Founders ask me “build or buy?” as if it is a branding choice. It is a capital and control choice. Buy undifferentiated plumbing; build only where your data or process is the product. Most mid-market teams over-build chat interfaces and under-invest in the workflow, data access and review gates that make any model useful.

Before anyone signs a statement of work or a multi-year platform deal, I ask a short set of questions. The answers usually make the decision obvious.

Is this differentiating? If a competent competitor could buy the same capability next quarter, prefer buy or configure. If the advantage sits in your proprietary data, regulated process, or client-specific judgement, a thinner custom layer on top of bought components may be justified.

What is the workflow map? Input, decision, output, owner, definition of good. If that page does not exist, you are not choosing architecture — you are shopping for demos. Map the human gate before you argue about models.

Where does data live, and what may leave? Build-versus-buy collapses quickly when client or financial data cannot sit in a vendor’s multi-tenant environment. Sometimes the answer is buy a vendor with strong isolation; sometimes it is keep inference inside your cloud with strict logging. Public playbooks such as CISA’s AI cybersecurity collaboration materials are useful prompts for threat and access discussions — not a substitute for your own risk assessment.

Time to a falsifiable release? A bought tool that can be in one team’s hands in weeks beats a twelve-month build that never ships. Conversely, a bought tool that cannot meet your control gates is not “fast” — it is a future incident. Define a thin release: one workflow, one metric, stop conditions.

Switching cost and evidence export. Ask how you leave. Can you export prompts, logs, embeddings and configurations? Will the vendor’s roadmap force a rewrite? Buy when lock-in is tolerable and documented; build when exit cost would threaten the business.

Total cost, not licence cost. Discovery, integration, review time, exception handling and change control belong on the same sheet as software. An AI budget that only lists licences is incomplete. CRM and workspace products (for example HubSpot for pipeline truth, Notion for SOPs) often appear in the “buy plumbing” column — evaluate them as operating scaffolding, not as AI magic.

A practical default for finance and professional-services founders: buy document extraction, retrieval, ticketing and CRM; configure carefully; build only thin orchestration and domain rules you must own. Revisit the decision when volume, regulation or proprietary data quality changes the economics.

When a vendor pushes a platform story, keep the conversation on your metric and your gates. Peers’ case studies are useful questions, not transferable ROI. Your staffing mix and control environment are not theirs.

A practical default for finance and professional-services founders

Buy document extraction, retrieval, ticketing and CRM; configure carefully; build only thin orchestration and domain rules you must own. Revisit the decision when volume, regulation or proprietary data quality changes the economics. When a vendor pushes a platform story, keep the conversation on your metric and your gates.

Peers’ case studies are useful questions, not transferable ROI. Your staffing mix and control environment are not theirs. Put review time and exception handling on the same cost sheet as licences, or you will fund a subscription that never reaches production.

Monday-morning checklist

  • Write the five-line workflow map before any build-vs-buy debate.
  • Classify data and decide what may leave company systems.
  • Prefer buy for undifferentiated plumbing; build only for true differentiation.
  • Demand export paths and a thin falsifiable first release.
  • Put review time and exception handling on the same cost sheet as licences.

Sources

Educational commentary from implementation work — not investment, legal or procurement advice. Verify contracts, security schedules and pricing yourself.

Keep the Monday checklist visible: owner, metric, exception path, data the tool may see, weekly review. Blank lines mean pause. Educational commentary only — not financial, tax, legal or investment advice.