Build, buy or partner: how a large company sources its AI

In 2024, 67.23% of large EU enterprises that used artificial intelligence (AI) bought commercial software that was ready to use [1]. In the same year, 34.05% developed AI with their own staff, and 45.76% had AI developed or modified by external providers [1]. Large here means 250 or more employees. Enterprises could give more than one answer, and the large-enterprise shares add up to 219.57%, so many use more than one route.

This page sets out the three routes (buy, build, partner) with the official figures for each, the contract terms that protect a buyer, how to manage a vendor's risk, and one EU rule that can turn a buyer into a provider with a provider's duties. It is part of the guide on enterprise AI adoption.

How companies source AI

Eurostat, the statistics office of the European Union (EU), asks enterprises that use AI how they obtained it. The newest year with this question is 2024 [1].

How the AI was obtained	All EU enterprises using AI, 2024	Large EU enterprises using AI, 2024
Commercial software or systems, ready to use	57.92%	67.23%
Commercial software modified by own employees	25.92%	41.73%
Open-source software modified by own employees	26.98%	30.8%
Developed by own employees	21.78%	34.05%
Developed or modified by external providers	28.6%	45.76%

Open-source software is software whose code is published for anyone to use and change under a licence. The shares add up to more than 100% because firms could name several routes. Large firms report every route more often than the average for all enterprises. The external-provider share for large EU firms was 52.57% in 2021 [1], so it fell by 6.81 points to 2024.

In the United States (US), the Census Bureau's AI supplement, collected 17 November 2025 to 8 February 2026, gives lower figures. Among firms with 250 or more employees that used AI, 10.3% "Used vendors or consulting services to install or integrate AI", against 3.8% of all firms that used AI [2]. Among the same large firms, 6.8% hired staff trained in AI [2]. A note on the name: because of Executive Order 14434, signed on 29 September 2026, the Census Bureau now calls AI "Super Intelligence" or "SI" in its files [3][4]. Its questions asked about "Artificial Intelligence (AI)" until the collection that began on 19 October 2026, and this supplement closed on 8 February 2026, so this page says AI [4].

In Canada, among businesses with 100 or more employees that used AI, "32.8% hired employees with AI-related skills and 30.2% used external consultants or vendors" [5]. In the United Kingdom (UK), the Office for National Statistics (ONS) reports that "Using free-to-use software and purchase of external software are the most common ways industries adopt AI" [6].

What each route means

The table below is Reveneau's summary of the three routes. It is a view, built from the work each route involves, and the figures above say how often each is used.

Route	What it is	What the company owns	Main risk
Buy	Software with AI built in, used as the vendor supplies it	Its data and its settings	The tool does not fit the work, and the company depends on one vendor's terms and prices
Build	The company's own staff develop or adapt the system	The code, the tests and the data	Hiring and keeping staff with AI skills
Partner	An outside firm builds or adapts the system for the company	Whatever the contract assigns	Knowledge stays with the partner unless the contract transfers it

In Reveneau's view, buying fits common tasks that many companies share, such as writing help inside office software. Building and partnering fit work that depends on the company's own data, processes and older systems. Most of the first uses on the page choosing your first AI use cases can start as a purchase and move to a build when the company needs more control. For the general case outside AI, see custom software: build or buy.

What to put in the contract

A US government memo gives a public list of buyer protections for AI. The Office of Management and Budget (OMB) issued memo M-25-22, "Driving Efficient Acquisition of Artificial Intelligence in Government", on 3 April 2025 [7]. It binds only US executive agencies, and it does not apply to AI acquired as a component of a national security system [7]. Reveneau's view is that its terms work as a checklist for any large buyer.

The memo tells agencies that "they must pay careful attention to vendor sourcing, data portability, and long-term interoperability" [7]. Data portability means the buyer can take its data out in a usable form. Interoperability means the system can work with other systems. Both reduce lock-in: depending on one vendor so much that leaving costs more than staying.

M-25-22 names the contract terms that reduce lock-in: "requirements regarding knowledge transfer, clear data and model portability practices, clear licensing terms, and pricing transparency" [7]. It encourages agencies to use performance-based techniques, which set out the results the system must achieve and the measures used to check them before and after the contract is signed [7]. It also tells each agency to "Convene a cross-functional team" for AI purchases, and its examples of team members include experts in buying, IT, cybersecurity, privacy, budgeting, data and legal matters [7].

