dealer principal a procurement cycle rather than a click. Dealership AI consolidated hard during 2026, and a great deal of published content has not caught up. Cox Automotive completed its acquisition of Fullpath on 1 June 2026. Gubagoo is owned by The Reynolds and Reynolds Company, which you can verify from Gubagoo's own privacy policy. DealerSocket is a Solera product line. Any list that puts those three in front of you as independent AI-native challengers was assembled from 2024 sources. A stale roster is the single fastest way to lose the confidence of the person actually signing the contract.
So this article does something duller and considerably more useful. It scores what you can verify without a sales call: documented DMS and CRM integrations on the vendor's own pages, published compliance artefacts and precisely what type of report is claimed, pricing transparency, whether the product is locked to a suite, ownership from public record, and what the vendor declines to disclose. A documented absence, checked on a stated date on a named page, is a legitimate table cell — and in this vertical it is frequently the most informative cell in the row. This sits inside our wider look at the AI agent landscape across categories in 2026, and it follows the same method we used for insurance agencies, where the binding constraint turned out to be producer licensing rather than model quality.
The one sentence that governs every product on this page
An AI agent may read the repair order, the RO status and the service history over a certified DMS interface, and it may send the customer a message. Writing the appointment back into the DMS is a separate, vendor-discretionary permission — and at least one certified vendor states plainly, in public, that it cannot do it. Everything else in a dealership AI evaluation is downstream of that one fact.
There is a third failure worth naming at the top, because it quietly wastes the most money in fixed operations. A large share of what is sold as agentic in this vertical is trigger-based messaging automation with a language model in front of it. That is often genuinely useful and often the right purchase — declined-service follow-up and RO status updates need reliability far more than they need autonomy. But it is not autonomy, and you should not pay autonomy prices or accept autonomy risk for it. In the entries below we say, for every product, whether it is an agent, a copilot or automation, and we use the vendor's own words wherever those are more honest than the category label. Several of them are.
How We Ranked, and What We Refused to Score
We scored only attributes a dealer principal can re-check personally, from a public page, in an afternoon. Everything below was verified on 23 August 2026 by direct fetch of primary sources: vendor domains and their own trust, security, pricing and integration pages; the Federal Register and govinfo; the eCFR; the Fifth Circuit's published opinions; the FCC's document server; the Florida Legislature's statute browser; CourtListener dockets; SEC EDGAR filings and the SEC submissions API; the Bureau of Labor Statistics series pages; and the Census Bureau's advance retail release.
Scored — every one of these is checkable by you
- Documented DMS and CRM integrations: named on the vendor's own integration or documentation page, with the direction of data flow stated — not implied by a logo wall
- Published compliance artefacts: SOC 2, ISO 27001, a DPA, a sub-processor list, a trust centre — and precisely what type of report is claimed, since a Type I attestation, a Type II attestation and a certification are three different things
- Whether the certificate belongs to the vendor: an infrastructure provider's certification is not the vendor's certification. Confirm the certificate names the vendor's own legal entity
- Pricing transparency: published, or the literal words not publicly disclosed. We never estimate a price
- Locked to a suite versus standalone: from product documentation. A DMS with embedded AI is a different purchase from a standalone messaging agent, and it should be priced as one
- Ownership and corporate status from public record: SEC filings, press releases, footer legal entities, privacy-policy entity lists, domain redirects
- Whether any independent evaluation exists: in dealership retail the answer was, everywhere we looked, none
- Whether the vendor is honest about autonomy: a vendor that documents what its interface cannot do scores better with us than one that implies no limits exist
Refused outright: accuracy, appointment-set rate, booking rate, containment, resolution rate, response-time reduction, ROI, repair-order lift, days-on-lot reduction and every cost-of-inaction figure. We encountered a great many of these during the research, and the table further down names them with their sources so you can recognise them when they arrive in a deck. Not one is accompanied by a published methodology, a sample or a denominator.
There is a concrete reason to hold that line rather than treat it as fussiness. It is what happened the single time a US federal regulator audited a vendor's published AI performance metrics — and the product in question was a voice agent, which is exactly the product category most heavily marketed to service drives today.
What happened the one time a regulator checked the numbers
In In the Matter of Presto Automation Inc., Securities Act Release No. 11352, Exchange Act Release No. 102177, Admin. Proc. File No. 3-22413 (14 January 2025), the SEC found that a public company had told investors its drive-thru voice AI delivered “over 94% accuracy even in noisy environments” and 95%–99% “automated order completion.” The order found that the product “lacked the capability to take orders on their own and required substantial human involvement,” with “human order takers located abroad (primarily in the Philippines and India), who processed the vast majority of drive-thru orders.”
The framing matters and is routinely mangled in secondary coverage. Presto consented without admitting or denying the findings. The remedy was a cease-and-desist order with no civil penalty — it was not a fine. The findings are against Presto only; the order's “Supplier A” is a different company, against which the SEC made no findings whatsoever. And Presto Automation Inc. is not Presto Phoenix Inc., which bought assets in December 2024. Read the order itself rather than the coverage of it.
The lesson for a dealer principal is direct. A voice product was sold on a published accuracy number, and when somebody with subpoena power looked behind it, the finding was that humans were doing the work. That is why we score the boring column instead.
No independent benchmark of dealership AI products exists. That is a precise claim rather than a rhetorical one, and it needs stating carefully, because in some adjacent markets independent evaluation genuinely does exist — it simply measures underlying models or a whole modality rather than the commercial products being ranked. In dealership retail we located neither kind as of 23 August 2026: no head-to-head study, no academic evaluation, no trade-body test. The closest thing to third-party signal anywhere in this roster is a G2 star rating, which is a review average, not a benchmark. What can be checked is narrower and considerably more useful: whether the vendor publishes a certified DMS interface, what direction the data actually flows, and whether there is a trust page a buyer can read before signing.
The speed-to-lead statistic, and what dealership vendors do instead
The famous speed-to-lead multiples that circulate in real estate and mortgage marketing — the ones usually quoted as a 391x improvement from responding within five minutes — trace back to a 2007 study that actually reported 21x, about the odds of qualifying a lead, comparing five minutes to thirty. The study says verbatim: “This study did not address close ratios.” Here is the interesting part. Searching the dealership vendors in this research, we found no hits for that number at all. They did not recycle the statistic. They kept the promise and dropped the citation — “lead response in 30 seconds,” “from 23 hours to under 10 minutes” — which is harder for a buyer to check, not easier.
Two dealership-specific figures deserve explicit handling, because refusing a number you did not trace is different from debunking one you did. Claims of the form the average dealership loses $X per missed service appointment circulate widely in fixed-operations marketing; we could not trace any version of that shape to a published denominator, and no vendor in this research actually printed one, so we refuse the shape rather than inventing a quote to knock down. Separately, the widely repeated assertion that customers now visit only 1.2 dealerships before buying is commonly attributed to a large trade study; we did not verify its origin and we do not assert that it is false either. It simply does not appear in this article as fact. An unsourceable number stays out whether or not we found its author.
One more scoring rule, borrowed from an error we have found repeatedly across this series: check whose certificate it actually is. Vendors in adjacent verticals have been caught citing ISO 27001 and SOC 2 on their security pages where the certifications belonged to their cloud hosting provider rather than to the vendor's own legal entity. Before you credit any compliance cell, confirm the certificate names the company you are about to contract with. It takes about thirty seconds and it is the highest-yield thirty seconds in a dealership software evaluation.
The Comparison Table
Every vendor in this table was confirmed to be trading under its own name in 2026, and every cell is either sourced to a page you can open or contains the words “not publicly disclosed.” There is no accuracy column, no ROI column and no score out of ten, because none of those could be produced honestly. The ordering reflects breadth of verifiable evidence and fit for a typical franchise or independent store — not measured performance, which nobody in this market can measure.
