Blog

OSHA's New Playbook: What Dealerships Need to Know From This Year's National Safety Council’s Safety Congress

Zach Pucillo — Tue, 22 Sep 2026 16:51:41 GMT

Takeaways from OSHA's 2026 update at the National Safety Council Safety Congress & Expo — and what they mean for your dealership or repair shop.

Every fall, OSHA uses the National Safety Council's Safety Congress & Expo to lay out where the agency is headed next. This year, in Indianapolis, Assistant Secretary of Labor David Keeling — joined by NSC CEO Lorraine Martin — sketched out an OSHA that looks noticeably different from the one many dealership operators grew up with. Less "gotcha," more partnership. But make no mistake: the enforcement teeth are getting sharper too, especially for repeat offenders.

KPA Named a 2026 Remote Work Top Workplace, Plus 8 Culture Excellence Awards

Deidra Mogan — Mon, 21 Sep 2026 17:29:52 GMT

We’re proud to announce that KPA has been named a 2026 Remote Work Top Workplace by TopWorkplaces.com, in partnership with Energage. This feels like an award we really earned; there was no application to fill out and no way to buy our way onto the list. The entire result comes from the Energage Workplace Survey, completed by our own employees. Energage compares that data against companies of similar size across the country, and this year only 156 organizations in our size range made the cut nationally.

The FTC’s New Pricing FAQs Leave Dealers Little Room for Guesswork

Adam Crowell — Wed, 16 Sep 2026 23:37:48 GMT

KEY TAKEAWAYS

The FTC says the advertised price must be the price any consumer can walk in and pay, excluding only charges the government requires the consumer to pay.
Mandatory document fees and dealer-required add-ons must be included in the advertised price. Rebates and conditional discounts cannot be used to create a lower headline price that is unavailable to every consumer.
The actual price must be the most prominent price everywhere consumers encounter it. This includes on inventory pages, vehicle detail pages, third-party sites, social media, signs, phone calls, and text messages.
Dealers should act now. The FTC says price transparency is not a new requirement, offers no grace period, and continues to treat deceptive pricing as an enforcement priority.

Introducing Integration Hub: Secure API access to your compliance data, wherever you need it

KPA — Tue, 15 Sep 2026 20:27:02 GMT

Your team pulls incident reports, tracks open issues, and monitors risk trends inside Vera Suite every day, but the moment you need that same data in a company-wide dashboard, a leadership report, or another business system, you may have previously exported that data via spreadsheets. Not anymore.

KPA Advertising, Sales, and F&I Solution Adds Additional to Support California CARS Act Readiness and Stronger Compliance Nationwide

KPA — Mon, 14 Sep 2026 22:48:34 GMT

The California CARS Act added a stack of new requirements set to go live on Oct. 1, 2026: a two-year advertising archive, tighter rules on how complaints get logged and retained, a requirement that pricing show up in that very first response to a customer, and more. That's a lot for any California team to absorb, so we upgraded our Advertising, Sales, and F&I solution to give them a stronger foundation to build on.

Employers Should Expect Increased Immigration Enforcement

Rich VanTuinen — Mon, 14 Sep 2026 15:01:20 GMT

You may have seen U.S. Immigration and Customs Enforcement (ICE) with a greater presence at airports recently. That’s part of a broader enforcement push after Congress increased ICE funding through the Secure America Act. Here’s what employers should know.

Strengthen Your I-9 Process Now

Employers can reduce the risk of an ICE visit or I-9 compliance audit by tightening internal practices before an issue arises:

Run frequent Form I-9 self-audits
Train anyone who completes I-9s on current requirements
Consider consistent use of E-Verify

For self-audit guidance, see the DOJ’s self-audit resource.

Don’t Use Form I-9 as a Prescreening Tool

ICE has flagged increased misuse of Form I-9 as a prescreening tool. The form should only be completed for candidates who have accepted an offer and are ready to start.

Best practice: read the instructions for completing Form I-9 regularly, and walk new hires through them directly when they complete Section 1. The M-274 Employer Handbook covers most I-9 questions.

