Everyone is building AI. Should your business?

01 / Choose a task with an observable result.

“Adopt AI” is too broad to evaluate. “Prepare a draft response using the customer’s current service agreement” gives you a starting input, a source and an output to examine. Identify who reviews the draft and what would make it useful or unacceptable.

Run a small test with representative, permitted examples. Include missing information and conflicting records. Write down the acceptance criteria first: source accuracy, permitted access, response quality, review effort and cost per completed task. Compare each option on the same examples so a polished demonstration does not decide the purchase.

02 / Compare three paths.

Buy when an existing application fits the work and its controls are sufficient. Integrate when the missing piece is information moving between systems you already use. Build when the workflow, access rules or user experience needs substantial custom behavior.

These paths can coexist. A custom application may use a hosted model and an existing CRM. Building an application does not mean training a foundation model. Before fine-tuning, investigate whether better source material, retrieval, prompting or tool design addresses the actual failure. Keep the simplest option that meets the agreed requirements.

• Buy: assess fit, data handling and configuration limits
• Integrate: check APIs, record ownership and failure recovery
• Build: define custom behavior, evaluation and operational ownership

03 / Budget for the day after launch.

Someone must review failures, update permissions, maintain integrations and retest changes. Include that work when comparing an off-the-shelf subscription with a custom build. A low initial implementation cost can leave an expensive operating burden if ownership is unclear.

NIST’s secure-development guidance for generative AI addresses development and acquisition across the software lifecycle. Our practical interpretation is to name the people responsible for updates, incident handling and release evaluation before choosing the implementation path. Include an exit plan for replacing a vendor or model, and identify what information can be exported.

04 / Make the next decision smaller.

You do not need to commit to a company-wide platform to learn whether one workflow is worth improving. Define a bounded trial, who will use it, the evidence needed and a stopping condition. If the task is infrequent or the information is unreliable, improving the process first may be more useful.

Bring the current workflow, available tools and a few representative examples to a consultation. Technical teams can add architecture and evaluation requirements. A team new to AI can describe the recurring work and where it breaks. Both are enough to begin a focused discussion.