A plain-English, hands-on session for the Beck Motor team in Pierre. No hype, no jargon. Just what AI is good at, the one rule that keeps customers safe, and where it can save your department real time.
Beck Motor Company · Family owned since 1969July 29, 2026 · Pierre, SDPresented by Dakota Intelligence, Mitchell SD
Basic Session Overview
Who this is for: Everyone. Sales, service, parts, office, detail, collision. If you work at Beck Motor, this hour is for you.
How it works: Follow along on your phone or laptop while Timm walks the room. Click the boxes, take the short quizzes, and speak up. Questions make the session better.
The promise: By the end of this hour you will know what AI is good at, what it is bad at, the one rule that protects Beck Motor customers, and one way AI can save you time this week.
Your progress
0 of 3 modules marked complete.
The Big Picture
Every safe use of AI at work follows this same path. Click each box to see what it means. Blue boxes are AI steps. Gold-ringed boxes are where a person stays in charge.
AI does the work A human checks it
You have a task: A follow-up text, a service explanation a customer will actually understand, a help-wanted ad, a schedule note. AI starts with your job, not the other way around.
AI drafts it: The AI produces a first draft in seconds. Think of it as a very fast assistant who has read a lot but has never set foot in Pierre and does not know your customers.
You review it: This step never goes away. You check the facts, the tone, and whether it promised anything it should not have. You know Beck Motor. The AI does not.
You use it: You send it, post it, or hand it to the customer. Your name is on it, so it goes out when you say it is ready, not before.
Module 1: What AI Actually Is (and Is Not)
About 15 minutesNo tech background needed
Plain-English lesson
The AI everyone talks about is a prediction machine. It has read an enormous amount of text and learned the patterns of how people write and explain things. When you type a request, it predicts a useful response one word at a time. That makes it remarkably good at some jobs and unreliable at others.
Great at Drafting emails and texts, rewording things to sound friendlier or clearer, summarizing long documents, brainstorming, explaining technical work in plain language.
Weak at Knowing your current inventory, your prices, your policies, or anything that happened at Beck Motor. If it does not have the facts, it may fill the gap with a confident guess.
The fix Give it the facts it needs, and check its work before it reaches a customer. AI plus your judgment beats either one alone.
What that means on the floor
Sales AI can draft a warm follow-up text in your voice. It cannot know which trucks are on the lot this morning. You supply that.
Service and parts AI can turn "replaced serpentine belt, noted seepage at valve cover" into a sentence a customer understands. It cannot diagnose the car. That stays with the tech.
Office AI can draft a job posting or a vendor email in two minutes. It cannot know your actual pay range or terms. You fill those in.
One sentence to remember: AI is a fast first draft, not a final answer.
See the difference facts make
Without facts The ask: "What diesel pickups do we have in stock?"
What comes back: "You have several excellent options, including the 2024 Silverado 2500HD Duramax..." Confident, specific, and completely made up. It has never seen your lot.
With facts The ask: "Here are the three diesels on our lot today: [your actual list]. Write one friendly sentence about each for a follow-up text."
What comes back: Three usable sentences about trucks that actually exist. Same AI. The facts made the difference.
Quick quiz
Which statement is true?
Module 2: The One Rule at a Dealership
About 15 minutesThis one has teeth
Plain-English lesson
Because Beck Motor arranges financing, federal law treats it like a financial institution. The FTC Safeguards Rule requires dealerships to protect customer financial information, and that rule follows the data wherever it goes, including into an AI chat window.
The one rule: Never put a customer's private information into a free, public AI tool. Not their name attached to a deal, not a Social Security number, not a credit application, not deal terms, not a driver's license photo, not a phone number pulled from the CRM.
Free consumer AI tools may store what you type and use it however their terms allow. Once customer information leaves the building through one of those tools, Beck Motor cannot get it back, and the exposure is real: regulatory, legal, and the kind of trust damage a 55-year-old family business never wants to explain.
Sort the risk: click each box
Green: General questions, public information, drafting where no real customer is named. "Write a friendly service reminder for a truck due for an oil change" names no one and risks nothing.
Yellow: Real situations with the identifying details removed. "A customer is unhappy about a repair delay, help me draft an apology" is fine. Pasting the customer's actual name, number, and VIN is not.