If ICE Contacts You, Act Immediately

A notice from ICE may request a Desk Audit or Full Audit Review. If so, I-9 forms must be ready for the agency within 3 calendar days.

Contact legal counsel as soon as you receive any notice from ICE.

Penalties and Related Changes

Civil penalties and fines for Form I-9 violations have increased. Separately, regulations on Temporary Protected Status and immigration visa processing continue to shift with ongoing court rulings, which can affect which identification documents are valid.

Colorado: New State-Specific I-9 Requirement

Effective June 3, 2026, Colorado’s HB 26-1283 adds new requirements for employers handling original identification documents during I-9 verification:

Original ID documents may be held temporarily, but only as long as needed to verify eligibility, up to a maximum of 10 hours
Employers must issue a written notice confirming the specific documents won’t be retained
The employee must sign an acknowledgment, and the notice must be kept on file

Other states may adopt similar rules. Employers operating in multiple states should watch for this pattern.

FAQ

What triggers an I-9 compliance audit from ICE?
ICE may issue a Desk Audit or Full Audit Review notice at any time. Once received, employers generally have 3 calendar days to produce I-9 forms for review.

Can Form I-9 be used to screen candidates before they’re hired?
No. Form I-9 should only be completed for candidates who have accepted an offer and are ready to start work, not as a prescreening step.

How long can an employer hold onto an employee’s original ID documents?
Under Colorado’s HB 26-1283, employers may hold an original identification document only as long as necessary to complete I-9 verification, up to a maximum of 10 hours.

What does Colorado’s new I-9 law require beyond federal rules?
Employers must give employees written notice that their original ID documents won’t be retained, and have the employee sign an acknowledgment. That notice must be kept on file.

What should an employer do if they receive a notice from ICE?
Contact legal counsel immediately and begin preparing I-9 forms for the requested audit.

Are other states expected to adopt similar I-9 requirements?
The article notes this is a pattern that may spread to other states, so employers operating in multiple states should watch for similar rules.

Before You Stockpile Motor Oil: The SPCC Compliance Risks Car Dealers Should Consider

Mike Tanguay — Wed, 09 Sep 2026 17:57:00 GMT

How geopolitical uncertainty and oil-supply concerns can turn an inventory decision into a compliance obligation

Geopolitical conflict, constrained shipping routes, sanctions, and volatile energy markets can create uncertainty throughout the petroleum supply chain. In August 2026, the U.S. Energy Information Administration reported that disruptions affecting major oil-transit routes had reduced global inventories and contributed to elevated oil prices. Faced with the possibility of higher costs or delayed deliveries, some car dealerships may consider purchasing and storing additional motor oil, lubricants, diesel fuel, or other petroleum products on-site.

Building additional inventory may seem like a reasonable business-continuity strategy. However, bringing extra 55-gallon drums, totes, or bulk tanks onto dealership property can change the facility’s regulatory status under the U.S. Environmental Protection Agency’s Spill Prevention, Control, and Countermeasure—or SPCC—rule.

Before a shipment arrives, dealers should determine whether the additional storage will trigger the need for an SPCC Plan, require an existing plan to be amended, or create new containment, inspection, training, and recordkeeping obligations.

Why 55-Gallon Containers Matter

The federal SPCC rule generally applies to a non-transportation-related facility when all of the following are true:

The facility stores, uses, transfers, or consumes oil;
A discharge from the facility could reasonably be expected to reach navigable waters of the United States or adjoining shorelines; and
The facility has more than 1,320 gallons of aggregate aboveground oil storage capacity.

For the 1,320-gallon calculation, containers with a storage capacity of 55 gallons or greater are counted. A 55-gallon drum therefore counts toward the threshold. Containers smaller than 55 gallons are generally excluded from this federal capacity calculation.

The calculation is based on each container’s shell or rated capacity, not the amount of oil currently in the container. A partially filled or temporarily empty 55-gallon drum may still count unless the container meets EPA’s definition of “permanently closed.” Temporary, seasonal, and standby storage can also count.

Consider a dealership with no other counted oil storage:

24 drums × 55 gallons = 1,320 gallons. This does not exceed the federal aboveground threshold.
25 drums × 55 gallons = 1,375 gallons. This exceeds the threshold.