| Vendor (status, checked 23 Aug 2026) | What it does, and whether it is an agent | Documented DMS / CRM integrations | Compliance evidence on its own pages | Pricing | Ownership from public record |
|---|---|---|---|---|---|
| 1. Matador AI (active; footer reads © 2026 Matador AI) | SMS, voice and chat lead response and service follow-up. Named products: AI Engage, AI Reply, AI Follow-Up, Call AI, Chat AI. Honest hybrid — outbound cadences are largely configured automation, the reply layer is model-driven, and the vendor's own FAQ says a dealer may leave prompt fields blank and let the base prompt handle it | Strongest public documentation in this table. Dedicated per-system pages for CDK Drive, Reynolds and Reynolds, Tekion, DealerSocket, VinSolutions, Dealertrack, eLead, PBS, Xtime and Activix; the index states 63 and counting. RCI-certified for Reynolds ERA per its own page. Each page states direction and the exact objects that sync | A real gap. No SOC 2 or ISO claim located, no trust centre, no public DPA, no FTC Safeguards Rule statement. A TCPA Compliance link exists in the footer but resolves to nothing — /tcpa-compliance returns 404. Only a privacy policy | Not publicly disclosed | Not located. Say not disclosed |
| 2. Tekion (active, private; Tekion One 2026 event and NADA 2026 recap published) | Cloud-native DMS marketed as Automotive Retail Cloud, with embedded AI and a partner ecosystem. Platform plus embedded AI, not a standalone agent — locked to the suite by definition | It is the DMS. Third parties integrate through its partner cloud; Matador and Kenect both document Tekion integrations from their side | Strongest verified posture in the roster, from its own trust portal: SOC 1 and SOC 2 Type II attestations (correctly described as attestations), ISO/IEC 27001 and ISO/IEC 27701 validated via BSI, a public DPA, a published sub-processor list, and retention and disposal language. It names GLBA explicitly — the closest any vendor here comes to addressing the dealer's Safeguards duty | Not publicly disclosed | Not verified this session. Do not accept a valuation or investor claim without a filing |
| 3. CDK Global (active; Fortellis, CVR, AVRS and the Dealership Xperience Platform) | DMS and dealership platform with an AI programme, and owner of the ELEAD CRM. Platform with embedded AI rather than a standalone agent | It is the DMS, and Fortellis is the published developer and API platform — the concrete answer to how a third party integrates. Matador and Kenect both document CDK integrations from their side | From its own Trust Center: SOC 1 and SOC 2 attestations — the page does not say Type II, and we do not upgrade it — plus ISO/IEC 27001:2022 certified by EY CertifyPoint. No FTC Safeguards Rule statement located and no public DPA located | Not publicly disclosed | Not verified. The widely reported take-private was not confirmed to a primary source this session, so we assert nothing about it |
| 4. Cars Commerce / Cars.com Inc. (active, NYSE: CARS, CIK 0001683606) | Marketplace plus dealer software: Cars.com, Dealer Inspire (websites and messaging) and AccuTrade (trade-in appraisal). AI features inside a marketplace and website platform, not an autonomous agent | Marketplace and website platform integrations; DMS-level integration documentation not verified this session | A trust centre exists at trust.carscommerce.inc; its contents were not enumerated here, so no certification is asserted | Not publicly disclosed | Public shareholders — the single most verifiable ownership row in the table. FY2025 Form 10-K filed 26 February 2026 and a Form 10-Q filed 6 August 2026. You can read the risk factors yourself |
| 5. Toma (active; rebranded November 2025, correct domain toma.com) | Voice AI agents for dealership phones, weighted to fixed operations. Markets autonomous voice agents; autonomy unverified | None located. There is no integrations page in the sitemap and no documented DMS integration — a significant gap for a product whose value depends on the service schedule | Best self-documentation among the small vendors: dedicated posts for SOC 2 Type II (February 2026), ISO 27001, PCI DSS and GDPR, plus privacy, terms, vendor terms and a delete-my-data page. Two caveats — no trust portal with a downloadable report, and its own copy calls SOC 2 Type II a certification when it is an attestation | Not publicly disclosed | Not located |
| 6. Impel (active, private, independent; sustained 2026 newsroom activity) | Customer-lifecycle AI across merchandising, sales and service; markets agentic AI. Mixed — it markets agents, but the autonomy boundary is not documented publicly | Standalone rather than locked to a DMS; specific DMS integration documentation not verified this session | Homepage claims certification and compliance with GDPR, TCPA, CCPA and SOC 2 Type II. A trust centre exists at trust.impel.ai but is JavaScript-rendered and returned no readable content, so the certification could not be independently confirmed. Record as a vendor claim plus a trust centre that exists | Not publicly disclosed. The /pricing path returns 404 | Private and independent. FM Capital is reported as a follow-on investor in July 2026 in secondary trade press; the cap table was not verified |
| 7. Kenect (active; sells into auto, powersports, marine and equipment) | Texting, chat, voice and reputation management. Largely trigger-based messaging automation with an AI layer — its own integrations page describes automated messaging based on triggers and message triggers based on Closed Sale Events. Do not buy it as an autonomous agent | Documented at /integrations with per-system descriptions: CDK eLead, Tekion (described as syncing contacts and data both ways), DealerSocket, VinSolutions, Dealertrack, Xtime, ZiiDMS (Dominion), RIMSS, Salesforce, HubSpot and Zapier | None located. No trust page, no SOC 2 or ISO claim, no DPA, no FTC Safeguards statement — only a privacy policy | Not publicly disclosed | Not located |
| 8. Numa (active; markets itself as an AI operating system for car dealerships) | Service-drive voice and messaging, with named Heat Case and Opportunity agents, voice AI and a mobile app. On its own description this is the closest thing in the roster to a genuinely autonomous voice agent — and that description is unverified | Claims DMS write-back. No integration documentation page located, so the claim could not be checked against any DMS vendor's certification material | None located. No trust page, no security page, no SOC 2 or ISO claim, no DPA, no Safeguards statement — only a privacy page. Score this as a gap | Not publicly disclosed | Not verified. Note that the $220M exit referenced on its About page belongs to the founders' prior company, Location Labs — it is not a Numa valuation or exit |
| 9. Podium (active, private; automotive is a named vertical) | Messaging, reviews and payments with an AI Employee and AI lead conversion. A horizontal SMB platform with an automotive vertical rather than a dealership-native product — a legitimate ranking discriminator, and we say it plainly | An integrations page exists; DMS-specific integration documentation was not verified | legal.podium.com and privacy.podium.com exist but were not machine-readable this session. SOC 2, DPA and Safeguards status not confirmed — verify before relying on anything | Not publicly disclosed, and this is verifiable: both the pricing and get-pricing pages are lead-capture forms with no plan prices. If you remember Podium publishing tiered prices, that memory is stale | Not verified from public record this session |
| 10. Lotlinx (active) | VIN-level inventory and merchandising decisioning with media buying. Not a conversational agent at all, and it should never be ranked as one without saying so — include it only if your scope covers merchandising spend | Inventory and media platform integrations; DMS integration documentation not verified | None located | Not publicly disclosed | Not located |
Four patterns come straight out of that table. First, pricing opacity is total: not one vendor on this roster publishes a price, which is unusual even by enterprise software standards and means every evaluation carries a procurement cycle you should budget time for. Second, the best integration documentation and the best compliance documentation belong to different companies — Matador publishes per-DMS integration pages that name the objects and the direction of flow, and publishes nothing about SOC 2, ISO or a DPA; Tekion publishes a full trust portal and is the DMS rather than an agent that connects to one. Third, ownership is largely undisclosed: one company in the ten has ownership you can verify from filings, and it is Cars.com Inc., because it is publicly traded. Fourth, two of the ten are in litigation with each other, which we disclose below.
Alongside the ten, several names will come up in every conversation you have this year and none of them belongs in a 2026 ranking as an independent vendor. Three were acquired or were always owned by someone else, one has ownership we could not resolve, and one could not be reached at all. We list them with the check you can run yourself, because knowing why a vendor is not in a table is often worth more than the table.
| Named in dealership AI rankings | What it actually is in 2026 | How you can check it yourself | Why it is not an independent ranking entry |
|---|---|---|---|
| Fullpath | A Cox Automotive product. Cox announced the acquisition on 23 April 2026 for 100% of Fullpath and confirmed completion on 1 June 2026, stating the same team, products and service levels remain in place | Read the Cox Automotive completion announcement, then read VinSolutions' own homepage, which says in the past tense that Cox Automotive has acquired Fullpath | Ranking it as an independent AI-native challenger is now false. Its compliance posture is genuinely strong — ISO 27001 and ISO 42001 per its own pages, plus a public DPA and sub-processor list, and it is the only vendor in this research claiming ISO 42001, the AI-management-system standard — but the correct entry is Cox Automotive with Fullpath named as a component |
| Gubagoo | A Reynolds and Reynolds component. Its own privacy policy names The Reynolds and Reynolds Company and its affiliates and gives an address at Reynolds Way, Dayton, Ohio | Open the privacy policy and read the entity list; then look at the newsroom URLs in its own sitemap, which describe the Reynolds acquisition directly | Not an independent vendor. Its site is JavaScript-rendered and the most recent dated news items in its sitemap are 2023-era, so current product vitality is not established either |
| automotiveMastermind | Site active, promoting a July 2026 webinar and an AI assistant named Fritz. Ownership could not be verified | Try to find a primary-source ownership statement. We could not confirm one, and we will not repeat a corporate relationship we did not verify | Unresolved ownership is precisely the acquisition trap that gets a ranking dismissed. Note also its headline construction — a vendor-internal cost-per-sale compared against an industry average attributed to a trade body. That is not a like-for-like comparison and should not be printed as one |
| DealerSocket | A Solera product line, still listed under Solera's dealer solutions alongside Titling, Autopoint, cap hpi, Service Suite and Goldstar | Open Solera's own site and find DealerSocket in the dealer solutions list | No DealerSocket AI-agent product was verified. It belongs in this market as an integration target — it appears in Matador's and Kenect's integration lists — not as a ranked AI vendor |
| Darwin Automotive | Unknown. The domain returned a Cloudflare 403 and could not be reached at all | Try it yourself. If it loads for you, you have more than we did | Unconfirmed 2026 existence means it does not go in the table. That is the rule, and applying it consistently is the whole point |
| Reynolds and Reynolds | A DMS and the gatekeeper of the Reynolds Certified Interface programme, and Gubagoo's owner. Its site is fully JavaScript-rendered | The clearest public evidence of how RCI works is on a third party's page — Matador's Reynolds integration page describes the certification and its limits | No Reynolds AI product was verified. It matters enormously to this article as the party that decides what an agent may do, and not at all as a ranked AI vendor |
| AutoFi | Site active. The only compliance signal located is a 2022 blog post about the importance of SOC 2 Type II certification | Look for a current attestation, a trust page or a report. A four-year-old blog post about why certification matters is not evidence of a certification | We do not credit SOC 2 to a vendor on the strength of a blog post about SOC 2, and we do not rank on unverified compliance |
Cox Automotive deserves a note of its own, because it is the consolidator story of 2026 in this market. Between VinSolutions, Dealer.com, Dealertrack, vAuto, Xtime, Kelley Blue Book, Manheim, NextGear and now Fullpath, a large share of the dealership technology surface sits under one roof. That is not a criticism — concentration can mean better integration — but it changes the shape of your negotiation and your concentration risk, and it is worth knowing before you treat two shortlisted products as independent alternatives when they share a parent. Fullpath's compliance posture is genuinely the strongest we found anywhere in this research, including an ISO 42001 claim — the AI management system standard, and the only such claim in the roster — alongside ISO 27001, a public DPA and a sub-processor list. All of that is now Cox's.