Contract term	What it protects	Source
Knowledge transfer	Staff can run and change the system after the vendor leaves	OMB M-25-22 [7]
Data and model portability	The company can move its data, and any model trained for it, to another vendor	OMB M-25-22 [7]
Clear licensing terms	The company knows what it may use, change and keep	OMB M-25-22 [7]
Pricing transparency	The company can see how prices are set and how they change	OMB M-25-22 [7]
Performance-based terms	The contract names the results the system must reach and how they are measured	OMB M-25-22 [7]

Status as of 26 October 2026: M-25-22 replaced memo M-24-18 and applies to contracts from solicitations issued 180 days or more after 3 April 2025 [7]. OMB's list of memoranda still shows M-25-22, with no later memo withdrawing it, through M-27-01 of 23 October 2026 [8]. A later memo, M-26-04 of 11 December 2025, adds "Unbiased AI Principles" for purchases of large language models [8].

Managing a vendor's risk

The US National Institute of Standards and Technology (NIST) AI Risk Management Framework treats vendors as part of the AI system's risk. It says "Third-party entities include providers, developers, vendors, and evaluators of data, algorithms, models, and/or systems and related services" [9]. Item MANAGE 3.1 asks that AI risks from third parties are "regularly monitored" [9]. Item GOVERN 6.1 asks for policies on AI risks that come from third parties, including the risk of infringing a third party's intellectual property [9].

In Reveneau's view, a large company can act on this in three ways. Keep a list of every AI vendor and what it supplies. Test each vendor's system on the company's own cases before release and after each vendor update. Read the vendor's terms on what it does with the company's data; the page on model provider terms and data use compares the main providers.

Public help with the choice is one policy idea. A report by the OECD (the Organisation for Economic Co-operation and Development), Boston Consulting Group and INSEAD suggests that "Governments could also provide guidelines or a framework to help small and medium-sized enterprises navigate the vendor selection process" [10].

When a buyer becomes a provider under the EU AI Act

The EU AI Act puts most duties for a high-risk system on its provider, the firm that develops it and puts it on the market. Article 25 says: "Any distributor, importer, deployer or other third-party shall be considered to be a provider of a high-risk AI system for the purposes of this Regulation and shall be subject to the obligations of the provider under Article 16" in three cases [11]. The deployer, the company using the system, becomes the provider if it puts its own name or trademark on a high-risk system, makes what the Act calls a "substantial modification" to it, or changes the purpose of an AI system so that it becomes high-risk [11].

This matters when a company buys a system and then adapts it, or asks a partner to adapt it. Regulation (EU) 2026/1744 rewrote Article 25(2): the first provider must cooperate with the new one, and that includes informing it about "known limitations and failure modes" [12]. In Reveneau's view, that duty belongs in the contract too.

A deployer that stays a deployer still has duties. Under Article 26, it must take measures to use a high-risk system according to the provider's instructions for use, and it must keep the logs the system creates, where they are under its control, "of at least six months" [11]. For Annex III high-risk systems these duties apply from 2 December 2027 [12]. The guide on the EU AI Act and your product covers the provider side.

Reveneau's view on the choice

Reveneau's view is that, whichever route it takes, a large company should own three things: the tests that define a good answer, the data the system uses, and the right to move both to another vendor. An eval suite is that set of tests: written, repeatable checks of the system's answers against cases the company chooses. A company that owns its eval suite can run a new vendor's system against the same cases before it switches. The guide on why AI evals matter explains how.

For choosing an outside firm, see an AI development partner for a large company. For the model where engineers work inside the customer's own teams and systems, see forward deployed engineering. For work that touches old systems, see connecting AI to older systems.

Reveneau is an AI software development consultancy with offices in San Francisco and Vancouver. Reveneau says AI writes all of its code and every change must pass an eval suite written from the specification. Reveneau says Jev, TypeSafe AI's decision model, grades that suite, and that the suite runs ten times faster than it did with its previous grader. Reveneau says it uses AI instead of hiring more engineers and puts that saving into clients' prices, and that it takes responsibility for the whole project through production and after release. To talk about a project, see Reveneau's services or contact Reveneau.