Most dealerships, however, do not start at zero. New-oil tanks, used-oil tanks, waste-oil heaters and their storage tanks, diesel generator tanks, hydraulic-oil reservoirs, transmission fluid, gear oil, and other qualifying containers may already contribute to the facility’s total. Just a few additional drums or totes could push a dealership over the threshold.

The word capacity is critical. Dealers should not assume that keeping a drum half-full, rotating inventory quickly, or labeling the storage “temporary” keeps it out of the calculation.

An SPCC Plan May Be Required

Crossing 1,320 gallons does not automatically make every dealership subject to SPCC. The location-based discharge potential must also be evaluated. EPA’s analysis considers factors such as topography, drainage, and proximity to regulated waters or adjoining shorelines. Manmade barriers such as berms or buildings cannot be used to determine that a discharge is not reasonably possible.

When the rule applies, the owner or operator must prepare and implement a facility-specific SPCC Plan. The plan describes the dealership’s oil-storage inventory, container locations, transfer activities, spill pathways, preventive equipment, inspection practices, response procedures, personnel responsibilities, and countermeasures.

Existing SPCC Plans May Need to Be Amended

Dealerships that already have an SPCC Plan should not assume that new containers are automatically covered. Commissioning, moving, replacing, or changing oil-storage containers may materially affect the potential for a discharge and require a technical amendment.

Under 40 CFR 112.5, a required amendment must be prepared within six months of the change and implemented as soon as possible, but no later than six months after the amendment is prepared. Depending on the facility’s qualification status and the nature of the change, the amendment may require self-certification or Professional Engineer certification.

The better operational approach is to review the planned storage configuration before ordering or accepting the additional oil. This gives the dealership time to confirm capacity, select a compliant location, obtain correctly sized containment, update diagrams and procedures, and train affected employees before the containers are placed into service.

Secondary Containment Is More Than a Spill Pallet

Additional drums, totes, or tanks may require new or expanded secondary containment. For bulk oil-storage installations, containment generally must be capable of holding the entire capacity of the largest single container plus additional capacity for precipitation when exposed to rainfall.

For example, a containment system holding multiple 55-gallon drums generally must be sized for at least the largest drum—not the combined capacity of every drum—plus sufficient precipitation capacity when outdoors. A 275-gallon tote placed in that same area changes the design basis to the tote’s full capacity plus precipitation.

Dealers should also evaluate:

Whether containment material is compatible with the stored product;
Whether rainwater can accumulate and how it will be inspected and discharged;
Whether floor drains, storm drains, doorways, slopes, or traffic routes create spill pathways;
Whether delivery and oil-transfer areas have appropriate controls;
Whether drums and totes are protected from vehicle impact, weather, corrosion, and unauthorized access; and
Whether incompatible materials are stored separately.

Secondary containment must work in actual dealership conditions. A spill pallet that is cracked, overfilled with rainwater, blocked by inventory, or exposed to forklift damage may not provide the intended protection.

Inspections, Training, and Records Must Keep Pace

More oil storage means more equipment to manage. Covered facilities must use appropriate inspection and testing procedures for bulk storage containers and associated equipment, keep records, correct visible leaks and deterioration, and maintain the integrity of containment systems.

Oil-handling employees must be trained on spill-prevention equipment, discharge procedures, applicable rules, general facility operations, and the contents of the SPCC Plan. The facility must designate a person accountable for discharge prevention and conduct spill-prevention briefings for oil-handling personnel at least annually.

Dealers should also ensure that spill kits are correctly stocked and accessible, employees understand internal and external notification procedures, and contractors or delivery drivers follow site controls during transfers.

