Why the AI Build vs Buy Debate Is Ultimately About Governance
Topic: Technology
Format: Article
Published Date: October 2026
AI for Leaders: Strategy to Action Programme
Companies adopting AI must decide which capabilities to build internally and which to source from external providers. The decision is not only about cost, speed, or technical capability. It also determines where critical expertise sits, who remains accountable for AI-driven decisions, and how much control the organisation retains over the technology it uses.
Artificial intelligence is forcing organisations to revisit one of management’s oldest questions: should they build technology themselves or buy it from someone else? For years, the answer largely depended on cost, speed, and technical capability. AI changes the underlying dynamics because organisations are deciding how much control they need over systems that increasingly shape business decisions.
Unlike traditional enterprise software, these systems require ongoing monitoring and adjustment as data changes, regulations tighten, and new risks emerge. The build-versus-buy decision, therefore, extends beyond implementation. It influences how organisations govern capabilities that are becoming central to their operations.
According to McKinsey’s State of AI 2025 global survey, 88 per cent of organisations now use AI in at least one business function, while 71 per cent report regular use of generative AI. Yet only about one-third have successfully scaled AI across multiple business functions, highlighting the challenge of translating adoption into enterprise-wide value. McKinsey’s State of AI Trust in 2026 finds that strategy, governance, and controls for increasingly autonomous AI systems continue to lag, with only around 30 per cent of organisations reaching higher levels of maturity in these areas.
Build When AI Becomes a Strategic Capability
Building AI internally makes sense when the capability itself is strategically important or when organisations operate in environments where control over AI is particularly demanding.
Netflix’s system of recommendations is one such example. It drives around 80 per cent of viewing activity and draws on years of experimentation and audience learning unique to the company. Recommendation algorithms are widely available, but the proprietary data and knowledge that make them effective remain a competitive advantage.
Building AI also creates long-term obligations. Organisations must maintain expertise, update models, document changes, and ensure systems remain reliable as technology, markets, and regulations evolve.
Buy Only When Governance Can Be Retained
For many organisations, buying AI turns out to be the better choice. Leading AI providers invest heavily in research, infrastructure, security, and model development. Reproducing those capabilities internally is prohibitively expensive for most firms and often unnecessary. The opportunity lies in selecting the right tools and integrating them effectively.
Klarna adopted external generative AI technologies rather than building its own foundational models. Its AI assistant now performs work equivalent to around 700 customer service agents while reducing costs and improving response times. Klarna created value by embedding external AI into its business processes rather than developing the underlying technology itself.
Morgan Stanley took a similar approach in a more sensitive setting. It deployed AI assistants powered by external large language models to support wealth advisers while maintaining internal controls and human oversight. Advisers remain responsible for recommendations, and sensitive information continues to operate within the firm’s governance framework.
The examples point to a broader distinction. Klarna did not need to own the underlying model because its advantage came from applying the technology to its customer service operations. Morgan Stanley, meanwhile, used external models in a sensitive domain while retaining responsibility for how the technology was deployed and used. In both cases, the organisation could focus its resources on the data, workflows, expertise, and controls that make the technology useful.
That distinction should shape how executives assess an AI vendor. Cost and technical performance matter, but organisations also need to consider what knowledge and expertise they will need to retain internally to use and govern the technology effectively.
Buying AI Does Not Transfer Governance
External providers may develop and maintain the technology, but organisations remain accountable for how those systems are deployed, monitored, and integrated into business decisions.
In 2023, Samsung restricted employee use of generative AI after confidential semiconductor information was uploaded to public AI tools. The incident exposed weaknesses in how employees were allowed to use an external technology.
Air Canada encountered a similar problem when its AI-powered chatbot provided customers with incorrect information about refund policies. The airline argued that the chatbot operated independently of its official communications. A tribunal rejected that defence and noted that the responsibility remained with the airline.
The two cases illustrate the limits of outsourcing. Organisations may purchase AI capabilities, but they remain responsible for the information those systems use and produce, the decisions they influence, and the risks they create. Organisations therefore need to know what data enters external systems, where critical expertise resides, how outputs are monitored, and when human judgement needs to override an AI system.
They should build when AI captures capabilities that are central to competitive advantage or regulatory responsibility. They should buy when external solutions meet their needs without weakening organisational control. Technology can be sourced from outside, but governance cannot.