Build or buy is the first real decision in any AI initiative, and for a FINMA-regulated institution it is also the one with the longest shadow. The choice of custom AI vs off-the-shelf is usually presented as a cost question (license a SaaS product or commission a bespoke build), but in regulated finance the deciding factors are data sensitivity and auditability, not the sticker price. Get the decision right and the system survives an internal audit for years. Get it wrong and you inherit either a tool you cannot account for or a build you cannot maintain.
Five questions decide it, and they are worth answering in order. How sensitive is the data the workflow touches: client identities, NAV files, board papers? How unique is the workflow to your institution, or is it a commodity that every fund runs the same way? What is the scale: one report a quarter, or thousands of documents a month? What internal capability do you have to own what you choose? And how much time pressure are you under? Each answer pulls the decision toward one of three archetypes; the trap is letting a single answer, usually time pressure, override the rest.
The first archetype is buy off-the-shelf, and it fits more cases than vendors of bespoke work like to admit. For a commodity workflow on low-sensitivity data (calendar coordination, meeting summaries, internal knowledge search), a mature SaaS product is the right answer. You are not differentiated by how you schedule meetings, and building a custom tool for it is a vanity project. The one caveat that is non-negotiable in regulated finance: confirm where the data goes. A product that routes prompts through an endpoint outside your control turns an innocuous workflow into an outsourcing and data-residency question the moment it touches anything confidential.
The second archetype is buy and integrate: take a capable platform you already license and configure the workflow inside your own environment. This is the pragmatic middle for mid-complexity workflows: the calculation logic is yours, the document store is yours, but you are not writing a model from scratch. Most institutions already own more of this than they realise; the BI and data tools most Swiss finance teams already run, whichever vendor they come from, can carry a surprising amount of automation before a custom build is justified. The work here is integration and process design, not algorithm research, which is exactly where most of the value sits anyway. Regulated reporting usually lands here: at IST Investmentstiftung, the factsheet pipeline is custom-built inside the Power BI environment IST already licenses, so the calculation stays deterministic and auditable, the data stays in IST's own tenant, and the templates, logic and configuration belong to IST. An off-the-shelf reporting platform could not have carried it; a model built from scratch was never needed.
The third archetype is build custom, and it is rarer than the market implies. It earns its keep in exactly three situations: the data is too sensitive for any platform, even one you already license; the workflow is so specific to how your institution operates that no platform can carry it; or the capability is a competitive edge you do not want to rent, a case that is real but, for most regulated institutions, rarely the first move. Outside those three, a custom build from scratch is usually a cost you did not need to take on.
The decision tree, then, is not custom AI vs off-the-shelf as a matter of taste. Start from the workflow and its control points. If the data is low-sensitivity and the process is a commodity, buy. If the logic is yours but the engine need not be, buy and integrate. Only when sensitivity, specificity, and strategic value all point the same way should you build, and then build where compliance can audit it. The institutions that waste the most money are the ones that build commodities and buy their crown jewels. The discipline is knowing which workflow is which before the first contract is signed.