Red: Anything from a credit application, deal jacket, or F&I paperwork. SSNs, DOBs, license images, account numbers, credit scores, financing terms tied to a person. These never touch a consumer AI tool under any circumstances.
Already using AI on your own? Good.
If you have been quietly using ChatGPT or something like it to get work done, you are not in trouble. It means you are ahead of the curve. Today is about bringing that into the open and doing it safely, so nobody learns the red-zone lesson the hard way.
Free consumer tools May store and learn from what you type. Fine for green-zone work. Never for customer data.
Business-grade tools Paid business accounts with data protections are how AI eventually handles more sensitive workflows, with management deciding what is approved.
Quick quiz
A customer's credit application is confusing. What is the safe move?
Which request is in the green zone?
Module 3: AI in Your Day at Beck Motor
About 15 minutesTake one home
Plain-English lesson
You do not need to automate the dealership this afternoon. You need one task that AI can make faster this week. Here are the ones that pay off first, by role.
Sales floor Drafting follow-up texts and emails, prepping for common objections, writing vehicle descriptions that do not sound like every other listing.
Service and parts Turning tech notes into customer-friendly explanations, drafting service reminders, wording a tough conversation about a repair bill.
Office and admin Job postings, vendor emails, meeting summaries, first drafts of policies and announcements.
Everyone Rewording anything for tone. "Make this friendlier." "Make this shorter." "Explain this like I am not a mechanic."
The simple recipe for asking
Better requests get better drafts. Click each ingredient.
Job: Say exactly what you want. "Draft a two-sentence text following up on a Saturday test drive."
Audience: Who reads it. "A rancher who wants the point fast" reads differently than "a first-time buyer who is nervous about financing."
Background: The facts it needs, minus anything private. Vehicle type, general situation, the tone Beck Motor uses with neighbors.
Boundaries: What it must not do. "Do not mention price or financing terms. Do not promise availability. Ask me if you need a detail."
Try it: name your one task
Write down one repetitive task from your week that AI could draft for you. This stays on your device.
Side by side: what each ask gets you
Weak ask The ask: "Write something about trucks."
What comes back: A generic paragraph that could belong to any dealership in America. You will rewrite the whole thing, so it saved you nothing.
Strong ask The ask: "Draft a short, friendly text to a customer who test drove a Silverado Saturday. Invite them back this week. Do not mention price."
What comes back: Two sentences you can approve after a ten-second read. That is the recipe working.
Quick quiz
Which is the stronger request?
Basic Session Final Check
Four questions. Answer them all, then submit.
1. The best way to think about AI at work is:
2. Customer financial information and free AI tools:
3. AI does not know Beck Motor's current inventory or policies, so:
4. A strong AI request includes:
Four things to walk out with:
1. AI drafts, you decide.
2. Customer private data never enters a free AI tool.
3. Give it facts, or it may guess.
4. Start with one task this week.
Advanced Session Overview
Who this is for: Managers, owners, and staff Trace has tapped for this block. You have already been through a basic session, so we move faster and go deeper.
The shift: The basic session was about single tasks. This session is about workflows: chaining AI steps together with human checkpoints so repetitive work runs on rails.
The promise: You will leave knowing which repetitive Beck Motor tasks are pipeline candidates, what a safe pipeline looks like stage by stage, and a rollout order that does not bite off too much at once.
Your progress
0 of 4 modules marked complete.
Module 1: Beyond Single Tasks
About 15 minutesThe leverage math
Plain-English lesson
In the basic session, AI drafted one thing at a time. The real payoff comes when a repetitive task gets a standing process: a trigger kicks it off, AI does the drafting or sorting, a person approves, and the result lands where it belongs. That standing process is a pipeline.
The leverage math: A ten-minute task done twenty times a week is 170 hours a year. Cut it to two minutes of review and you just bought back over 135 hours, per task, per person doing it.
Anatomy of every safe pipeline
Click each stage. Notice the gold ring: no pipeline in this room ships anything to a customer without a human approving it.
Automated step Human checkpoint
Trigger: A lead comes in, a service is completed, a phone rings after hours, a repair order closes. Pipelines start from events that already happen dozens of times a week.
AI step: The AI drafts the message, summarizes the notes, sorts the request, or translates the tech-speak. This is the part that used to eat someone's morning.
Approval: A named person sees the draft before it moves. For some low-risk internal work this can loosen over time, but customer-facing output keeps this checkpoint. Always.