The Ten, Entry by Entry
Each entry below says what the product does, what is verifiable, what is not disclosed, who it fits, who it does not, and who owns it. Where a vendor documents a limitation about itself, we treat that as a mark in its favour, because a vendor willing to publish what its interface cannot do is a vendor whose other claims are worth more.
1. Matador AI — the best-documented integrations in the market, and the thinnest compliance page
What it does: SMS, voice and chat lead response and service follow-up, sold to rooftops rather than to enterprises. Named products are AI Engage for speed-to-lead outreach, AI Reply, AI Follow-Up, Call AI and Chat AI. What is verifiable: the integration documentation, which is the best in this market by a wide margin. Matador publishes dedicated pages for CDK Drive, Reynolds and Reynolds, Tekion, DealerSocket, VinSolutions, Dealertrack, eLead, PBS, Xtime and Activix, with an index stating 63 integrations and counting. Each page states the direction of data flow and names the objects that sync. It also publishes that it holds Reynolds Certified Interface certification for ERA. All of that is one click from the homepage and re-checkable by you today.
What is not disclosed: a great deal, and it is a real gap. No SOC 2 or ISO claim was located, no trust centre, no public DPA and no FTC Safeguards Rule statement. A “TCPA Compliance” link sits in the footer and resolves to nothing — the page returns a 404. Ownership is not disclosed. Who it fits: single rooftops and small groups on CDK, Reynolds or Tekion that want documented, certified data flow and are prepared to do their own § 314.4(f) diligence by questionnaire. Who it does not fit: a group whose security review requires a SOC 2 report before signature. Ownership: not located.
2. Tekion — the strongest verifiable compliance posture, and it is the DMS
What it does: a cloud-native dealer management system marketed as Automotive Retail Cloud, with embedded AI and a partner ecosystem. This is a platform purchase with AI inside it, not a standalone agent, and it is locked to the suite by definition. What is verifiable: more than anyone else here. Its trust portal states SOC 1 and SOC 2 Type II attestations — and Tekion correctly calls them attestations — plus ISO/IEC 27001 and ISO/IEC 27701 certificates validated through BSI, a public Data Processing Addendum, a published sub-processor list, and retention and disposal language. It states GLBA adherence explicitly, which is the closest any vendor in this roster comes to speaking to the dealer's own Safeguards obligation.
What is not disclosed: pricing, and ownership or funding that we could verify from a filing. Note that its own trust page names GLBA rather than the Safeguards Rule as such. Who it fits: a group willing to change DMS, or one already on Tekion, that wants its AI and its system of record under one contract and one attestation. Who it does not fit: anyone unwilling to make a DMS decision in order to buy an AI capability. Disclosure: Tekion is the plaintiff in live antitrust litigation against CDK Global, which is also ranked on this page. We disclose it, we do not characterise it, and no merits ruling exists.
3. CDK Global — the incumbent, with a trust centre and a published API platform
What it does: a dealer management system and dealership platform with an AI programme, plus CVR, AVRS and the Dealership Xperience Platform, and it owns the ELEAD CRM. Like Tekion, this is a platform with embedded AI. What is verifiable: its Trust Center states SOC 1 and SOC 2 attestations and ISO/IEC 27001:2022 certified by EY CertifyPoint. Note carefully that the page does not say Type II for the SOC attestations, and we do not upgrade a claim a vendor did not make. Fortellis is the published developer and API platform, which is the concrete, documented answer to how a third party integrates with CDK — a question that is otherwise the subject of years of litigation.
What is not disclosed: pricing, a public DPA, any FTC Safeguards Rule statement, and current ownership. The widely reported take-private transaction was not confirmed to a primary source in this research, so we assert nothing about it. Who it fits: the large installed base already running CDK, where the integration question is answered by Fortellis rather than by a negotiation. Who it does not fit: a buyer whose evaluation is driven by concentration risk — see the outage section below. Disclosure: CDK is the defendant in the Tekion antitrust action and was the subject of the June 2024 cyber incident discussed later on this page.
4. Cars Commerce — the only ranked vendor whose ownership is in a filing
What it does: marketplace plus dealer software. Cars.com is the marketplace, Dealer Inspire supplies websites and messaging, and AccuTrade handles trade-in appraisal. The AI here lives inside a marketplace and website platform; it is not an autonomous agent and should not be evaluated as one. What is verifiable: the corporate record, completely. The legal entity is Cars.com Inc., NYSE: CARS, CIK 0001683606, with a FY2025 Form 10-K filed 26 February 2026 and a Form 10-Q filed 6 August 2026. You can read the audited financials and the risk factors yourself, which is not true of any other vendor in this table. A trust centre exists at trust.carscommerce.inc.
What is not disclosed: pricing, and the enumerated contents of that trust centre, which we did not read in full and therefore do not characterise. Who it fits: stores that want demand generation, website and appraisal in one relationship with a counterparty whose finances are public. Who it does not fit: a service department looking for phone coverage. Ownership: public shareholders — and that is a legitimate scoring advantage, not a formality. Public reporting obligations are the only mechanism in this entire roster that forces a vendor to disclose bad news on a schedule.
5. Toma — the best compliance self-documentation among the small vendors, and no integrations page
What it does: voice AI agents for dealership phones, weighted towards fixed operations. It launched in 2024 and rebranded in November 2025, shipping features called Safeguards and Inbox. The correct domain is toma.com; a similarly named domain belongs to an entirely unrelated company, which is worth knowing before you send a diligence email to the wrong business. What is verifiable: unusually good compliance self-documentation for a company of its size, with dedicated posts covering SOC 2 Type II, ISO 27001, PCI DSS and GDPR, plus privacy, terms, vendor terms and a delete-my-data page.
What is not disclosed: integrations — there is no integrations page in its sitemap and we located no documented DMS integration, which is a significant gap for a product whose value depends on reading a service schedule. Also missing: a trust portal with a report you can request, any FTC Safeguards Rule statement, pricing, and ownership. One terminology flag worth a note in your evaluation: its own copy describes SOC 2 Type II as a certification. SOC 2 Type II is an attestation, not a certification. It is a small tell, and small tells are what you have in a market with no referee. Who it fits: a store that wants phone coverage and will accept a manual bridge into the schedule. Who it does not fit: anyone who needs a documented, certified DMS interface on day one.
6. Impel — broad lifecycle coverage, with a trust centre nobody can read
What it does: customer-lifecycle AI spanning merchandising, sales and service, marketed as agentic AI. What is verifiable: that it is active, private and independent, with sustained 2026 corporate activity on its own newsroom — an Inc. 5000 listing in August 2026, a strategic partnership announcement in August 2026, industry awards in July 2026 and a named marketplace partnership in February 2026. That matters more than it sounds: confirming a vendor still trades under its own name in 2026 eliminated three candidates from this roster.
What is not disclosed: the substance behind its compliance claims. Its homepage claims certification and compliance with GDPR, TCPA, CCPA and SOC 2 Type II. A trust centre exists at trust.impel.ai, but it is JavaScript-rendered and returned no readable content, so the certification could not be independently confirmed and we record it as a vendor claim plus the existence of a trust centre — nothing more. Pricing is not disclosed and the pricing path returns a 404. The autonomy boundary is not documented publicly. Who it fits: groups wanting one vendor across merchandising and lifecycle marketing. Who it does not fit: a security review that requires the report before the pilot. Ownership: private and independent; a follow-on investment by an investor was reported in trade press in July 2026, and the cap table was not verified.
