Short answer: no software makes a dealership compliant with the FTC Safeguards Rule on its own. The rule asks for a written security program, run by a person you name, and software covers pieces of it: multifactor authentication, encryption, logging, vulnerability testing and vendor oversight. The risk most dealers miss is staff pasting credit applications into public AI tools. Close that gap first, because it is the easiest one to prove and the easiest one to fix.
By Jacques M. Jean. November 2026.
Every month a dealer asks me some version of the same question: which platform do I buy so I pass a Safeguards audit? The honest answer is that there is no single box to buy. Anyone selling you "compliance in a box" is selling you comfort.
What you can do is match each part of the rule to a tool, a policy and a person. Here is how that breaks down, in plain words.
Why does the FTC treat a dealership like a bank?
Because on paper, you are one. If your store arranges financing or leasing, the FTC treats you as a financial institution. Your F&I office collects Social Security numbers, income, bank details and credit reports on every deal. That is the same kind of data a bank holds, so the FTC holds you to a similar standard.
The updated rule took effect for most businesses on June 9, 2023. Since May 13, 2024, you also have to tell the FTC within 30 days if unencrypted information on 500 or more customers is taken.
What does the rule actually ask for?
In short, nine things:
- A Qualified Individual who owns your security program. It can be an employee or an outside provider, but someone has to be named.
- A written risk assessment of where customer data lives and what could go wrong.
- Safeguards based on that assessment: access controls, encryption, multifactor authentication, secure disposal and activity logging.
- Testing, either continuous monitoring or yearly penetration tests plus vulnerability scans every six months.
- Staff training, so the people at the desk know what not to do.
- Oversight of service providers, meaning you check how your vendors protect the customer data you hand them.
- A written incident response plan.
- An annual written report from your Qualified Individual to your owner or board.
- Updates to the program as your store and your systems change.
A store that keeps data on fewer than 5,000 consumers is spared some of the paperwork, like the written risk assessment, the incident plan and the annual report. Most franchise stores pass that number quickly.
Which software covers which part?
| What the rule asks | Software that helps | What software cannot do |
|---|---|---|
| Access controls and MFA | Your DMS and CRM settings, a single sign on tool, MFA on email | Decide who should see what |
| Encryption | Encrypted laptops, drives and backups, encrypted email | Stop someone from copying data into another app |
| Logging and monitoring | Activity logs, endpoint protection, a managed security provider | Read the logs for you if nobody is assigned |
| Testing | Vulnerability scanners, a yearly penetration test | Fix what the test finds |
| Vendor oversight | A vendor list with contracts and security terms | Make a vendor sign one |
| Incident response | Backups, alerting, a written plan template | Run the drill |
The pattern is clear. Software gives you the controls. A person still has to own them, and a policy still has to say how they are used.
Where does AI fit into all this?
This is the gap I see most often, and it is growing fast.
A salesperson wants to move faster. They paste a credit application into ChatGPT and ask for a summary. A finance manager drops a deal jacket into a free AI tool to draft a letter. Nobody meant harm. But that customer's data just left your network and landed with a vendor you never reviewed.
Under the Safeguards Rule, that vendor is now part of your risk. It belongs in your risk assessment and your vendor oversight. In practice, it almost never is.
You have two honest options:
- Ban it, in writing, and enforce it. Put it in your policy and your training, and block the tools on store devices.
- Give staff a private AI that runs on hardware you own. They get the speed, and the data never leaves the building. There is no outside AI vendor to review because there is no outside AI vendor.
Most stores end up doing both: a written rule for public tools, and a private tool so people stop reaching for them.
What should you ask any vendor who says they help with Safeguards?
Five questions that sort the serious ones from the rest:
- Where exactly does my customer data go, and who can see it?
- Will you put your security terms in writing in our contract?
- Can you give us the logs and reports our annual report needs?
- What happens to our data if we cancel?
- Do you claim your product makes us compliant? (If the answer is yes, keep looking.)
How TechFides helps, and where we stop
We keep customer financial data, deal files and service history on hardware your store owns, and we give your team private AI to work with it. That takes an outside AI vendor out of your risk assessment and makes the data map in your written program shorter and easier to defend.
We do not make you compliant, and we will not tell you otherwise. Your Qualified Individual still runs the program, signs the report and owns the result. We make the AI part of that job simple.
If you want to see what that looks like for your store, read our auto dealership page, or book a 15 minute call. If you are in Dallas Fort Worth, start with our DFW dealer page.
This post is a plain language overview, not legal advice. Check the rule text and talk to your counsel or compliance advisor about your store.
Like this? Get the next one Wednesday.
One email per week. No marketing filler. Unsubscribe anytime.