The Three Most Common DMs I Got From Dealers in May

I shipped two compliance posts to the dealer audience in late May. The AI/FTC responsibility post on May 29. The CARS Rule companion post on May 31. Both generated DMs from dealers.

I am not going to share the dealers' names or identifying details. I am going to share the patterns. Three questions came up enough times that they are worth naming publicly. The answers I gave privately are the answers I am giving publicly here.

Question One: "Is My Existing AI Tool a Compliance Problem?"

About half the DMs were variations of this question.

The dealer has an AI chatbot on the website. An AI BDC. An AI lead routing system. An AI inventory description writer. Some combination of vendor-supplied AI products that have been running for months or years. The dealer read the FTC post and is now wondering whether any of these tools is creating compliance exposure.

My answer was the same for everyone who asked.

The tool itself is not the problem. The accountability gap around the tool is the problem.

Three questions to run any AI tool through.

First. Can you produce, on demand, a complete log of every claim the tool made to a customer in the last sixty days? If yes, you have observability. If no, the tool is operating in a way you cannot audit, and you cannot defend it if a regulator asks what it said.

Second. Does the tool have access to credit data, financial information, or anything that puts you under the Safeguards Rule? If yes, the vendor needs SOC 2 attestation or equivalent. If they cannot produce one, that is a problem you cannot solve with a written policy.

Third. Who at your store has authority to override or correct what the tool said to a customer? If the answer is "nobody" or "it is automatic," you have a process gap. Regulators expect a human in the loop, not because AI cannot be trusted, but because accountability requires a named accountable party.

If a tool fails any of the three questions, the answer is not necessarily to shut it down. The answer is to fix the gap. Add logging. Get the SOC 2. Name the accountable person. The tools are not the threat. The unaccountable use of the tools is the threat.

Question Two: "What About Compliance for States I Do Not Operate In?"

The second pattern was state-scope confusion.

Dealers operating in one state asked whether California's CARS Act applies to them. Dealers operating in multiple states asked which state's law governs which transaction. Dealers who advertise online but do not have a presence outside their home state asked whether out-of-state customer interactions trigger compliance in those states.

My answer has three parts.

One. If you advertise to customers in a state, that state's consumer protection laws can apply, regardless of where your dealership is located. California has been aggressive about asserting jurisdiction over out-of-state dealers who advertise to California consumers. Other states are following.

Two. The Safeguards Rule is federal. It applies to every dealership in every state that handles customer credit data. There is no state exemption.

Three. State CARS Acts are different from each other. California's takes effect October 2026. Colorado, Connecticut, Maryland, Pennsylvania, and Virginia are at various stages. Read your own state's specific requirements rather than assuming they mirror California.

The dealers who get caught are not the ones who advertise nationwide and ignore state law. They are the ones who advertise nationwide and assume the federal floor is sufficient. The state floor sits higher.

Question Three: "Should I Buy Your Compliance Product?"

This is the question I want to address most directly.

Multiple dealers DMed asking whether I sell a compliance program, a compliance audit service, an AI compliance certification, or any other product that would help them get current.

I do not sell any of those things. I do not plan to.

The reasoning. There are good compliance attorneys who specialize in dealer law. There are good compliance consultants who specialize in Safeguards Rule audits. There are good MSPs who specialize in dealership technology. My adding a compliance product to that market would be entering a category where I have no comparative advantage and where the existing providers are doing work I respect.

What I do is different. I write about how to think about AI operations, including how compliance fits into a broader operating posture. I work with a small number of clients on the framework that connects strategy, governance, and execution. That is the AI Operator Framework. Compliance is one layer in that framework. It is not the whole framework, and the framework is not a compliance product.

If you are a dealer who needs help getting Safeguards Rule current, I will recommend three lawyers and two consultants who do that work well. None of them is me. None of them pays me a referral fee. They are just good at the thing you need.

If you are a dealer who wants to think about your entire AI operating posture, including how compliance fits, my calendar is open. That is a different conversation than buying a compliance product. It is the conversation I am set up to have.

What the Pattern Tells Me

Three observations from the volume and content of these DMs.

Dealers are anxious about AI compliance, and the anxiety is not being met by their existing vendor relationships. Most of the dealers who DMed me have vendors. They are paying their vendors. The vendors are not answering the questions the dealers actually have. There is a gap between what dealers are sold and what dealers need.

The compliance conversation is the entry conversation, not the exit conversation. Dealers reach out about compliance because that is the most pressing pain point in their inbox. The conversation that follows is rarely about compliance itself. It is about operating posture, vendor relationships, organizational design, the questions that compliance pressure surfaces.

Operators recognize operator content. The dealers who DMed me referenced specific phrasings from the posts that an outsider would have missed. Not the headlines. The middle paragraphs where the operator details lived. Dealers are reading carefully. Surface-level content does not move them. Specifics do.

If You DMed Me and I Have Not Responded Yet

I read every DM. I respond to every DM. The response can take 48 hours. Sometimes longer if I am traveling.

If you DMed me before this post and did not get an answer, send another message. It is possible something dropped. I would rather get pinged twice than miss someone.

If you are reading this post and have a question that fits one of the three patterns above, the answer above is the same answer I would give you privately. Saved you a DM.

If you have a question that does not fit those patterns, that is the DM I want. Different questions tell me where the next post needs to go.

Structure before tools. Strategy before speed. Systems before scale.

The AI Operator Framework is the methodology for designing, governing, and scaling AI operations inside a business, including the data and citation fidelity layers most companies skip. Explore the full framework at JamilAshkar.com/framework. Start with the free course at JamilAshkar.com/course.