7. Kenect — documented integrations, honest about being trigger-based, no compliance page
What it does: texting, chat, voice and reputation management across auto, powersports, marine and equipment dealers. What is verifiable: its integrations page, which is genuinely good — per-system descriptions naming CDK eLead, Tekion, DealerSocket, VinSolutions, Dealertrack, Xtime, ZiiDMS from Dominion, RIMSS, Salesforce, HubSpot and Zapier. The Tekion entry describes syncing contacts and data both ways; the CDK eLead entry describes pushing leads in real time and automating texts based on opportunity status.
What is not disclosed: anything about security. No trust page, no SOC 2 or ISO claim, no DPA, no Safeguards statement, and no ownership. Note also the honest reading of its own copy: the integrations page describes automated messaging based on triggers and message triggers based on closed-sale events. This is trigger-based messaging automation with an AI layer, and it should not be bought as an autonomous agent. That is not a criticism of the product, which does a defined job; it is a caution about the price and the risk you accept. Who it fits: multi-line dealers who want one messaging surface across auto and powersports. Who it does not fit: a group with a formal vendor security review.
8. Numa — the strongest autonomy claim in the roster, and the least documentation behind it
What it does: service-drive voice and messaging, marketed as an AI operating system for car dealerships, with named Heat Case and Opportunity agents, a voice product and a mobile app. On its own description this is the closest thing in this roster to a genuinely autonomous voice agent. What is verifiable: that it is active and selling. What is not: almost everything else. We located no trust page, no security page, no SOC 2 or ISO claim, no DPA, no Safeguards statement and no integration documentation — only a privacy page.
Two specific cautions. First, its site claims that where most AI voice products only greet and transfer, it resolves the request and writes it back to the DMS. We could not verify that write claim against any DMS vendor's certification documentation, and it sits in direct tension with what a certified competitor publishes about the same class of system — the subject of the next section. Second, the “$220M exit” referenced on its About page belongs to the founders' previous company, Location Labs. It is not a Numa valuation or a Numa exit, and it is easy to misread as one. Who it fits: a store willing to run a measured pilot and demand the write scopes in writing. Who it does not fit: anyone who needs the documentation before the pilot.
9. Podium — a capable horizontal platform that is not dealership-native
What it does: messaging, reviews and payments, with an AI Employee product and AI lead conversion, sold across many small-business verticals with automotive as one named vertical. What is verifiable: the pricing opacity, precisely. Both its pricing page and its get-pricing page are lead-capture forms offering a custom quote with no plan prices published. If you remember Podium publishing tiered prices in the past, that memory is stale — it does not today, and we checked.
What is not disclosed: compliance substance. Legal and privacy subdomains exist but were not machine-readable in this research, so SOC 2, DPA and Safeguards status are unconfirmed and should be verified before you rely on anything. DMS-specific integration documentation was not verified. One detail worth carrying into a demo: the flagship revenue testimonial on its own pricing page is attributed to an HVAC company, not to a dealership. Who it fits: smaller independent stores that also want reviews and payments on one platform. Who it does not fit: a franchise store whose workflows live in the DMS — a horizontal platform with an automotive vertical is a legitimately different product from a dealership-native one, and pretending otherwise wastes a quarter.
10. Lotlinx — included with a warning label, because it is not a conversational agent
What it does: VIN-level inventory and merchandising decisioning with media buying attached. It decides which units get spend and how much. It is not a conversational agent, it does not answer a phone, and it belongs on this page only because it appears constantly in dealership AI rankings and a dealer principal deserves to know what category it actually occupies before comparing it with a voice product.
What is not disclosed: compliance evidence of any kind, pricing and ownership. Its published performance figures — reductions in days on lot, markdowns and holding costs per VIN — carry the vendor's own asterisk describing them as estimated from industry data. When a seller flags its own headline number as an estimate, that is the seller telling you not to treat it as a result. Who it fits: groups with enough inventory turn and enough media spend for VIN-level decisioning to matter. Who it does not fit: anyone shopping for fixed-operations phone coverage, which is what most dealership AI conversations in 2026 are actually about.
Below is the register of performance claims we encountered and refused, with the vendor that publishes each one. Print it out and take it into your next three demos. When a number in this table appears on a slide, the correct question is not whether it is impressive — it is what the denominator was, who measured it, and whether you can see the working.
| Published claim | Whose claim it is | Why it is not in this article |
|---|---|---|
| 80%+ appointment booking rate; 70% heat cases resolved; response time cut from 23 hours to under 10 minutes; repair-order dollars per advisor lifted by over 35% | Numa, on its own homepage | No methodology, no sample, no denominator, no independent verification. These are the cleanest examples in the vertical of a vendor measuring itself and publishing the result as though it were a finding |
| Lead response in 30 seconds; engagement of 45% becoming 80%; lifting engagement from around 30% toward 40–50% | Matador, on its own product pages | Same problem. Matador's integration documentation is the best in the roster and its performance claims are no better sourced than anyone else's — good documentation in one place does not transfer credibility to another |
| $1.8M–$3.7M in annual AI-driven value; $150K–$308K per month in foregone value | Tekion, on its own site | The most aggressive unsourced ROI construction we found. A cost-of-inaction figure is a sales instrument, not a measurement, and no methodology accompanies it |
| 25% more sales appointments with AI assistance; roughly 3x customer-pay RO for top-quartile dealers | CDK, on its own site | Vendor-published performance figures about the vendor's own product. Not printed as fact here |
| Sell up to 34% more vehicles per month | VinSolutions (Cox Automotive), on its own homepage | Unsourced. The word up to is doing all the work |
| 37% fewer days on the lot; $445 less markdowns per VIN; $800 in reduced holding costs per VIN | Lotlinx, on its own site | The vendor asterisks its own headline figure as estimated based on industry data. When a seller flags its own number as an estimate, a buyer should not repeat it as a result |
| 34% closer to actual market value than two named guidebooks; $2,700 more profit per VIN | Cars Commerce / AccuTrade | Vendor analysis of vendor data, comparing the vendor's own product to named competitors. Not an independent benchmark |
| 10x return on investment; $247 cost per sale versus a $722 industry average | automotiveMastermind | A vendor-internal numerator set against an industry denominator sourced elsewhere. Two different populations, presented as one comparison |
| 20% more weekly sales calls and $96K additional monthly revenue | Podium, on its own pricing page | The flagship testimonial number is attributed to an HVAC company, not a dealership. Worth knowing before you extrapolate it to a service drive |
| Any phone-abandonment benchmark sold with a voice agent — abandonment percentages, or the share of callers who never call back | The standard pitch for service-drive voice AI, across vendors | We could not trace any of these to a published methodology. They are the fixed-ops equivalent of the missed-appointment figures banned elsewhere in this series, and they are refused for the same reason |
The Binding Constraint: DMS Write Access
The thing that decides whether a dealership AI agent works is not the model — it is whether the agent can write to your DMS, and that permission is commercially gated by the DMS vendor. Certified interfaces are frequently read-only. An agent can read the repair order, read live RO status, read service history and send the customer a text about any of it. Booking the appointment back into the system of record is a different permission, granted separately, and it is the difference between an agent that reduces work and an agent that creates a queue somebody has to key in by hand.
This is not an inference. It is documented by a vendor, in public, against its own commercial interest. Matador AI publishes a field labelled “Direction: Read from the DMS” on both its CDK Drive and its Reynolds integration pages. Both pages list what flows — repair orders, live RO status, service appointments, service history — and both describe step one as Matador being granted read access. The Reynolds page then carries an explicit FAQ that says the quiet part out loud.
Is the Reynolds integration certified? Yes. Matador is certified through the Reynolds Certified Interface (RCI) programme for ERA, so service data moves over an interface Reynolds has reviewed and sanctioned. Can Matador write service appointments into Reynolds? No.
— Matador AI, Reynolds and Reynolds integration page, read 23 August 2026
Read that twice, because it contains the whole argument. The vendor holds a real certification. It says so, and it explains on the same page that Reynolds does not hand out access casually, which is the point of holding one. And then it tells you the certified interface cannot write the appointment. That is a vendor publishing its own limitation — the single most useful thing any company in this research did, and the reason Matador sits at the top of the table despite having the thinnest compliance page in it.
The contrast, presented as a question rather than a verdict
Numa's site claims the opposite capability — that where most AI voice products only greet and transfer, it resolves the request and writes it back to the DMS. We could not verify that claim against any DMS vendor's certification documentation, and we do not call it false. Two vendors describe different write access to the same class of system. That contradiction is not something we can adjudicate from the outside, and it is not something you should have to. Ask your vendor to show you the certification letter and the specific write scopes, per DMS, in writing, before signature. The answer differs by vendor and by DMS, and it decides whether the agent books the appointment or merely texts about it.
Practically, that question reshapes the business case. If the interface is read-only, the agent is a triage and communication layer: it can identify the customer, pull the history, answer the status question, send the reminder and hand a qualified request to an advisor. That is worth real money in a busy service drive — it is just a different quantity of money from “the agent books appointments while you sleep,” and it is measured differently. If you build the payback case on booked appointments and the interface turns out to be read-only, you have bought a queue.