Output: The text goes to the customer, the note lands in the CRM, the summary hits the manager's inbox at 7 AM. The result arrives where work actually happens, not in a tool nobody opens.
Quick quiz
What makes a task a good pipeline candidate?
Module 2: Department Deep Dives
About 25 minutesClick your department
Each department gets the two or three highest-value plays plus the caution that matters most in that room. Click a department to expand it.
Play 1: Lead follow-up drafting AI drafts the first-touch and follow-up messages in Beck Motor's voice. The salesperson edits and sends. Speed-to-lead improves without sounding like a robot wrote it, because a person finished it.
Play 2: Know your CRM's AI Modern dealership CRMs already run AI features behind the scenes: lead scoring, suggested replies, engagement tracking. Knowing what yours is doing matters as much as any new tool.
Play 3: Objection prep Rehearse tough conversations. "Play a customer who thinks the trade-in offer is low" is a private practice rep that costs nothing.
The caution No AI-drafted claims about price, APR, payments, or availability go out without human review. A drafted number that reads like an offer is a real problem. The human edit is not optional here.
Play 1: Inspection translation Multi-point inspection findings, rewritten so the customer actually understands what "seepage at the valve cover gasket" means and why it matters. Clear explanations approve more work than pressure ever did.
Play 2: Reminder and follow-up language Service reminders, declined-work follow-ups, and seasonal campaigns drafted in minutes instead of an afternoon nobody has.
Play 3: Tech research assist AI as a thinking partner on a stubborn diagnosis: summarizing bulletins, laying out possibilities to check. It helps a tech think. It never signs off. The tech does.
The caution Liability lives here. AI-assisted research supports the technician's judgment and paper trail. It does not replace either. If a diagnosis is wrong, "the AI said so" is not a defense.
The hard line first This is the most compliance-sensitive room in the building. Credit applications, deal terms, customer financials: none of it touches a consumer AI tool, full stop. The Safeguards Rule from the basic session applies here with teeth, because these are the hands that hold the paperwork.
Play 1: Internal drafting Job postings, policy drafts, staff announcements, vendor correspondence. High volume, low risk, immediate payoff.
Play 2: Summarizing the readable Meeting notes, public program documents, training materials. AI condenses; the office confirms.
Play 3: Process documentation Those procedures that live in one person's head? AI interviews are a fast way to get them written down before vacation season proves the point.
Quick quiz
Which department output can never skip human review, even in a mature pipeline?
Module 3: Pipelines, the Repetitive Work on Rails
About 30 minutesThe centerpiece
Four real dealership pipelines. Every stage is clickable. Watch where the gold rings sit: that placement is the whole design philosophy.
1
Lead Follow-Up Pipeline
Trigger: A lead lands from the website, a phone inquiry, or the walk-in log. Today, response speed depends on who is free. In the pipeline, the clock starts instantly.
AI step: Using the inquiry type and vehicle interest, AI drafts a personalized first response. No invented pricing, no availability promises: those are boundaries baked into the pipeline's instructions.
Human checkpoint: The draft waits in the salesperson's queue. Thirty seconds to personalize and approve beats ten minutes to write from scratch, and the customer still gets a message a person stands behind.
Output: The approved message sends, and the interaction logs to the CRM automatically. No sticky notes, no "did anyone get back to that guy from Tuesday?"
2
Service Reminder Pipeline
Trigger: Vehicles crossing a mileage or time threshold surface automatically from service records, on approved business systems, not free tools.
AI step: Each reminder references the actual vehicle and service due, written like a neighbor's note rather than a form letter. Batch of forty, drafted in a minute.
Human checkpoint: The advisor scans the batch, pulls any that should not go (that customer called yesterday, that truck was traded in), and approves the rest in one pass.
Output: Reminders go out, bookings come back, and the follow-up list of non-responders builds itself for a second, gentler touch.
3
Inspection Write-Up Pipeline
Trigger: The multi-point inspection closes with the usual tech shorthand. Accurate, and unreadable to most customers.
AI step: Each finding becomes one clear sentence: what it is, why it matters, how urgent. No scare tactics, no invented severity. Just translation.
Human checkpoint: The advisor confirms the plain-English version says exactly what the tech meant. A translation error here costs trust, so this check is non-negotiable.
