Build, buy or partner

By late November, three vendors had written to Andre offering to solve Cascade Ridge's after-hours client questions. One sold a ready-made veterinary chat assistant that plugged into websites. One was an AWS Partner offering to build a custom assistant on Amazon Bedrock. And Kwame Asante, who had written the BookVet app, thought he could build it himself. Each option had a champion. Andre needed a way to compare them that the board would accept and that the losing champions would think was fair.

The exam guide asks you to evaluate build, buy or partner decisions for AI by considering factors including budget, timelines, capabilities, vendor proposals and regulatory compliance requirements. This lesson walks through the options, the factors and the decision Cascade Ridge reached for its planned client-support assistant.

Three options and the spectrum between them

In practice the options form a spectrum rather than three boxes. A finished product sits at the buy end. A managed AI service, such as Amazon Textract for document extraction or Amazon Transcribe for speech to text, is bought as a building block but assembled by your team. A foundation model reached through Amazon Bedrock, with your own prompts, knowledge base and guardrails, is mostly built, on top of components you buy. A custom model trained in Amazon SageMaker AI is the most fully built. A partner can help anywhere along the spectrum.

AWS offers routes for each part of the spectrum. AWS Marketplace lists third-party software, data products and models that can be bought and billed through an AWS account, which simplifies procurement and keeps spending visible in one bill. The AWS Partner Network includes consulting firms that specialize in AI work. And AWS's own services range from ready-made assistants, such as Amazon Quick for business users working with company data, to fully managed building blocks and the tools for custom models.

The five factors

Each factor in the exam guide asks a different question about the options:

• Budget. What does each option cost over its whole life, not just to start? Subscriptions look cheap in year one and accumulate. Building looks expensive up front but may be cheaper to run. Lesson 8 covers total cost of ownership.
• Timelines. When is the capability needed? A product can be live in weeks; a custom build may take months. If the business benefit depends on being ready before a peak season, time may outweigh cost.
• Capabilities. Does the organization have the skills to build, run and improve the solution, now and in three years? Capabilities include data engineering, prompt and evaluation work, security, and the people to watch it in production. A partner can fill a gap, ideally while teaching your team.
• Vendor proposals. What exactly is each vendor offering, and how well does it fit the requirements? Proposals must be compared on the same terms, with evidence rather than promises.
• Regulatory compliance requirements. Can each option meet the legal and policy obligations that apply to the data and the use? Where will data be stored and processed? Who can see it? Will it be used to train someone else's models?

Regulatory questions for AI sourcing

Hannah Weiss took the regulatory factor seriously, because client contact details and conversations about pets' health would flow through the assistant. She wrote her questions for every vendor in advance.

In Canada, private-sector personal information is protected by PIPEDA and, in Alberta and British Columbia, by each province's own Personal Information Protection Act. Cascade Ridge had committed to keeping client data in Canada. The federal Artificial Intelligence and Data Act, proposed in 2022, lapsed when Parliament was prorogued in January 2025, so there was no general federal AI statute; privacy law, consumer protection law and sector rules still applied, and Hannah expected targeted rules to follow. Her questions therefore focused on data location, consent, access, retention and how each vendor used customer data.

For the build and partner options built on Amazon Bedrock, Hannah could check several answers directly in AWS documentation: Amazon Bedrock does not use customer prompts and outputs to train the base models or share them with model providers, and data is stored in the Region where the service is used. She still recorded those answers and the date she checked them, since terms can change.

Comparing the options

Andre ran the same kind of weighted comparison he had used for prioritization, with criteria and weights agreed before the proposals were opened. Each option was scored from 1 to 5.

The scores told a clear story, but the discussion added nuance. The ready-made product was cheapest and fastest, and in a business with no data residency commitment it might have won. Here, it failed on the factor Hannah could not compromise on. Building in-house was attractive for control, but Kwame was the only developer and was already committed to the BookVet modernization; six months was optimistic. The partner option combined Bedrock's compliance position with a faster timeline, but its control score depended on the contract.

Making a partnership work

Andre recommended the partner option, with conditions written into the contract:

• Ownership. All prompts, knowledge base content, guardrail settings, evaluation sets and code belong to Cascade Ridge and live in Cascade Ridge's own AWS accounts from day one.
• Knowledge transfer. Kwame works alongside the partner's team, and the partner delivers documentation and a hand-over plan so Cascade Ridge can run the assistant itself after the pilot.
• Acceptance criteria. The partner is paid in stages, with the final payment tied to passing the evaluation set agreed in advance, including the requirement that every clinical or urgent question is handed to a person.
• Exit. Either side can end the engagement, and Cascade Ridge keeps everything needed to continue without the partner.

These conditions turned the partner option's weakest score, control, into something close to the build option's strength. A partnership designed to make the customer self-sufficient avoids the main risk of depending on outsiders.

Lock-in and switching costs

Lock-in is the situation where leaving a supplier is so costly that the customer stays even when better options appear. It comes from proprietary formats, data that cannot easily be exported, skills tied to one product, contracts with long commitments, and integrations built around one vendor's way of working. Some lock-in is the price of convenience and is acceptable. The strategist's job is to know where it is and to keep it in proportion to the benefit.

For generative AI, a useful protection is to keep the parts that hold your know-how separate from any one model. Cascade Ridge's approved documents, evaluation set, guardrail rules and hand-off design would work with a different foundation model if needed. Amazon Bedrock's choice of models from several providers makes such a switch possible without rebuilding everything, though, as lesson 3 noted, any switch still needs re-testing.

When each option tends to win

Reading vendor proposals

Vendor proposals are written to win, so they need careful reading. Andre asked every vendor to answer the same structured questions, so that their answers could be compared side by side rather than in each vendor's preferred format. He asked for evidence instead of claims: references from similar customers, results from a trial on Cascade Ridge's own sample data where possible, and independent audit reports for security and privacy. He also asked each vendor to state its total price over three years, including setup, usage, support and exit, because headline prices often leave out the items that grow.

A short paid trial can be worth more than a long proposal. For the client-support assistant, the partner agreed to build a small prototype answering twenty common questions from approved documents, tested against a handful of questions that had to be handed to a person. The prototype showed how the partner worked, how quickly it learned the group's requirements and how it handled the hand-off rule. That evidence fed directly into the capability fit score, and it gave Kwame a first look at what he would later have to run.

Whichever option wins, the decision should be recorded with its reasons, the scores, the evidence and the date. Circumstances change: a vendor may add the missing language, a new AWS service may make building easier, or Kwame's availability may change. A recorded decision can be revisited quickly when that happens, instead of being argued again from the beginning. Andre set a review date for the sourcing decision twelve months after the assistant's launch.