There is a second-order effect that catches groups out. A vendor may hold write access into one DMS and not another. A dealer group running CDK at four rooftops, Reynolds at two and Tekion at one may find the same contract delivers three different capability sets. Ask per DMS, not per vendor, and put the answer in the contract rather than the deck. If you are weighing a custom build against a purchase for a workflow that spans all three, the read-versus-write map is the first artefact to produce — it is the deliverable we start with in any dealership agent engagement, before a line of code is written.
Why DMS Access Is Political
Access to dealer data has been litigated for the better part of a decade, and the most consequential case is live right now between two vendors ranked on this page. You do not need to follow the merits to make a buying decision, and you should not try — no merits ruling exists. What you need is the shape of the risk, because it lands on your integration rather than on their balance sheet.
The live one: Tekion Corp. v. CDK Global, LLC
Tekion Corp. v. CDK Global, LLC, No. 3:24-cv-08879 (N.D. Cal.) was filed on 9 December 2024 before Judge Jacquelyn Scott Corley, pleading a cause of action under 15 U.S.C. § 2 with a nature of suit recorded as antitrust. It is not terminated. The docket showed activity as recently as 18 August 2026, and ancillary discovery actions were filed across several districts during 2026 — the Southern District of Ohio in May, the Western District of Missouri in May, and the Northern District of Georgia in May and June. That pattern is what active, contested litigation looks like from the outside.
Disclosure, stated plainly: Tekion is ranked second on this page and CDK Global is ranked third. Tekion is the plaintiff; CDK is the defendant. We are ranking two companies that are suing each other over exactly the data-access question this article says is the binding constraint. We characterise the merits of neither side. No merits ruling has issued, and an article that scored either party on the strength of a pending antitrust complaint would be doing the thing this series exists to refuse.
The history is longer than the current case. In Re: Dealer Management Systems Antitrust Litigation, MDL No. 2817, was consolidated in the Northern District of Illinois before Judge Rebecca R. Pallmeyer by a JPML order of 1 February 2018, and it concluded in March 2025 — the district docket terminated on 6 March 2025 and the JPML docket on 11 March 2025. We did not verify the terms on which it ended and we therefore do not characterise the outcome. What is safe and sufficient to say is that it was consolidated in 2018 and concluded in March 2025, and that a related dispute reached the Seventh Circuit as early as 2017. The point for a buyer is not who was right. It is that data access in this industry has been contested in federal court, continuously, for most of a decade, and it is contested today.
Translate that into three questions for a vendor and one for your lawyer. Ask the vendor: what happens to my integration if your access to my DMS changes? Ask: can I export my conversation history, my consent records and my customer data in a usable format, on demand, without your assistance? Ask: what is your notice period if an interface is withdrawn? And ask your lawyer to put a material-change-of-control clause and a defined exit window into the agreement. None of those questions requires you to predict the outcome of a lawsuit, which is fortunate, because nobody can.
What Actually Governs a Dealership Agent
Four bodies of law decide what an agent may do in a dealership, and the most talked-about of them never took effect at all. Get the status of each one exactly right, because two of the four are commonly described backwards in vendor decks, and acting on either misdescription is expensive.
1. The CARS Rule never took effect for a single day
The FTC's Combating Auto Retail Scams Rule, 16 CFR part 463, was published on 4 January 2024 at 89 FR 590. Its effective date was delayed on 22 February 2024 at 89 FR 13267 while a petition for review was pending. On 27 January 2025, the Fifth Circuit vacated it in National Automobile Dealers Association; Texas Automobile Dealers Association v. Federal Trade Commission, No. 24-60013, reported at 127 F.4th 549. The opinion was written by Judge Higginbotham, with Judge Higginson dissenting. From the body of the opinion:
Finding that the FTC failed to issue an advance notice of proposed rulemaking in violation of its own regulations, we GRANT the petition for review and VACATE the CARS Rule.
— NADA v. FTC, No. 24-60013 (5th Cir., 27 January 2025)
The court added that “this was not harmless error,” and expressly declined to reach the substantive challenges: it granted the petition and vacated, and said it would not address NADA's remaining substantive arguments. Judge Higginson, dissenting, wrote that “it is regrettable that our court still sets aside the CARS Rule—a Rule promulgated over a decade after Congress authorized the FTC to regulate unfair and deceptive motor vehicle dealer practices, which inflict immense, proven harm on U.S. consumers.” That sentence belongs to the dissent, not to the court.
The FTC then formally withdrew the rule document effective 12 February 2026, at 91 FR 6507, in a final rule conforming several rules to federal court decisions. Here is the precision point almost every summary misses: the withdrawal's amendatory instructions revise part 425 and remove part 910, and there is no instruction removing part 463 — because the CARS Rule was never operative. Its effective date was delayed, and it was vacated before it ever bound anyone. The FTC withdrew a rule document, not a live regulation. Say “it never took effect,” not “it was repealed,” and never say dealers no longer have to comply with it — nobody ever had to.
And do not read any of this as permission. The vacatur was procedural, not substantive. Section 5 of the FTC Act, 15 U.S.C. § 45, still prohibits unfair or deceptive acts and practices by dealers. Dodd-Frank § 1029(d), 12 U.S.C. § 5519(d), still authorises the FTC to write dealer UDAP rules, and the withdrawal document cites that authority. The Commission could restart the process with an advance notice of proposed rulemaking; as of 23 August 2026 we located no re-proposal, which is not a statement that none exists. Meanwhile state dealer-advertising law, enforced by state DMVs and attorneys general, governs what you may say about price and payment. An AI agent that quotes a price, a payment or availability is making an advertised representation on your licence. The licence is yours; the model's output is your statement.
2. The FTC Safeguards Rule makes vendor selection a legal duty
Automobile dealers are financial institutions under the Safeguards Rule, and the FTC says so on its own dealer guidance page: the rule “requires automobile dealers who are financial institutions to develop, implement, and maintain a comprehensive written information security program that is sufficient to protect customer information.” That page describes ten elements, each detailed at 16 CFR § 314.4. Several vendor blogs say nine. Use the FTC's number.
The provision that governs an AI purchase is § 314.4(f), which requires you to oversee service providers by taking reasonable steps to select and retain providers capable of maintaining appropriate safeguards, requiring those safeguards by contract, and periodically assessing the provider based on the risk it presents and the continued adequacy of its safeguards. An AI vendor touching customer information is a service provider. Selecting it, contracting it and re-assessing it are your legal duties, not procurement preferences. This is the entire reason this ranking scores trust pages, DPAs and sub-processor lists rather than accuracy claims: those artefacts are the evidence that discharges a duty you already have.
Two dates to hold. The 2021 amendments — written programme, qualified individual, encryption, multi-factor authentication and the rest — took effect 9 June 2023. The breach-notification amendment was announced in October 2023 and took effect 13 May 2024; it requires notifying the FTC as soon as possible and no later than 30 days after discovery of a security breach involving the information of at least 500 consumers. If your AI vendor is holding customer conversations, that clock is one you now share with them.
3. ECOA and Regulation B: the statute survived the guidance
An AI tool may collect the application, pre-fill the deal and surface financing options. If it contributes to a decision to deny credit or to offer materially less favourable terms, a specific-reasons adverse-action notice is required, and “the model is complex” is not an answer. The durable authority is ECOA, 15 U.S.C. § 1691(d), and Regulation B, 12 CFR § 1002.9(b)(2). Cite the statute and the regulation, not a circular.
Why not a circular: CFPB Circular 2022-03, on adverse-action notification where credit decisions rest on complex algorithms, was withdrawn effective 12 May 2025, listed as item 14 in the Bureau's withdrawal of 67 guidance documents at 90 FR 20084. The Bureau took the position in 2022 that model complexity is not a defence to the specific-reasons requirement; that guidance is gone, while the statute and regulation it construed remain in force. Anyone writing “the CFPB requires…” in the present tense and pointing at that circular is sourcing a live obligation to a dead document.
And a warning that will save someone a very bad afternoon: “CFPB Circular 2026-03” does not exist. It is fabricated, and it surfaces confidently in search results and in AI-generated compliance summaries. We checked the Federal Register: the count is zero. If a vendor deck, a consultant's memo or a chatbot cites it to you, that citation is evidence the source is unreliable about everything else it told you as well. This is worth more than a footnote — a confidently wrong regulatory citation is the most common way a well-meaning compliance process gets poisoned in 2026.
One further change of status, stated with care because three different descriptions of it are circulating and all three are wrong. Regulation B no longer contains the disparate-impact “effects test.” It was removed by final rule at 91 FR 21620, effective 21 July 2026. Its posture is unusual and specific: in force, under challenge in National Fair Housing Alliance v. CFPB in the District of Columbia, and not enjoined — because the plaintiffs never sought an injunction. It has not been enjoined, it has not been struck down, and the old effects test is not current law. Any of those three framings in a vendor's compliance materials should make you re-read everything else in them. Separately, federal supervisory attention to auto finance narrowed materially after 2025; that changes who is likely to audit you, and it changes nothing about what ECOA and Regulation B require.
