Research · AI Strategy & Adoption

Build vs. Buy

AI can be bought as a finished product, assembled from platforms and model APIs, or built and trained in-house. The right choice depends on how differentiating the capability is, the data involved and the skills you have.

The AI Sourcing Spectrum

Build versus buy is no longer a two-way choice. Most AI capabilities can be sourced at one of five depths, and most companies use several at once for different use cases. The AI Sourcing Spectrum is a CorpExcellence framework that places every option on a single scale where control and effort rise together. The rule of thumb: go only as deep as differentiation or data sensitivity requires.

Adopt and configure

Adopt means using the AI already built into tools you license, such as office suites or CRM systems. Configure means building agents on a vendor’s platform with its low-code tools. Both are fast and cheap to start, and they suit capabilities that look the same in every company, such as meeting summaries. The trade-off is that the vendor controls the roadmap and often the data terms, so review those terms before confidential data flows.

Compose

Compose means writing your own application on top of commercial model APIs, connected to your data and systems. This is where most differentiated enterprise work sits. You own the workflow, the prompts, the retrieval layer and the evaluation suite, while the model stays swappable. An AI gateway between your applications and the providers makes that swap practical and gives one place for logging and cost control.

Adapt and create

Adapt means fine-tuning a model or running an open-weight model on infrastructure you control. It suits high-volume tasks where a smaller tuned model is cheaper, or data that cannot leave your environment. In return you take on hosting and ongoing evaluation. Create, training a foundation model from scratch, is rarely justified outside companies whose product is the model. Revisit the choice when a new model generation changes the cost picture.

Questions that set the depth

• Does this capability set you apart, or is it the same for every company in your sector?
• Can the data leave your environment under the vendor’s terms?
• What will each depth cost at production volume, including people?
• How hard would it be to switch providers a year from now?

Buying AI? Most enterprise AI is bought, not built

Third-Party AI Risk sets out five sourcing patterns, from embedded AI features to model APIs and agent platforms, each with its own risks, diligence depth and contract terms.

Get the full report →

Where the industry is now

Two developments make the deeper options less risky. Open-weight models with permissive licenses are now credible for many tasks; OpenAI released its gpt-oss models under Apache 2.0 in August 2025. The Model Context Protocol, hosted since December 2025 by the Linux Foundation’s Agentic AI Foundation, gives agents a common way to connect to tools and data, which reduces lock-in at the integration layer. Contract terms still matter when you buy. US federal guidance (OMB M-25-22) requires agencies to bar vendors from using non-public agency data to train their commercial models without consent, a clause worth copying in any AI contract.

Common pitfalls

• Building what a vendor already sells well.
• Skipping a cost model at production volume.
• Hard-coding one provider into every application.
• Signing contracts without reviewing how the vendor uses your data.