Seven Actions to Take Before Stockpiling Oil

Before increasing on-site oil inventory, dealership leaders should:

Inventory every oil container. Record the product, location, container type, and rated capacity of every container that may count—not just the proposed new drums.
Recalculate aggregate capacity. Include all applicable aboveground containers with capacities of 55 gallons or greater, whether full, partly full, empty but in service, temporary, or seasonal.
Evaluate discharge potential. Review site drainage, topography, nearby stormwater conveyances, and the potential pathway to regulated waters or adjoining shorelines.
Review the current SPCC Plan. Determine whether the new storage is already addressed or whether the inventory, facility diagram, spill scenarios, procedures, inspection program, or certification must be updated.
Install containment before delivery. Size and locate secondary containment for the actual containers and site conditions, including outdoor precipitation.
Update inspections, records, and training. Add new containers to inspection forms and train employees on storage, transfer, response, and reporting procedures.
Check other requirements. Confirm applicable state and local aboveground-storage, fire-code, stormwater, zoning, hazardous-material, and emergency-planning requirements. SPCC compliance does not replace these obligations.

Plan Before the Purchase Order

Oil stockpiling can protect dealership operations from short-term supply interruptions, but it can also create long-term compliance exposure if the storage decision is made without EHS review. The most important step is to assess the facility’s total rated storage capacity and spill potential before additional oil arrives.

KPA helps dealerships evaluate SPCC applicability, inventory oil-storage containers, prepare or update SPCC Plans, assess secondary containment, establish inspection programs, and train employees. A proactive review can help dealers strengthen supply-chain resilience without creating an avoidable environmental compliance gap.

Before adding drums, totes, or tanks, contact KPA to determine how the change may affect your dealership’s SPCC obligations.

—–

This article provides general information and is not legal advice. SPCC applicability is site-specific, and federal, state, and local requirements may apply.

Sources

U.S. Environmental Protection Agency, Spill Prevention, Control, and Countermeasure Compliance Factsheet (September 2025): https://www.epa.gov/system/files/documents/2025-11/spcc-compliance-factsheet_0.pdf
Electronic Code of Federal Regulations, 40 CFR Part 112: https://www.ecfr.gov/current/title-40/chapter-I/subchapter-D/part-112
U.S. EPA, Tier I Qualified Facility SPCC Plan Template: https://www.epa.gov/oil-spills-prevention-and-preparedness-regulations/tier-i-qualified-facility-spcc-plan-template
U.S. Energy Information Administration, Short-Term Energy Outlook (August 2026): https://www.eia.gov/outlooks/steo/

Your Dealership’s Biggest Data Risk May Be a Vendor You Forgot About

KPA — Wed, 09 Sep 2026 07:00:00 GMT

Your dealership probably knows its major technology vendors.

The DMS. The CRM. The website provider. The digital retailing platform.

The less obvious vendor relationships are often the easiest to overlook. For example, a marketing agency may still have system access, your service department may have adopted a new texting platform, an old API integration may remain connected, or an employee may be using an AI tool that was never formally reviewed or approved. Start with one question:

Do you know which outside companies can access your customer information today?

For dealerships subject to the Federal Trade Commission’s Safeguards Rule, that is not just an IT question. It is a compliance obligation.

The Safeguards Rule requires covered financial institutions to select service providers capable of protecting customer information, require appropriate safeguards by contract, and periodically reassess those providers based on risk.

That means vendor oversight cannot end when the contract is signed.

Approval Is the Beginning, Not the End

A vendor may have passed your security review three years ago, but that approval was based on the relationship at that point in time.

Since then, the vendor’s services, security practices and integrations may have changed. Your dealership’s use of the vendor’s services may have changed as well, including the information it shares and the access the vendor has to dealership systems.

That is why vendor oversight should continue after the initial review and contract. Not every vendor requires the same level of scrutiny, but those with access to more sensitive information or critical systems generally warrant closer attention.

Risk-based oversight starts with an accurate picture of who your vendors are—and that list may be longer than you think.

Your Vendor List May Be Longer Than You Think

Dealerships rely on a growing network of technology providers with varying levels of access to customer information and dealership systems. Not all those relationships go through a formal approval process. A department adopts a new application, a marketing company installs another tool, or an old vendor remains connected after being replaced.

Individually, these decisions may seem routine. Collectively, they create a basic problem:

You cannot protect customer information if you do not know who has access to it.

Under the Safeguards Rule, a service provider includes any person or company that receives, maintains, processes or has access to customer information while providing services to a covered financial institution.