4. TCPA: an AI voice is an artificial voice, and the law did not get easier
In Declaratory Ruling FCC 24-17, adopted unanimously and released 8 February 2024, the FCC held that AI-generated voices are “artificial” voices under the TCPA. The ruling forecloses the obvious workaround in its own words: it “makes clear that the TCPA does not allow for any carve out of technologies that purport to provide the equivalent of a live agent, thus preventing unscrupulous businesses from attempting to exploit any perceived ambiguity in our TCPA rules.” Callers must obtain prior express consent — prior express written consent where the call or text is marketing — identify the party responsible for the call, and offer an opt-out.
The trap: Insurance Marketing Coalition v. FCC (11th Cir., 24 January 2025) vacated only Part III.D of the 2023 order — the one-to-one consent provision. The court's own footnote records that the 2012 order was not at issue. Prior express written consent for marketing survives, and so does the artificial-voice classification. Writing “the TCPA got easier for AI callers” inverts the law, and it is advice a dealer could act on and be sued for. An AI SDR texting a lead about a payment quote is marketing, whatever the vendor calls it. Separately, the TCPA revocation-of-consent rule at 47 CFR § 64.1200(a)(10) is in force: honour the word “cancel” and its plain-language equivalents, across every channel you use, promptly.
Your SMS agent is regulated twice. Florida's Telephone Solicitation Act, Fla. Stat. § 501.059, defines prior express written consent as a written agreement that bears the signature of the called party, clearly authorises a telephonic sales call by telephone call, text message, or voicemail transmission using an automated system, and includes the telephone number to which the call is authorised. It expressly covers text messages, and it reaches calls made into Florida from other states — so a group texting Florida leads from a BDC in Texas is inside it. Several other states have enacted their own telephone-solicitation acts with consent standards of their own, and they follow the consumer rather than the dealership. We verified Florida's statute only; read your own states rather than trusting a summary, including this one.
One more, for any group with European operations: the EU AI Act's Article 50 transparency obligations applied from 2 August 2026 and require that a person be told they are interacting with an AI system unless that is obvious. The Digital Omnibus regulation that came into force in July 2026 deferred the high-risk obligations, not Article 50. “The EU delayed the AI Act” is wrong, and if any of your rooftops serve EU customers, a customer-facing agent is inside a live obligation today.
A Worked Scenario, Not a Case Study
What follows is an illustrative scenario, not a client result. We are not describing a dealership we worked with, and no outcome below was observed anywhere. It exists to show the shape of an honest payback calculation and where the DMS write constraint bites, using only figures that are published on this page — our own cost bands, and a baseline that you would measure yourself before buying anything.
Consider a four-rooftop group running CDK at three stores and Reynolds at the fourth, with a shared service BDC. The principal wants an AI agent on the inbound service line. The first temptation is to model the return on booked appointments. Resist it until the read-versus-write question is answered, because the two scenarios produce different products.
Scenario A — the interface is read-only, which is what the documentation suggests you should assume
The agent identifies the caller, pulls the repair order and its live status over a certified read interface, answers the status question without a human, and hands a qualified booking request to an advisor as a structured task. Nothing is written to the DMS. The saving is advisor and BDC minutes on status calls, plus faster first response outside hours. That is a real, measurable saving. It is not appointment volume, and if you sell it internally as appointment volume you will be judged on a number the product cannot produce.
The measurement you need is one you take before buying: over two weeks, count inbound service calls by type, and time how many minutes advisors spend on pure status enquiries. That is your denominator, it belongs to you, and no vendor can supply it.
Scenario B — the vendor holds write scopes, evidenced by a certification letter
The same agent also writes the appointment. Now the return includes appointments captured outside advisor hours and abandoned-call recovery. Do not model this scenario until you have the certification letter and the write scopes named in the contract, per DMS. In the group described here, that could easily mean write access at three rooftops and read-only at the fourth — one contract, two products, and a rollout plan that has to reflect it.
Now the arithmetic, using only the bands published further down this page. A single-workflow agent runs $28k–$70k over four to nine weeks. Take the midpoint of that band, $49,000. Against a twelve-month payback target, the workflow has to return about $4,083 per month across the group — roughly $1,021 per rooftop per month. That is the number to test against the baseline you measured, and it is deliberately unglamorous: it is a threshold, not a promise. If your two-week measurement cannot plausibly clear it in Scenario A, then either the write access has to be real or the project is a Scenario A project with a smaller budget and a narrower scope. Add a discovery and workflow audit at $9k–$22k if you want the read-versus-write map, the consent audit and the vendor artefact review done before you commit to the larger number.
The honest version of the business case
Every input above is either published on this page or measured in your own store. None of it comes from a vendor. That is not a stylistic preference — it is the only way to build a payback model in a market where no independent benchmark exists and every published performance figure was produced by the company selling you the product. If a vendor's ROI calculator produces a better number than your own two-week measurement, believe the measurement.
What Breaks First
The first thing that breaks is not your agent — it is the DMS underneath it, and the integrations come back last. That is not a prediction. It is what public dealer groups told the SEC after the June 2024 CDK cyber incident, under securities-law liability, which makes those disclosures the most reliable numbers available anywhere in this article.
The June 2024 CDK outage, as filed with the SEC
AutoNation, Inc. disclosed in a Form 8-K filed 15 July 2024 that on 19 June 2024 it “was notified by CDK Global (‘CDK’), a third-party provider of information systems, that CDK was experiencing a cyber incident impacting its systems, including the systems necessary to support our dealer management system,” and that it “currently estimate[d] earnings per share for the quarter ended June 30, 2024, will be negatively impacted by approximately $1.50 per share, without taking into account any potential recoveries related to the incident.”
The sentence that matters most for anyone buying an AI agent came later in the same disclosure: after DMS restoration, “certain ancillary systems and integrations, such as those that help automate ordering, scheduling, payment, and reporting processes, remain unavailable or limited.” The integrations came back last. Your AI agent is one of those integrations. It will be dark after the DMS is back up, and unless you instrument it, the first people to notice will be customers receiving confirmations for appointments that no longer exist.
Lithia Motors, Inc. disclosed that it “activated its cyber incident response procedures, which included taking precautionary containment steps and severing business service connections between the Company's systems and CDK's.” Group 1 Automotive, Inc. described operating 202 dealerships in the US and UK, said its US operations were disrupted, and noted that its UK dealerships do not use CDK's systems and were therefore not impacted — an unintentional but precise illustration of what platform concentration costs and what diversification buys.
Every other failure mode in this vertical is a variation on the same theme: the agent keeps acting confidently on data that is no longer true. The table below gives each mode a detection signal you can implement and a rollback you can rehearse. The rule underneath all of them is fail closed. An agent that stops talking when it is unsure costs you a phone call. An agent that keeps talking when it is wrong costs you a customer, and occasionally a complaint to a regulator.
| Failure mode | What it looks like in a dealership | Detection signal | Rollback |
|---|---|---|---|
| Your DMS goes down and the integrations come back last | The documented case: AutoNation told the SEC that after DMS restoration, ancillary systems and integrations — the ones automating ordering, scheduling, payment and reporting — remained unavailable or limited. Your agent is one of those integrations. It will be dark after the DMS is back, and your staff will assume it is working | A heartbeat check that reads a known record over the interface every few minutes and alarms on failure, independent of any vendor status page | A written manual path for the service BDC, staffed and rehearsed at low volume. Kill the agent's outbound channel deliberately rather than letting it text customers from stale data |
| The agent texts from stale data during or after an outage | Appointment confirmations for appointments that no longer exist; RO status updates that are days old; a customer arriving for a slot nobody holds | Data freshness age on every record the agent uses, surfaced as a hard maximum rather than a dashboard average | Freshness gate: if the last successful read is older than the threshold, the agent stops sending anything about that record. Fail closed, not open |
| A vendor is acquired and the roadmap you bought belongs to someone else | This market consolidated hard in 2026. A product you selected as an independent challenger becomes a line in a larger suite, and your renewal quote moves without explanation | A footer entity change, a domain redirect, a press release, a competitor's homepage suddenly naming your vendor in the past tense | Contractual, agreed before signature: data export rights in a usable format, a defined exit window, and a clause on material change of control |
| Consent drifts out of sync and you are texting people who opted out | An opt-out honoured in one system and not another; a purchased or aged list loaded into a campaign; a Florida number contacted without a signed consent record | Reconcile suppression lists across the CRM, the messaging vendor and the DMS daily, and alert on any number contacted that appears in any suppression source | Stop the campaign, not the platform. Rebuild the suppression union from source, and keep the consent artefacts retrievable per number — that record is your defence |
| Prompt injection through an inbound customer message or a review | A message contains instructions the model follows — disclosing another customer's information, sending an unauthorised offer, or quoting a price nobody approved | Any outbound message that does not match an approved template; credential use outside the expected scope; unusual outbound volume in a short window | Revoke the agent credential rather than pausing the code, and assume anything the agent could read has been read. Then narrow the blast radius before re-enabling — this is the posture we work through in our prompt-injection guide |
| The write-back you assumed exists does not | The agent has been texting customers to confirm appointments for a month, and no appointment has ever appeared in the DMS. Advisors have been rekeying them, or not | Reconcile the agent's claimed writes against the DMS nightly. If the vendor cannot support that reconciliation, that is itself the finding | Revert to a queue an advisor works, and renegotiate the scope. This is the failure that the certification letter would have prevented before signature |
The prompt-injection row deserves a sentence of its own, because it is the failure mode most often waved away in a demo. Prompt injection is unsolved. Any agent that reads untrusted text — a customer SMS, an inbound email, a review, a scanned document — can be steered by instructions hidden in that text, and a service drive is a firehose of untrusted text arriving all day from strangers. The correct posture is not detection, it is blast-radius reduction: keep untrusted content out of any session holding a write credential, restrict outbound to approved templates, alert on anomalies, and revoke credentials rather than pausing code. Be sceptical of any vendor quoting a detection rate against injection — in security, a percentage in the nineties is a failing grade. We work the whole failure class through in our guide to prompt injection and the OWASP LLM Top 10.
