Build vs Buy: Enterprise AI Platform Decision Guide

Short answer: Buy when the need is common and the vendor's product already does it. Build when the capability is core to your business or your data and compliance rules leave no choice. For most enterprises the answer is a hybrid: buy the commodity layers, build the thin layer that is truly yours, and keep an exit route.

As of 26 October 2026, prices and product names below were checked against official vendor pages listed in Sources. They change often, so treat them as examples, not quotes.

Three options, not two

"Build or buy" hides a middle path. Think of three choices.

• Buy: a finished product or SaaS feature, such as an AI assistant inside tools you already use. You configure it. You do not own the model, the pipeline or the roadmap.
• Compose: you assemble managed parts from a cloud platform: hosted models, a managed retrieval service, agent hosting. You write the application logic.
• Build: you run more of the stack yourself, for example open-weight models on your own infrastructure, your own retrieval, your own evaluation and monitoring.

Microsoft's own Foundry documentation shows the same spectrum inside one product. Its "prompt agent" path is declarative: Microsoft hosts and runs the agent with no application code or containers to maintain. Its "hosted agent" path runs your own code in a container with a managed endpoint. The more you write, the more you control and the more you own.

What total cost of ownership really includes

The licence or token price is only one line. Count all of these over three years.

• Acquisition: subscription fees, per-user licences, or per-call usage charges.
• Integration: connecting to identity, data sources, ticketing and document systems. This is often the biggest line for both buy and build.
• Data work: cleaning, labelling, permissions mapping and keeping content current.
• Engineering and operations: developers, platform engineers, on-call time, upgrades and security patches.
• Infrastructure: compute, storage, search indexes, networking, and GPU capacity if you host models.
• Evaluation and monitoring: test sets, quality checks, logging, cost tracking and incident review.
• Governance: security review, legal review, audits, and vendor management.
• Change cost: model retirements and vendor changes force rework. Budget for at least one migration.

Build shifts spending from fees to people and infrastructure. Buy shifts it from people to fees. Neither is free.

Real pricing examples, with limits

Public prices show how vendors charge. They do not show what your total will be. Here are three verified examples from official pages.

Per-user licence. Microsoft's pricing page lists Microsoft 365 Copilot at $30.00 per user per month, paid yearly, as an add-on. A separate licence for a qualifying Microsoft 365 plan is required. Microsoft notes that prices can differ by currency, country and region, and that the actual price shows at checkout.

Usage-based agents. Salesforce's Agentforce pricing page lists Flex Credits at $500 per 100,000 credits. Each agent action uses 20 credits, which the page puts at about $0.10 per action. It also lists $2 per conversation, and per-user add-ons from $125 per user per month for core clouds. The page says the information is subject to change.

Per-token model access. Amazon Bedrock's pricing page lists on-demand pricing per token, with batch inference at 50% less for selected models, and Provisioned Throughput billed per hour per model unit, with optional one- and six-month commitments. As one example of a per-token rate, it lists Mistral Large 3 at $0.50 per million input tokens and $1.50 per million output tokens (US East). Fine-tuned models add training charges and monthly storage per custom model.

Buying often means a per-seat or per-outcome fee that grows with adoption. Composing means a per-token or per-hour fee that grows with usage. Neither includes your integration and people costs. Run the sums with your own forecast.

Team and skills

Be honest about who you have.

• Buy needs a product owner, an administrator, and a security reviewer.
• Compose adds application developers who can build retrieval, tool calls and permission checks, plus someone who owns cost and quality.
• Build adds platform and machine-learning engineers, people to run GPUs or inference servers, and an evaluation practice. These are scarce skills. If you cannot hire or keep them, building is a risk, not a plan.

A useful test: if the engineers who built it left tomorrow, could you still run it?

Time to value

Buying is usually the fastest route to a first result, because the product exists. Composing is next, because the platform parts exist. Building is slowest, because you must create the parts and prove they work.

Speed has a trade. A fast start on a rigid product can stall when it cannot fit your process. A slow custom build can miss the window the business needs. Set a date for the first useful release, then pick the option that can meet it with acceptable risk. No fixed "months and millions" figure applies to every project, so distrust any that you see.

Data control and compliance

Ask where data goes, who can see it, and who is answerable.

