1 December 2025 · 11 min read · SpectraIQ Compliance
The governance gap
Most dealer groups have no documented AI policy. Individual GMs sign trials, data flows out, OEM auditors notice, the holding company is exposed.
The minimum policy
Approved vendor list. Required PIA before deployment. Data residency mandate. Tone and brand standards. Escalation matrix. Quarterly review.
Centralised vs federated
Centralised procurement, federated configuration. The group sets the rails; individual rooftops choose tone, hours and offers within them.
Board reporting
AI deployments should appear in the quarterly risk register. Vendor security incidents are board-level events.