Output, also human: The advisor walks the customer through it, or sends it with the estimate. Customers approve more recommended work when they genuinely understand it. That is the revenue case for this whole pipeline.
4
Missed-Call Capture Pipeline
Trigger: Every dealership leaks revenue through unanswered phones: after close, over lunch, when the desk is slammed. Each missed service call is a booking that may land at a competitor by morning.
AI step: A voice AI answers naturally, around the clock. It does not pretend to be a person, and it does not quote prices or make commitments. It greets, listens, and gathers.
AI step: Name, number, what they need, when to call back. Structured and logged, not scribbled on a while-you-were-out pad.
Human checkpoint: Staff open a clean summary of every after-hours conversation and work the callbacks by priority. Nothing slips.
This one is not hypothetical. Dakota Intelligence runs it live today. Call 605-273-8300 after hours tonight and the voice that answers is this exact pipeline.
Quick quiz
Across all four pipelines, what does the gold ring always guard?
Module 4: The Management Close
About 15 minutesDecisions, not demos
A rollout that will not tip over
The failure mode is trying everything at once. The pattern that works is boring and sequential. Click each phase.
Weeks 1-2: Adopt a one-page AI policy (the green/yellow/red zones from today are its backbone) and pick one approved business-grade tool so "which AI do we use" has an answer.
Weeks 3-4: Pilot exactly one pipeline in one department with one owner. The lead follow-up or inspection write-up pipelines are the usual first winners: frequent, low-risk with the checkpoint in place, easy to measure.
Weeks 5-8: Measure honestly. Minutes saved, response times, work approved, staff grumbling or staff asking for more. Kill what is not working. Expansion earns its way in with numbers.
Quarter 2: Add the second and third pipelines, revisit the policy with what you learned, and decide what deserves budget. By now you know, instead of guessing.
Greenlight now vs. later
Greenlight now The AI policy. One approved tool. Staff using AI for green-zone drafting. One pipeline pilot with a named owner.
Soon, with planning Service reminder batches, missed-call capture, CRM AI feature audit. Real value, but they touch systems and deserve a scoped setup.
Not yet Anything customer-facing without a human checkpoint, anything touching F&I data, anything nobody owns. "The AI handles it" with no name attached is how pipelines rot.
The state will help pay for the next round
South Dakota's Department of Labor and Regulation runs an AI Adoption Workforce Funding program that can cover up to half the cost of qualifying AI training for businesses like Beck Motor. Today's session was kept simple on purpose, but a deeper follow-on round (department-level buildouts, pipeline implementation training) is exactly the kind of thing the program exists for. Completion certificates, like the one this session issues, are part of the paperwork the state asks for. Worth a conversation before the next application window closes.
Exercise: your first three
As a leadership group: which pipeline pilots first, who owns it, and what number tells you it worked?
Quick quiz
What is the right size for a first AI rollout?
Advanced Session Final Check
Answer all four, then submit. Pass with all four correct and all four modules complete to claim your certificate.
1. A pipeline is:
2. The human checkpoint in a customer-facing pipeline:
3. F&I and credit application data in AI pipelines:
4. The right first rollout is:
Claim your Certificate of Completion
Your Certificate
Review your name below, then choose Print / Save as PDF. In the print dialog, set the destination to "Save as PDF" for a copy you can keep on file.
Dakota Intelligence
Certificate of Completion
Beck Motor Company AI Training Day Advanced Session
This certifies that
Your Name
has completed the advanced onsite training covering
AI workflow pipelines, department-level AI practices, customer data safeguards, and AI rollout planning
for automotive dealership operations, delivered onsite in Pierre, South Dakota.
Date
Date of Completion
Timm Johnson
Dakota Intelligence, Mitchell SD
Powered by Dakota Intelligence · Automate South Dakota · dakota-intelligence.com
Verification ID
Bonus Reference Materials
Three take-home resources from the Dakota Intelligence library. They work on your phone anytime, long after today's session. Pick one below.
🤖
Dakota Intelligence
Mitchell, SD · Beck Motor Training Day
FAQ Reference
Business Owner AI Guide
Your questions, answered plainly.
No jargon, no hype. The questions South Dakota business owners actually ask about AI —
from "what even is this" to "how do I roll it out without something going wrong."