The Human-in-the-Loop Boundary
Every row in this table is grounded in something verifiable — a vendor's own documentation, a regulation, or a federal ruling — rather than in a preference about how cautious to be. Print it and use it as the acceptance criteria for a pilot. If a vendor cannot tell you which row its product sits in for each action, that is your answer.
| Action | Boundary | Why the line is there | The control that makes it real |
|---|---|---|---|
| Read the repair order, live RO status and service history over a certified DMS interface | Agent may act alone | Read access is what certified interfaces are actually built to give. Matador documents exactly this on its CDK Drive and Reynolds pages, object by object | A read-only credential on its own agent identity, scoped to the objects named in the integration documentation, with the interface certificate on file |
| Send a service-reminder text to a customer who has consented | Agent may act alone | The consent, the identification of the responsible party and the opt-out are what make the message lawful — not the content of the message | Consent captured and timestamped at source, the dealership named in the first message, a working opt-out honoured across every channel you use, and suppression synced to the CRM within minutes rather than nightly |
| Place an outbound AI-voice call | Needs prior express consent, and prior express written consent where the call is marketing | FCC 24-17 classifies an AI-generated voice as an artificial voice, and the ruling refuses any carve-out for technologies that purport to provide the equivalent of a live agent | Written consent records retrievable per number; disclosure of the responsible party at the top of the call; opt-out honoured in-call; Florida numbers checked against § 501.059's signature and number requirements before dialling |
| Write an appointment back into the DMS | Vendor-discretionary — verify per DMS, in writing | At least one RCI-certified vendor states in public that it cannot do this for Reynolds ERA. Another claims it can. The certificate decides, not the demo | The certification letter and the specific write scopes named in your contract, per DMS, plus a reconciliation job that compares what the agent believes it wrote against what the DMS actually holds |
| Quote a price, a payment or vehicle availability to a customer | Needs review | That is an advertised representation made on the dealership's licence. With the CARS Rule vacated and withdrawn, what governs it is FTC Act § 5 and state dealer-advertising law — and the licence is yours, not the model's | Templated, human-approved price language only; no free-text generation of figures; every quoted number traced to a system of record and logged with the approver's identity |
| Contribute to a decision to deny credit or to offer materially worse terms | Must never act alone | ECOA § 1691(d) and Regulation B § 1002.9(b)(2) require a statement of specific reasons. Model complexity has never been a defence, and the withdrawal of the 2022 guidance did not change the statute | No agent credential touches the decisioning surface. The agent may collect, pre-fill and surface options; a named human owns the adverse action and the notice |
| Handle customer information without a contracted vendor safeguards obligation | Must never happen | 16 CFR § 314.4(f)(2) requires you to require your service providers by contract to implement and maintain appropriate safeguards. This is a duty on the dealer, not on the vendor | The safeguards clause signed before the pilot begins, not after go-live; periodic re-assessment scheduled and documented; the assessment record kept where an examiner can find it |
| Act on instructions found inside a customer message, an email, a document or a review | Must never happen | Prompt injection is unsolved. Any agent reading untrusted text can be steered by it, and a service drive is nothing but untrusted text arriving all day | Untrusted content never shares a session with a write credential; outbound sends restricted to approved templates; anomaly alerts on outbound volume; revoke the credential rather than pausing the code |
Two boundaries are worth restating in the shape a compliance officer will quote back at you. An agent may read the repair order, the RO status and the service history over a certified interface, and it may send a consenting customer a message; writing the appointment back is a separate, vendor-discretionary permission that must be evidenced per DMS. And: an AI tool may collect the application, pre-fill the deal and surface financing options; if it contributes to a decision to deny credit or offer worse terms, a specific-reasons adverse-action notice is required under ECOA § 1691(d) and Regulation B § 1002.9(b)(2), and model complexity is not an answer.
The boundary that catches dealerships out most often is the price quote. It feels administrative — the agent is reading a number off a system and repeating it — but a quoted price, payment or availability is an advertised representation made on the dealership's licence, and the licence does not care that a model produced the sentence. That is why the control in that row is templated, approved language with every figure traced to a system of record, rather than a system prompt instructing the model to be careful. A system prompt is a request. A template is a control.
Cost, Timeline and Build vs Buy
No vendor on this roster publishes a price, so every purchase in this market starts with a procurement cycle rather than a number. Budget the calendar time for that, and use the wait productively: the artefacts you need for 16 CFR § 314.4(f) diligence are the same ones that tell you whether the product is any good.
| Engagement | Range | Timeline | What it includes |
|---|---|---|---|
| Discovery + workflow audit | $9k–$22k | 2–4 weeks | Workflow inventory across the DMS, the CRM, the scheduler and the phone system; a written map of which interfaces are read-only and which write scopes you actually hold; vendor artefact collection against 16 CFR § 314.4(f); consent-record audit; a prioritised shortlist with a measurement baseline taken before anything is bought |
| Single-workflow agent | $28k–$70k | 4–9 weeks | One workflow end to end — inbound service triage, RO status updates, or declined-service follow-up — with read integration, a human commit step for anything customer-facing that quotes a number, idempotent writes where writes are permitted, reconciliation against the DMS, full audit logging, and a review queue instrumented for timing |
| Multi-workflow platform with system integration | $70k–$180k | 9–16 weeks | Several workflows across sales and fixed operations, read and write paths where the DMS genuinely supports them, an evaluation harness against your own transcripts and records, schema-drift tests in CI so a DMS update does not silently break extraction, and a reporting pack you can hand to an examiner |
| Enterprise / multi-site / regulated build | $180k–$420k+ | 14–24 weeks | Multi-rooftop or multi-state rollout, per-store isolation, consent handling that survives a state-by-state review, a full audit pipeline with attribution that holds up in a compliance examination, step-up authorisation for privileged actions, disaster recovery and restoration testing against a DMS outage scenario, and the documentation package |
Senior-led work runs $150–$225/hr, ongoing retainers $2,500–$9,500/month, every engagement carries a 30-day post-launch warranty, and a fixed-price phased proposal follows a discovery call within 5 business days. Full source-code and IP ownership transfers to you. We are a senior-led, Black-owned agency in Los Angeles, and you can reach us on +1 (424) 272-5601.
When buying wins: a commodity workflow where a vendor already holds a certified DMS interface you would otherwise have to negotiate yourself. Inbound service texting is the clearest example — several vendors hold documented interfaces into CDK, Reynolds and Tekion, and reproducing that access from scratch is a commercial problem rather than an engineering one. When building wins: when the workflow spans systems no single vendor integrates; when you need the audit trail, the retention policy and the consent records to be yours rather than a vendor's; when the data you would be handing over is more sensitive than the workflow is valuable; or when your group is large enough that per-rooftop subscription pricing overtakes a build inside two years.
Whichever way you go, one line item is not optional: the read-versus-write map per interface. Whether you buy or build, somebody has to establish, in writing and per DMS, what the agent may actually do. Doing that before you sign costs a few thousand dollars in discovery. Doing it after go-live costs a quarter, and it is the most common reason a dealership AI project is quietly shelved rather than loudly cancelled.
Red Flags When Evaluating a Vendor
Every red flag below was observed on a real vendor page during this research, and every one is checkable by you in under a minute. None of them is disqualifying on its own. Two or three together tell you what kind of counterparty you are dealing with.
Stop and ask before you proceed
- An appointment-set rate, booking rate or ROI figure offered as neutral fact: Ask for the methodology, the sample and the denominator. If those do not exist, the number does not either. A cost-of-inaction figure — value you are supposedly forgoing every month — is the most aggressive version of this and the least substantiated.
- SOC 2 described as a certification: SOC 2 Type II is an attestation, not a certification. One vendor in this roster gets the terminology right and another gets it wrong on its own compliance page. It is a small tell, and in a market with no referee small tells are most of what you have.
