Software Engineering
Build vs Buy for AI: Choose Without Creating Strategic Debt
A matrix for choosing among internal development, AI SaaS, and hybrid integration based on differentiation, data, risk, and exit cost.

Decision supported
Make build-versus-buy decisions layer by layer. A company can buy a model or SaaS while building the orchestration, integration, business rules, and evaluation that carry differentiation. Compare time to value, TCO, data control, skills, supplier risk, and exit—not initial price alone.
Executive summary
- Decompose model, data, orchestration, controls, interface, and operations.
- Buy standard capability when security and reversibility are sufficient.
- Build layers encoding differentiation or a hard constraint.
- Test portability before signing.
Decompose the system before choosing
Assign strategic value, available products, risk, skills, interfaces, and exit needs to each layer rather than labelling the whole solution build or buy.
Compare TCO for build, buy, and hybrid
Model delivery, licence, tokens, integration, data, security, review, operations, change, scaling, support, and exit over several volume horizons.
Choose prompt, API, RAG, or fine-tuning deliberately
Use prompting for instruction, RAG for changing private knowledge with sources, fine-tuning for repeatable behaviour or format when justified, and model training only with a distinct evidence-based need.
Perform SaaS and model due diligence
- Data use and retention.
- Security and access.
- Quality and evaluation.
- SLA, support, and price change.
- Export, termination, and replacement.
Build realistic portability
Own prompts, evaluation sets, business rules, interfaces, and data exports. Avoid expensive abstraction across suppliers unless a measured risk justifies it.
Make the decision reviewable
Record assumptions and triggers such as volume, price, quality, regulation, capability, or supplier change that require a new review.
Decisions to make now
Recommended actions
- 01Map solution layers and strategic value.
- 02Price build, buy, and hybrid across volumes.
- 03Run data, security, SLA, and exit due diligence.
- 04Create a supplier-independent evaluation.
- 05Write review triggers.
Watch points
- Licence price compared without integration or exit.
- Multi-supplier abstraction without proven need.
- Data, prompts, logs, or evaluations that cannot be exported.
Frequently asked questions
Does building require training a model?
No. It may mean assembling an external model with your data, orchestration, controls, and interface.
Is SaaS always faster?
It often speeds the demo; real time also includes integration, controls, procurement, migration, and adoption.
How is lock-in measured?
Price the time, cost, and functional loss to export data, replace APIs, reproduce evaluation, and restore service elsewhere.
Sources and verification
Last editorial verification: 14 August 2026. Links point to the source texts, authorities, and reference guides consulted.
- 01Choose the right tools and technology
Government Digital Service, GOV.UK. Accessed 14 August 2026.
- 02Using commercial-off-the-shelf products and services
Government Digital Service, GOV.UK. Accessed 14 August 2026.
- 03Comparing Retrieval Augmented Generation and fine-tuning
AWS Prescriptive Guidance. Accessed 29 August 2026.
- 04AI RMF Core: Govern, Map, Measure and Manage
NIST AI Resource Center. Accessed 14 August 2026.
- 05FinOps for AI Overview
FinOps Foundation. Accessed 14 August 2026.
- 06The Adoption of Artificial Intelligence in Firms
OECD. Accessed 14 August 2026.
Related decisions
Continue with briefs that share the same operational, technical, or governance context.
Software Engineering
Monolith or Microservices? Why Business Context Matters More Than Architecture Fashion
Read the briefSoftware Engineering
How to Evaluate the Production Readiness of a Business Application
Read the briefSoftware Engineering
Building Secure Multi-Tenant SaaS Platforms for Algerian Businesses
Read the briefNext step
Identify the first workflow to automate.
We start with the real flow, its exceptions, and one business metric to define a measurable pilot.