🧠 The Basics🔧 Implementation⚠ Risk & Compliance👁 Oversight & Control
🧠
The Basics
What AI actually is and how it works
Not quite. A search engine finds existing pages that match your words. AI — specifically the kind called a large language model — generates a new response by predicting what words should come next, based on patterns learned from billions of documents. It's less like looking something up and more like asking a very well-read assistant to compose an answer on the spot.
💡 That's also why AI can be confidently wrong. It's generating plausible-sounding text, not retrieving verified facts. Always check important outputs against a trusted source.
They're all AI assistants built on large language models, but from different companies with different philosophies. ChatGPT (OpenAI) is the most recognized name. Claude (Anthropic) is known for longer, more careful reasoning and stronger privacy defaults. Gemini (Google) is deeply integrated into Google Workspace. Copilot (Microsoft) is built into Microsoft 365 products. For most everyday business tasks, they're more similar than different — the bigger question is which one has the right data agreements for your use case.
For most small businesses, the honest answer right now is: it replaces tasks, not people. Drafting a first version of an email, summarizing a long document, generating a social media post, pulling together a report — those are tasks AI does well. The judgment calls, client relationships, and local knowledge that make your business yours are harder to automate. The businesses that struggle will be those that ignore AI entirely while competitors use it to move faster and do more with the same team size.
✓ Think of it as a very capable intern that never sleeps — useful for volume tasks, but still needs direction and review.
It depends entirely on the tool and the plan you're using. Free tools often do use your inputs to improve their models — that's part of how they're funded. Most paid business plans explicitly promise they do not train on your data, and that's written into their terms. This distinction matters enormously if you're working with client information, financial data, or anything sensitive. When in doubt, read the data policy or ask your vendor directly.
🔧
Implementation
How to actually bring AI into your business
Start with your biggest time drains. Think about the last week — what tasks took longer than they should have? Common starting points for South Dakota businesses: writing and editing (emails, proposals, job postings, social content), research and summarizing (reading through long documents, comparing options), and customer communication templates. Pick one task, try it for two weeks, and see how much time you save before adding more.
🌾 The best first AI project is the one you'll actually use — not the most impressive one on paper.
Two things kill AI adoption: no clear guidance on what to use it for, and no clear guidance on what not to use it for. Before rollout, give your team three things: a short list of approved use cases, a short list of things that should never go into AI (client PII, passwords, internal financials), and a simple way to ask questions when they're unsure. Staff who understand the guardrails feel more confident experimenting — not less.
✓ Designate one person as your internal "AI point of contact" — someone who tries things first and fields questions. It doesn't require a tech background, just curiosity.
For most small businesses, the entry point is $20–$30 per user per month for a quality paid plan with solid data protections. That's less than a tank of gas and buys you meaningful productivity gains if used consistently. Enterprise-grade implementations with custom integrations, API access, and compliance packages run higher — but the vast majority of Mitchell-area businesses don't need that level to start. Don't start with free tiers for business use — the data policy trade-offs aren't worth the savings.
For basic AI tools — no. Tools like Claude, ChatGPT Business, or Copilot 365 are designed for non-technical users and work right in the browser. You don't need to write code or hire an IT person to get started. Where you do start needing technical help is when you want to connect AI to your existing systems — your CRM, your scheduling software, your intake forms. That's where an implementation partner earns their keep.
⚠
Risk & Compliance
The things that can go wrong — and how to prevent them
Using free AI tools with real client, patient, or employee data — without knowing whether those tools are permitted to store or train on that data. It's happening constantly, often innocently, and it creates real legal exposure. The second biggest mistake is publishing AI-generated content without reviewing it — especially anything with specific facts, figures, dates, names, or legal/medical claims. AI makes things up. A human needs to catch it before it goes out.
Yes — intent doesn't change compliance obligations. If protected health information ends up in a tool without a signed Business Associate Agreement, that's a HIPAA violation regardless of how it happened. If AI generates content that infringes copyright or makes a false factual claim about a person, you're the publisher. Regulators and courts are still catching up to AI, but the underlying laws — HIPAA, FTC rules on advertising, employment law — already apply. "I didn't know the AI would do that" is not a defense that has held up well.
⚠ Review any AI output that will be seen by clients, posted publicly, or used in a legal or financial context before it goes out.