- A compliance certificate that belongs to the hosting provider: Confirm the certificate names the vendor's own legal entity. Citing a cloud provider's ISO 27001 or SOC 2 on your own security page is a pattern we have found repeatedly across this series, and it is thirty seconds to check.
- Integrations shown as logos rather than documented per system: A logo wall is not an integration list. Ask which system, which objects, which direction, and where that is published. The best vendor in this table answers all four on a public page.
- No written answer on DMS write scopes: Ask for the certification letter and the specific write permissions, per DMS, in writing, before signature. A vendor that treats this as an unreasonable question has told you the answer.
- A compliance link that resolves to nothing: One vendor in this roster has a TCPA Compliance link in its own footer that returns a 404. Click the compliance links. It costs nothing and it is remarkably informative.
- A citation you cannot find in the Federal Register: If a deck cites CFPB Circular 2026-03, that document does not exist. Treat a confidently wrong regulatory citation as evidence about the source, not as a detail to correct politely.
- Any suggestion that the TCPA got easier for AI callers: It did not. One narrow consent provision was vacated in January 2025; the written-consent regime and the artificial-voice classification both stand. A vendor that gets this backwards is exposing you, not itself.
- A flagship testimonial from outside your industry: One vendor's headline revenue claim on its own pricing page is attributed to an HVAC company. That does not make the product bad; it makes the number irrelevant to a service drive.
- No answer on data retention, residency or model training: You have a legal duty under § 314.4(f) to assess this. Being asked is not unreasonable; being unable to answer is.
And the inverse — the signals worth paying for. The vendor publishes what its interface cannot do. It names its integrations per system and states the direction of flow. It calls an attestation an attestation. It publishes a DPA and a sub-processor list you can read without signing anything. It describes a human review stage as a designed feature rather than a limitation. On this roster, the vendors that described their own products most conservatively were consistently the ones whose public documentation held up best under checking, and that correlation is not a coincidence — it is the same discipline showing up in two places.
Limitations and What We Could Not Verify
This ranking has real limits and they belong on the page rather than in a footnote. Here is everything that constrains what you have just read.
What we could not establish
- Ownership for most of the roster: We could not verify ownership for Matador, Numa, Toma, Kenect, Podium or Lotlinx, nor for CDK Global or automotiveMastermind. Cars.com Inc. is the exception, because it is publicly traded. Where we could not verify, we wrote not disclosed rather than repeating what is widely reported.
- Any price at all: No vendor in this roster publishes one. Every pricing cell reads not publicly disclosed, and we never estimate.
- Any independent evaluation of any product here: None located, of any kind, as of 23 August 2026. That is a verified absence rather than a rhetorical flourish, and it is the reason this article is built the way it is.
- How MDL 2817 actually ended: We verified that it was consolidated in February 2018 and that both dockets terminated in March 2025. The terms — settlements, amounts, approvals — were not verified, so we characterise the outcome nowhere.
- What the Seventh Circuit held in the 2017 Authenticom appeal: We did not read the disposition in full and therefore do not describe it. We say only that the dispute reached the Seventh Circuit in 2017, which is enough to make the point.
- Darwin Automotive's 2026 existence: The domain returned a Cloudflare 403 and could not be reached. Unconfirmed existence means not ranked, and applying that rule consistently is the whole point of having it.
- Trust-page contents for Impel, Podium and Cars Commerce: All three exist; none was machine-readable or enumerated in this research. Their certifications are recorded as vendor claims or as unread, never as verified.
- Numa's DMS write-back claim: Unverifiable from any DMS vendor's certification documentation. We present the contradiction with Matador's published limitation as the question a buyer should ask, not as a finding against either vendor.
- CFPB's 2026 enforcement posture in detail: Reported changes to nonbank auto-finance supervision are described in secondary sources we did not verify to primary documents. We print the safe formulation — supervisory attention narrowed, the underlying obligations did not — and nothing more specific.
- State dealer-advertising law: We verified no specific state advertising regulation in this research, so we cite none. The general proposition holds — a quoted price is an advertised representation on your licence — but check your own state's code and your own DMV's guidance.
None of this argues against buying. It argues for buying in the right order: establish what each interface actually permits, per DMS, in writing; work out which workflows sit safely on the read side of that line; collect the compliance artefacts your Safeguards duty already requires you to collect; measure your own baseline for two weeks; and only then decide which product you like. The dealer groups that get value from this technology in 2026 are the ones that found out what they were permitted to automate before they found out what the demo could do.
And the boundary holds whichever vendor you choose. An agent may read, identify, summarise, draft and queue. A person books what the interface will not let it book, approves every number that leaves the building, and owns every adverse action. The licence is the dealership's, and so is everything the tool says under it.
Want an Honest Read on Your Store's Workflows?
Book a free 60-minute discovery call with Frenchy Digital — a senior-led Black-owned LA agency. You leave with a workflow inventory across your DMS, CRM, scheduler and phone system, a written read-versus-write map per interface, a vendor artefact checklist against 16 CFR § 314.4(f), and a fixed-price phased proposal within 5 business days. Call +1 (424) 272-5601.
Want an Honest Read on Your Store's Workflows?
Book a free 60-minute discovery call. You leave with a workflow inventory across your DMS, CRM, scheduler and phone system, a written read-versus-write map per interface, a vendor artefact checklist against 16 CFR § 314.4(f), and a fixed-price phased proposal within 5 business days.
1517 S Bentley Ave Unit 204, Los Angeles CA 90025
Frequently Asked Questions
Sources & References
- 1US Court of Appeals for the Fifth Circuit — NADA v. FTC, No. 24-60013, decided 27 January 2025 (127 F.4th 549)↗
- 2Federal Register — FTC withdrawal of the CARS Rule, 91 FR 6507, effective 12 February 2026↗
- 3Federal Register — CFPB, Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal, 90 FR 20084 (12 May 2025)↗
- 4eCFR — 16 CFR § 314.4, elements of an information security program (including § 314.4(f), service provider oversight)↗
- 5FTC — Automobile Dealers and the FTC's Safeguards Rule: Frequently Asked Questions↗
- 6FTC Business Blog — Safeguards Rule notification requirement now in effect (14 May 2024)↗
- 7FCC — Declaratory Ruling FCC 24-17, AI-generated voices under the TCPA, released 8 February 2024↗
- 8Florida Legislature — Fla. Stat. § 501.059, Telephone Solicitation Act↗
- 9Office of the Law Revision Counsel — 15 U.S.C. § 1691, Equal Credit Opportunity Act↗
- 10eCFR — 12 CFR § 1002.9, Regulation B notifications and specific reasons for adverse action↗
- 11Federal Register — Regulation B final rule at 91 FR 21620, effective 21 July 2026↗
- 12CourtListener — docket, Tekion Corp. v. CDK Global, LLC, No. 3:24-cv-08879 (N.D. Cal., filed 9 December 2024)↗
- 13CourtListener — docket, In Re: Dealer Management Systems Antitrust Litigation, MDL No. 2817 (N.D. Ill.)↗
- 14SEC EDGAR — AutoNation, Inc., Form 8-K filed 15 July 2024 (CDK cyber incident)↗
- 15SEC EDGAR — Lithia Motors, Inc., Form 8-K filed 24 June 2024↗
- 16SEC EDGAR — Group 1 Automotive, Inc., Exhibit 99.1 to Form 8-K, 24 June 2024↗
- 17SEC — In the Matter of Presto Automation Inc., Securities Act Release No. 11352 (14 January 2025)↗
- 18US Bureau of Labor Statistics — CES series CES4244100001, motor vehicle and parts dealers employment↗
- 19US Census Bureau — Advance Monthly Retail Trade Survey, July 2026 (Release CB26-131, 14 August 2026)↗
- 20Matador AI — Reynolds and Reynolds integration page, stating RCI certification for ERA and Direction: Read from the DMS↗
- 21Matador AI — CDK Drive integration page↗
- 22Matador AI — integrations index, stating 63 and counting↗
- 23Kenect — integrations page, naming CDK eLead, Tekion, DealerSocket, VinSolutions, Dealertrack, Xtime and ZiiDMS↗
- 24Tekion — Trust Portal, compliance page (SOC 1 and SOC 2 Type II attestations, ISO/IEC 27001 and 27701)↗
- 25Tekion — public Data Processing Addendum↗
- 26CDK Global — CDK Trust Center (SOC 1 and SOC 2 attestations, ISO/IEC 27001:2022 certified by EY CertifyPoint)↗
- 27Fortellis — CDK's published developer and API platform↗
- 28Cox Automotive — completion of the Fullpath acquisition, 1 June 2026↗
- 29Gubagoo — privacy policy naming The Reynolds and Reynolds Company and a Reynolds Way, Dayton, Ohio address↗
- 30SEC — Cars.com Inc. (NYSE: CARS, CIK 0001683606) filing history, including the FY2025 Form 10-K filed 26 February 2026↗
- 31Impel — newsroom, showing sustained 2026 corporate activity↗
- 32Fullpath — legal and trust page (ISO 27001 and ISO 42001 claims, public DPA and sub-processor list)↗
