Build vs buy enterprise AI in 2026: a decision framework

Three categories matter. Buy means licensing a productised AI platform, typically SaaS, with feature parity across customers. Examples include Microsoft Copilot, Salesforce Einstein, ServiceNow Now Assist, Glean, Harvey, Luminance, Quantexa Decision Intelligence Platform. Build means commissioning a custom system from a consulting partner or in-house team, usually integrating one or more foundation models with proprietary data, workflows and policy logic. Configure sits between the two: licensing a platform and paying a partner to customise it heavily, which is operationally a hybrid.

McKinsey's 2024 state-of-AI survey found that 65% of organisations now use generative AI in at least one function, up from 33% the prior year, and that the median enterprise had deployed three to five distinct AI use cases [3]. The portfolio mix matters more than any single vendor choice.

Three patterns favour buying. The first is when the workload is generic across customers and the platform is ahead of the in-house build curve, for example knowledge search inside Microsoft 365 with Copilot or developer assistance with GitHub Copilot. The second is when the buyer needs feature velocity and the platform vendor is investing more than any in-house team can match. The third is when the regulatory or assurance work has been done by the platform vendor and inheriting that work is faster than recreating it.

The trade-offs are vendor lock-in, data-residency constraints, customisation limits and the share of value that accrues to the platform vendor rather than the buyer. IDC forecasts the worldwide AI software market to grow at 27% CAGR through 2028, with the platform tier capturing the majority of that growth [6].

Four patterns favour building. First, when the workload is specific to your business and the platform vendors do not have a fit, for example a contract triage system tuned to a particular legal team's clauses, or a recoveries automation system tuned to a specific Baltic or Nordic language and policy band. Second, when the data is sensitive enough that residency, sub-processor and audit constraints rule out a multi-tenant platform. Third, when the EU AI Act risk classification is high and the buyer wants to be the provider on the conformity assessment rather than rely on a platform vendor's. Fourth, when the workload is a competitive differentiator and outsourcing it to a platform that competitors also use is strategically wrong.

The trade-offs are time-to-value (a custom build typically lands in production three to nine months later than a platform pilot), engineering and run cost over time, and the dependency on a partner's continued availability. The Forrester Wave for Generative AI Services in Q4 2024 noted that fewer than 20% of enterprise GenAI engagements were running in production at scale [2], which is the gap a build partner has to be able to clear.

Productised platforms scope at the per-seat or per-call level, with pricing that scales with the user base and a tier jump from general productivity AI to specialist platforms (legal, financial crime, customer support) to enterprise-tier deals with custom data ingestion. Annual licence cost for a large deployment is dominated by seat count plus implementation.

Custom builds scope at the engagement level. A discovery and pilot phase runs over weeks. A production build with an EU AI Act conformity track runs over months. Run cost depends on volume, document throughput and inference choice rather than seat count.

The honest framing is that the cost of a single productised platform is usually lower than the cost of a single custom build, but the cost of a portfolio of platforms is often higher than the cost of a portfolio of builds, because platform pricing scales with seats while build run-cost scales with usage. We quote engagements after a discovery call.

It pulls some workloads towards build and some towards buy, in opposite directions. For high-risk systems under Annex III, the buyer wants control of the conformity assessment, the technical documentation and the post-market monitoring [5]. A custom build with a partner that signs the assessment is often the cleanest path. For general-productivity AI with limited risk classification, a platform vendor's compliance pack saves the buyer substantial work and is the rational choice.

The implication is that buyers should not run a single build-vs-buy decision across the portfolio. Each workload needs its own assessment, with the AI Act risk classification as an explicit input. The European Commission's AI Office is publishing successive guidance and that material is the canonical reference rather than vendor marketing pages [5].

Five questions, scored honestly, sort most workloads. Is the workload generic or specific to your business? Is the data sensitive enough to rule out multi-tenant hosting? Is the workload high-risk under Annex III? Is the workload a competitive differentiator? Is there a credible platform with a fit for the workload?

If the workload is generic, the data is not sensitive, the risk classification is limited, the workload is not differentiating, and a credible platform exists, buy. If the workload is specific, the data is sensitive, the risk classification is high, the workload is differentiating, or the platform fit is weak, build. Most workloads land in between, and the decision becomes a question of which trade-offs the buyer is willing to accept.

Impetora is an enterprise AI consultancy and solutions partner on the build side. We do not sell a productised platform. We design, build and deploy custom AI systems in five workloads (document processing, customer support automation, internal knowledge AI, decision support, process orchestration) for enterprises in regulated industries. That makes us the right fit for the build-side of a portfolio decision, particularly when the workload is specific, the data is sensitive, the AI Act classification is high, or the workload is a competitive differentiator.

For the buy-side of a portfolio, we routinely advise clients on platform selection without taking a fee from the platform vendor. The decision should be made on the workload, not on which side of the table the consultant sits.