Without a signed data agreement in place, keep these out of any AI tool:
Client/patient identifying information — names, dates of birth, SSNs, addresses combined with other identifiers Employee records — performance reviews, salary information, disciplinary files Financial account details — account numbers, routing numbers, tax ID combinations Passwords or credentials — ever, under any circumstances Attorney-client or doctor-patient privileged communications
When you need AI help on a sensitive topic, anonymize first. "My client John Smith, born 4/12/1968" becomes "a client in their mid-50s." You still get useful output with zero exposure.
Almost certainly yes — and the answer isn't to ban it, because bans don't work and they push usage further underground. The answer is to get in front of it with a policy. A one-page "AI use at work" guideline — approved tools, approved use cases, what never goes in — is enough to dramatically reduce your risk and channel the energy productively. Staff who are already using AI are often your most efficient people. Give them a sanctioned path.
👁
Oversight & Control
How to stay in charge of what AI does in your business
The short answer: you verify anything that matters. AI is best used as a first draft engine, not a final authority. For content, check that specific facts, names, dates, and statistics are accurate before publishing. For research, confirm conclusions against a primary source. For anything legal, financial, or medical — treat AI output as a starting point for a professional to review, never the final word. The more specific and verifiable a claim, the more worth checking it is.
✓ Ask the AI to cite its sources or explain its reasoning — if it can't, that's a signal to verify independently.
A functional business AI policy doesn't need to be long. It needs to answer four questions:
1. Which tools are approved? (List 1–3 vetted options with signed agreements where required) 2. What can staff use AI for? (Drafting, research, summarizing, brainstorming — be specific to your business) 3. What can never go into AI? (Client PII, financial details, privileged info — see above) 4. Who do staff ask when they're unsure? (Name a person, not just a department)
One page. Review it annually. That's a real AI policy.
Technically yes — but in most regulated industries, a human must remain the decision-maker of record. Using AI to screen job applicants, for example, can create Fair Housing or EEOC exposure if the model reflects biased training data. Using AI to make credit or lending decisions triggers financial regulation. The general rule: AI can inform and assist decisions. The accountability for the decision stays with a person. Build your workflows with that separation clear.
Start with a simple inventory — ask your team what AI tools they're currently using, even informally. Most organizations are surprised by the answer. From there: limit official use to a short approved list, use business accounts rather than personal accounts so there's an admin layer, and build a brief check-in into your regular team meetings ("anything new you've been using AI for?"). Audit trail features in paid enterprise tools give you more formal visibility, but for most small businesses, a culture of transparency gets you 80% of the way there.
For a small to mid-size South Dakota business, a realistic timeline looks like this:
Week 1–2: Identify your highest-value use case. Pick one approved tool. Get it set up properly with a business account. Week 3–4: Run a small pilot with 1–2 staff on that specific use case. Gather feedback. Month 2: Write your one-page AI policy. Expand to the full team on that one use case. Month 3–6: Add a second use case. Evaluate ROI. Decide what comes next.
Six months in, you have something you can genuinely call a strategy — not because you planned it on a whiteboard, but because you built it from real experience.
🤖
Dakota Intelligence
Mitchell, SD · Beck Motor Training Day
Score: 0 / 6
Activity · AI Literacy
Can you spot the hallucination?
Both answers sound reasonable — but one is accurate, one is made up by AI. Click the answer you think is the hallucination.
Local historyAgricultureSmall business lawTechnologyHealthcareReal estate
0 of 6 answered0%
0/6
hallucinations correctly identified
🤖
Dakota Intelligence
Mitchell, SD · Beck Motor Training Day
⚠ Compliance Risk
AI Data Protection · What Nobody Tells You
The tools you've trusted for years just got a lot more complicated.
Word. Excel. QuickBooks. Google Docs. Every major productivity tool now has AI built in —
and most people don't realize what that means for their data. Two acronyms, BAA and DPA,
are what stand between your organization and a serious compliance violation.
Hover the numbered badges to see sources.
First, the vocabulary
BAA
Business Associate Agreement
A legal contract a vendor must sign before they're permitted to access, store, or process protected health information. Without one, your organization is the one in violation — not the software company.
Required under HIPAA
DPA
Data Processing Agreement
A contract specifying exactly what a vendor can do with personal data you give them — including whether they can use it to train AI models. Applies to any client, employee, or patient personally identifiable information.