• Where does data travel? Find out what leaves your environment, where it is processed, whether it is stored, and whether it is used to train models. Get the answers in the contract.
• Who is accountable? Under India's Digital Personal Data Protection Act 2023, section 8(1) makes the data fiduciary responsible for compliance for processing done by it or on its behalf by a data processor. Section 8(2) allows a processor to be engaged only under a valid contract. Buying does not move the responsibility.
• What is the AI rule timeline? The European Commission's page lists high-risk rules for Annex III use cases applying from 2 December 2027 and for AI in regulated products from 2 August 2028, after the AI Omnibus entered into force on 27 July 2026. If you serve EU users or sell into the EU, check which category your use case falls in.
• Residency. Some platforms let you choose where training and inference run. Microsoft Foundry, for example, offers Standard training that stays in your resource's region and Global training that does not provide data residency.

Build gives the most direct control, but you then carry the evidence yourself: access logs, retention, testing and audit trails.

Lock-in and exit

Lock-in is not only about contracts. It is about everything that is expensive to move.

• Models retire. OpenAI's deprecations page lists the GPT-4o models and GPT-4.1 for retirement on 14 January 2027, and says fine-tuned versions follow the same schedule. On Amazon Bedrock, a model removed after its end-of-life date fails all requests, and migration does not happen automatically.
• Customisation is tied to a model. AWS says that once a model is Legacy, you cannot create new fine-tuning jobs on it. Training investment does not move to a new base model for free.
• Platforms rename. Azure AI Foundry is now Microsoft Foundry. Google renamed Vertex AI to Gemini Enterprise Agent Platform on 22 April 2026. Renames are usually manageable, but they show how fast the ground moves.

Ways to keep an exit open:

1. Keep prompts, test sets and evaluation results in your own repository.
2. Put a thin interface of your own between the application and the model provider.
3. Store your documents and embeddings in a system you control.
4. Ask for data export and deletion terms before you sign.
5. Test a second model on your evaluation set once a year.

Scoring table

Score each option from 1 (poor) to 5 (strong) for your situation, multiply by the weight, and add up. The weights below are examples. Change them to match your priorities.

How to use it:

1. Score with the people who will run and use the system, not only the sponsors.
2. Score per use case. A support assistant and a core product feature will differ.
3. If two options are close, pilot both on the same test set.
4. Do not let one weak score hide. A 1 on data control may rule an option out.

When a hybrid wins

A hybrid is the right answer more often than a pure choice. It wins when:

• Some use cases are common and some are unique. Buy the common ones, build the unique ones.
• You need speed now but want control later. Start with a bought or composed option, with a thin layer of your own, and replace parts as you learn.
• Your data is split. Keep restricted data in systems you control and use vendors for the rest.
• You want negotiating power. Having a working alternative changes vendor talks.

A hybrid also has costs: more vendors, more contracts and more seams. Assign one owner and one evaluation suite across all of it.

FAQ

Is building always cheaper at high volume?

No. Per-call cost can fall at high volume, but people, infrastructure, evaluation and on-call time can outweigh the savings. Model it with your own volume forecast and a three-year view.

What is the middle option between build and buy?

Composing managed cloud parts, such as hosted models and managed retrieval, with your own application code. You control the logic and the data flow, and the provider runs the heavy infrastructure.

Does buying an AI product transfer compliance responsibility to the vendor?

Not by itself. Under India's DPDP Act, the data fiduciary stays responsible for processing done on its behalf by a processor, and must use a valid contract. Check the rules that apply in your own jurisdictions too.

How do I avoid lock-in?

Keep your prompts, test sets, documents and embeddings in your own systems, use a thin interface between your application and the model provider, and test an alternative model on a regular schedule.

Sources

1. Microsoft, Microsoft 365 Copilot plans and pricing for enterprise
2. Salesforce, Agentforce pricing
3. AWS, Amazon Bedrock pricing
4. AWS, Amazon Bedrock model lifecycle
5. Microsoft Learn, What is Microsoft Foundry?
6. Microsoft Learn, Fine-tuning in Microsoft Foundry (training types and data residency)
7. OpenAI, Deprecations
8. Google Cloud, Gemini Enterprise Agent Platform release notes
9. European Commission, AI Act regulatory framework and timeline
10. MeitY, Digital Personal Data Protection Act 2023 (section 8)