Effective vendor oversight starts with knowing who your vendors are, then understanding what information they can access and how they have agreed to protect it.

The Contract Matters

A vendor telling you that it takes cybersecurity seriously is not the same as the vendor agreeing to protect your customer information.

The Safeguards Rule requires covered financial institutions to require service providers, by contract, to implement and maintain appropriate safeguards.

That makes the agreement itself part of the dealership’s security program.

Dealerships should understand what information a provider can access, how that information will be protected, whether other parties may receive it, what happens after a security incident and what happens to the information when the relationship ends.

A polished security webpage can support due diligence, but it cannot replace the contract.

Watch for the Vendor No One Approved

Another challenge is the vendor that never made it onto the approved list at all.

It has never been easier for an employee to introduce new technology into a dealership workflow.

An employee can create an account, upload a document, connect an application or enter a customer interaction into an AI tool in a matter of minutes. Just as quickly, dealership information may be sitting in another company’s environment.

The tool may be legitimate and useful, but before dealership or customer information is introduced, someone should understand where that information goes and how it will be used.

Is it retained, and if so, for how long?
Can the provider use it for other purposes?
Is the information shared with other service providers or third parties?
What security controls protect it?

This is where vendor management and employee behavior intersect.

Employees do not need to become cybersecurity experts. They do need to understand when a new tool should go through the dealership’s review process.

The goal is not to discourage employees from using useful technology. It is to make sure the privacy and security implications are evaluated before customer information is introduced into a new tool.

Offboarding Deserves the Same Attention as Onboarding

Dealerships can spend considerable effort bringing new technology online.

Removing it may receive far less attention.

When a vendor relationship ends, credentials, API connections, integrations, user accounts and stored information do not necessarily disappear with the contract.

Someone should be responsible for verifying that vendor access has been fully terminated.

The dealership should also understand what happens to information already in the vendor’s possession. Is it returned? Deleted? Retained? If retained, for how long and why?

Five Questions Worth Asking Now

Your dealership should be able to answer five questions:

Who can access our customer information?
Maintain an accurate inventory of vendors that receive, process, store or can access it.
What can each vendor access?
Understand what information is involved and whether that access is necessary.
Did we evaluate the risk before granting access?
Assess whether the provider can appropriately safeguard the information it handles.
Are we periodically reassessing the relationship?
Periodically reassess vendors based on their risk and continued ability to safeguard customer information.
What happens when we stop doing business with them?
Remove access and address customer information that remains in the vendor’s possession.

If your dealership cannot confidently answer those questions, the issue is not simply whether a vendor-management policy exists. It is whether the dealership has visibility into where its customer information is going and who can still access it.

Vendor oversight should reflect the environment you have today, not the one you documented years ago.

The vendor worth another look may not be the one you just approved. It may be the one no one remembers is still connected.

—-

Additional Resources:
Automobile Dealers and the FTC’s Safeguards Rule: Frequently Asked Questions and FTC Safeguards Rule: What Your Business Needs to Know.

Tax-Free Overtime: Are you Recording it Properly?

KPA — Tue, 01 Sep 2026 19:55:40 GMT

What does “Tax-Free Overtime” really mean?

The One Big Beautiful Bill Act (OBBBA) created a tax credit with a limit of up to $12,500 for an individual and $25,000 for a married couple filing jointly for “ qualified overtime pay .”

State-Level Compliance Isn’t Enough: Dealerships Must Look Beyond State Law

KPA — Tue, 01 Sep 2026 19:47:05 GMT

KEY TAKEAWAYS

Complying with state law does not automatically satisfy federal requirements. Dealerships must comply with every applicable law, regardless of which regulator enforces it.
When state and federal standards differ, dealerships should identify and follow the more stringent applicable requirement to reduce compliance risk.
Federal and local agencies increasingly influence dealership operations in areas ranging from pricing and advertising to privacy, workplace safety, and employment practices.
The FTC’s recent focus on pricing transparency illustrates how practices long accepted under state law can still draw federal scrutiny.
A proactive, multi-layered compliance strategy not only helps avoid penalties, but also builds customer trust, reduces operational risk, and prepares dealerships for changing regulatory expectations.