Required under GDPR / state privacy laws
How it happens — a pattern playing out everywhere
⚠ Real-World Patterns — Happening Across South Dakota Right Now
Real-world AI vulnerabilities have real-world consequences for your customers and clients.
It usually starts with efficiency. Someone in the organization reaches for a familiar tool — Excel, QuickBooks, Google Docs, a free AI assistant — to solve a problem faster. It works. The software they've trusted for years now has an AI button built right in. They click it. That's the moment the exposure begins — not because anyone did something reckless, but because the tools people trust most have quietly changed what they do with your data.
Tools that now have AI built in — whether you opted in or not:
Microsoft Excel / Word / Outlook (Copilot)
Google Docs / Sheets / Gmail (Gemini)
QuickBooks (Intuit AI)
Adobe Acrobat (AI Assistant)Zoom (AI Companion)
None of these offer a BAA on free or personal-tier accounts. Most people never changed a single setting.
This pattern is showing up across every kind of South Dakota organization:
💊
Healthcare / Pharmacy
A pharmacy tech builds a controlled substance count log in Excel. They use the built-in Copilot AI to flag discrepancies and summarize monthly totals. Patient names and prescription details are now passing through Microsoft's AI layer — on a personal Microsoft account with no BAA.
PHI — HIPAA applies
⚖️
Law Firm / CPA Office
Staff uses ChatGPT Free to draft client letters, pasting in case summaries and financial details to get better output. No data processing agreement in place. QuickBooks AI features are used to categorize client invoices that include diagnosis codes.
Client PII / privileged data
🏫
School / Municipality
Administrator uses a free AI tool to summarize staff performance reviews or student records. The free tier has no retention controls or audit trail. Gemini in Google Workspace on a personal account is used to draft HR documents containing employee PII.
FERPA / employee records
What's actually at stake — 2026 HIPAA penalty schedule:
Fines from $145 to $73,011 per violation — even for violations you didn't know were happening (Tier 1)
Willful neglect that goes uncorrected: up to $2,190,294 per violation category per year
HIPAA breach notification — you must contact every affected individual
HHS Office for Civil Rights investigation — OCR enforcement timelines typically 12–24 months
Reputational damage — especially serious in a close-knit South Dakota community
Personal liability can extend to the individual who set up the tool
How the major AI tools compare
🔵
Google Gemini
Free / Workspace Personal
✗ No BAA
Trains on your dataYes (opt-out needed)
Data storageUnknown / varies
HIPAA useNot permitted
Safe for client PII?No
💬
ChatGPT / Copilot
Free / Consumer Plans
⚠ Enterprise Only
Trains on your dataYes on free; opt-out on paid
BAA availableEnterprise only
HIPAA useEnterprise tier only
Safe for client PII?Enterprise only
🧡
Claude
Pro / Business / Teams
✓ BAA Available
Trains on your dataNo — never on paid plans
BAA availableYes — Business & Teams
HIPAA useSupported w/ BAA
Safe for client PII?Yes (paid plans)
Organizations doing this right
✓ What a responsible AI policy looks like in practice
Forward-thinking organizations are building approved tool lists — a short, vetted set of AI tools staff are permitted to use with client data, each with a signed BAA or DPA on file. Staff still use AI. Productivity goes up. But there's a clear line between "approved for client work" and "general use only — no identifying information." That policy doesn't require a big IT department. It requires someone willing to ask the question and document the answer. In most small organizations, that's a one-afternoon project.
What to do if you think you already had an exposure
If you're sitting here thinking "I may have already done this" — you're not alone, and the fact that you're asking the question puts you ahead of most. Don't panic, but don't ignore it either. Here's what to do.
1
Stop the bleeding immediately
Stop using that tool with that data right now. If the platform has a conversation history or data retention setting — check it. Some tools allow you to delete session data. Do it. Document what happened, what data was involved, and when.
2
Know the 4-factor test before you do anything else
Under HIPAA, not every accidental exposure automatically becomes a reportable breach. There is a formal 4-factor risk assessment that determines whether notification is required:
What PHI was involved — type, sensitivity, volume
Who accessed it — authorized party vs. unknown third party
Was it actually viewed or acquired — or just briefly processed
How much risk was mitigated — was data deleted, session cleared
3
Call a professional — not Google
This is not a situation to self-diagnose. Contact your compliance officer, HIPAA privacy officer, or a healthcare attorney before deciding whether you have a reportable incident. Do not self-report without guidance — but also do not simply hope nobody noticed. The documentation you create right now either helps or hurts you later.
