Buy off-the-shelf AI or build your own? A build vs buy decision matrix for mid-sized companies

The question “buy or build” suggests two extremes: a subscription to an off-the-shelf tool, or a team of developers writing everything from scratch. In practice there are several intermediate steps between them, and most companies use two or three at the same time.

The table below lists these options from the simplest to the most demanding. The further down the table, the more control you have – but also the more work, cost and responsibility on your side.

The decision is easier when the management board answers the same questions for each process separately. You can score each question from 1 (clearly in favour of buying) to 5 (clearly in favour of building) and add up the results. The total is not a verdict, but it shows where opinions on the board differ.

The first two questions usually outweigh the rest. If the process does not set the company apart and works the same way as at your competitors, the other answers rarely change the result.

An off-the-shelf assistant wins where the work looks much the same in every company. Writing emails, summarising meetings, first drafts of documents and searching files are not tasks that win anyone a tender. The makers of these tools develop them for millions of users, so your own version will not catch up with them on features or price.

The same goes for AI built into systems you already use. If your CRM offers suggestions for salespeople, it is usually cheaper to switch them on and configure them than to build a separate tool that has to be connected to the CRM.

Buying is not enough in three situations. First, the process is the source of your competitive advantage and you do not want the vendor offering the same thing to your competitors. Second, the off-the-shelf tool has no access to the data everything depends on. Third, there is no product on the market that does what you need.

In a mid-sized company, building almost always means assembling a solution from existing components. You take an AI model from a major provider, connect it to company data and add your own rules. You do not train your own model – that is the domain of companies with enormous budgets for it.

Take a hypothetical machinery manufacturer with tens of thousands of pages of technical documentation and a history of service tickets. Its salespeople want to tell customers quickly which parts fit older models. A general-purpose assistant does not know this data, and there is no off-the-shelf product for this industry.

In this case, a solution based on searching the company’s documents makes sense – RAG, a technique in which the AI first finds the relevant passages in company documents before answering. It can often be built in Copilot Studio on data in SharePoint before you turn to a fully custom application.

Building only makes sense if someone will maintain the result. Models change, and providers regularly retire older versions – Anthropic announces such retirements at least 60 days in advance. When that happens, someone has to check that the solution still answers correctly.

The most common mistake is comparing costs for the first year only. A subscription then almost always wins, because it needs no upfront investment. But an AI solution runs in the company for several years, so you have to count that whole period.

A simple formula for buying: number of users × monthly price × 12 × 5 years. For building: build cost + annual maintenance × 5 + model usage cost + one major rebuild along the way. In both cases, add the time people spend on implementation and training.

An example shows where the bar sits. A company buys Microsoft 365 Copilot Business for 100 people at USD 21 a month. That is USD 25,200 a year, or about PLN 93,000 at an assumed exchange rate of PLN 3.70, and about PLN 466,000 over five years.

A general-purpose assistant of your own would therefore have to cost less than that to build and maintain for five years. On top of that, it would have to match a product that Microsoft improves every month. In practice this does not work, which is why buying is the safer option for general tasks.

It is different for a process that no product supports. There, you compare the cost of building not with a subscription, but with the cost of the current manual work and errors. Below is a list of items worth including.

You often hear that regulations force companies to run their own servers. That is not true. NIS2 – implemented in Poland by an amendment to the National Cybersecurity System Act (KSC Act) in force since 3 April 2026 – requires risk management, including supplier risk. DORA, the EU regulation on digital operational resilience in the financial sector, requires detailed contracts and oversight of IT service providers – but it does not ban the cloud.

The GDPR requires a data processing agreement (DPA) and knowing where data is processed. Major cloud providers offer processing in the European Union, which in most companies solves this problem without building their own infrastructure.

The AI Act cuts both ways. The obligation to tell people they are talking to AI applies from 2 August 2026, whether the system was bought or built. But when a company builds a high-risk system itself, such as one for screening job candidates, it becomes its provider. From 2 December 2027 it is then responsible for documentation, event logging and human oversight. When you buy a ready-made system, you pass some of these obligations to the vendor.

Vendor lock-in is real whichever option you choose, but it takes different forms. With a subscription, the vendor can raise the price or change the product. With your own solution, you depend on the company that built it and on the people who understand it.

Two simple tests help. First: will the management board accept that the process’s data and way of working stay with this vendor for five years? Second: how much time and money would it cost to move to another solution? If the answer is “six months of work”, the lock-in is significant.

You can reduce the risk through contract terms and good practice. Below is a list of things worth securing, whichever route you choose.

Most mid-sized companies end up with several layers at once. A typical set is an off-the-shelf assistant for everyone, AI features in the CRM for sales, automations in Power Automate and one custom solution where the company has unique data. This is not a compromise; it is the result of asking the same questions separately for each area.

Such a set needs one person who oversees the whole: they know which tools are running, who is responsible for them and what data goes into them. Without that person, after two years the company is paying for tools that overlap.

A sensible order usually looks like this: first, off-the-shelf tools, so people learn to work with AI and show where they lose the most time. Then building in one or two places where off-the-shelf tools were clearly not enough. This approach limits the risk of a large upfront investment.