✓
Context matters — one slip is different from a pattern
A single accidental paste into a free AI tool carries very different risk than six months of staff doing it daily. HIPAA enforcement is largely complaint-driven and audit-triggered. Good-faith, isolated incidents that are promptly contained and documented are treated differently than systemic, ongoing neglect.
The honest bottom line:
"I didn't know the AI was reading it" is not a permanent defense — but it's also not an automatic catastrophe. What turns an honest mistake into a serious liability is doing nothing about it. The organizations that face the hardest enforcement outcomes are the ones that knew or should have known and took no action.
The quick gut-check
Before you paste anything into a free AI tool, ask:
🔍Would I be uncomfortable if this showed up in a newspaper? Names, dates of birth, diagnoses, case numbers, financial records — anything that identifies a real person should not go into a free AI tool without a signed agreement.
📄Is there a signed BAA or DPA on file? "They're a big company, they must be compliant" is not a legal defense. You need the paperwork.
🆓Is it free? Free AI tools are almost never BAA-eligible. The product is funded by learning from your inputs. Most users don't realize that trade-off has been made on their behalf.
✉When in doubt — anonymize. Replace real names with "Client A," strip dates of birth, remove identifying numbers. Full AI productivity, zero compliance risk.
Something to think about
?
How many AI tools are being used in your organization right now — and does anyone know which ones have a signed BAA?
Most organizations have 3–8 AI tools in active use that were never formally reviewed. A 30-minute inventory conversation can close that gap before it becomes a problem.
The new frontier: third-party AI layers — and why they demand even more scrutiny
The BAA conversation above covers the tools you already use. But there is a second wave coming — and it is already arriving in South Dakota. Vendors are now actively selling AI layers that sit on top of your existing systems — your EHR, your accounting platform, your ag management software — and promise to summarize, analyze, and automate. The pitch is compelling. The questions nobody is asking are the ones that matter most.
🏥
AI that listens to your patient visits
Ambient AI scribes and EHR summarizers are being sold aggressively to clinics, counseling practices, and rural health organizations. They record, transcribe, and analyze provider-patient conversations.
Ask before you sign: Where are those recordings stored? What country are the servers in? Is the vendor subject to foreign government data requests? Does the model train on your session data?
PHI + privileged communications
🌾
AI that holds your land and soil data
Precision ag platforms collect soil samples, yield maps, application records, and generational land data. That data is genuinely valuable — to commodity traders, competitors, insurers, and foreign interests.
A third-party AI layer that aggregates your soil chemistry, drainage patterns, and yield history across multiple seasons is building a proprietary asset from your land — and most data agreements give them broad rights to it.
Proprietary land + competitive data
🌐
AI built overseas, sold locally
Cost pressure is driving small businesses toward cheaper AI solutions. Many of those solutions are built by vendors headquartered outside the US, with servers in jurisdictions that have very different rules about government data access.
The reputational risk alone — if your clients learned their data was stored on servers subject to a foreign government's access laws — is significant in a conservative, trust-based community like Mitchell.
Data sovereignty + reputational risk
⚖️ The cost trap small businesses keep falling into
The conversation in most small businesses goes: "Option A is $200/month and has all the right protections. Option B is $40/month and seems to do the same thing." Option B wins because nobody in the room has the framework to evaluate what's missing. Onsite vs. cloud. US-based servers vs. offshore. Dedicated instance vs. shared model training. BAA-eligible vs. not. These are not technical questions — they are business risk questions. And the gap between Option A and Option B is rarely $160/month when you factor in what's actually at stake.
QUESTIONS TO ASK ANY AI VENDOR BEFORE YOU SIGN
→Where are your servers physically located — US, EU, or elsewhere?
→Does my data leave a dedicated instance or go into a shared model?
→Is my data used to train or fine-tune your AI model?
→Will you sign a BAA or DPA — and which specific services does it cover?
→What happens to my data if I cancel or the company is acquired?
→Who are your subcontractors — and are they subject to the same terms?
Censinet — Data Localization Laws and Geopolitical Risk (2026)Countries including China and Saudi Arabia have laws restricting cross-border transfers AND requiring government data access; geopolitical tensions increasing scrutiny of cross-border data flows