Usually neither in pure form. Most regulated businesses do best buying the layer that governs agents, with its bounds, certification and records, and building their own agents on it. The deciding factor is not who writes the code. It is whether you can see, test and change what each agent may do, because you answer for it either way.
What does "build" and "buy" really mean here?
There are three layers, and the build-or-buy choice can differ for each:
- The model. Almost nobody builds their own. You choose a provider or an open-weight model.
- The governing layer. Authority, bounds, certification, records, the held queue. This is infrastructure, and building it well is a large, ongoing effort.
- The agents themselves. Each one's brief, sources, connections and depth. This is knowledge of your own process.
A "bought agent" is often a vendor's governing layer plus a vendor's brief for a common job. A "built agent" is often your own brief on a model, with the governing layer improvised in code. The strongest combination tends to be the reverse of the weakest: bought infrastructure, your own process knowledge.
What decides the choice?
| Question | Points towards building | Points towards buying |
|---|---|---|
| Is the job specific to your process? | Yes: your policies, products, systems | No: a common job with standard rules |
| Can you build and maintain a governing layer? | You have a platform team ready for years of upkeep | You would rather own the agents than the plumbing |
| Can you see and change each agent's bounds? | You need full control | Only if the vendor exposes them |
| Will it be certified on your own cases? | You can run that | Only if the vendor supports it |
| Can you change model provider? | You control it | Check it is not tied to one provider |
| Who are you under the EU AI Act? | You may become the provider | You are likely a deployer with your own duties |
The last row deserves care. Buying does not hand over accountability. The deployer of an AI system has duties of its own, and the guide to the EU AI Act and third-party AI agents you buy explains which ones stay with you.
What can the business do itself, and what needs specialists?
Describing the job, choosing sources, setting escalation rules and judging outcomes are tasks for the people who run the process. They do not need engineers, which is the case made in whether non-technical teams can build AI agents. Connecting systems securely, managing credentials and maintaining the record need technical people, whichever route you choose.
What does the decision look like in practice?
Say a mid-sized bank wants agents for three jobs: answering card customers' balance questions, preparing suspicious activity case files, and reconciling nostro accounts.
A vendor offers a ready-made card support agent. It works well in demonstration, but its bounds are set by the vendor and it cannot be certified on the bank's own cases. The bank's platform team proposes building everything on a model directly, then estimates the work to build bounds, certification and records, and realises it is a product in itself.
The bank buys a governing layer that lets its own teams describe jobs and certifies each agent on its cases. The card support brief is written by the support team in an afternoon, then certified. The case file agent is built by financial crime analysts, because the job depends on internal typologies no vendor knows. Reconciliation waits until the ledger connections are ready. All three run under one set of bounds and one record. The method of building an agent from a plain-language job description is what made the business teams the builders.
Who answers for the result?
You do, in every case. A vendor answers for its product; your organisation answers for what your agents do to your customers and your books. That is why the test of any option is whether your named owner can see the agent's bounds, read its record, run its certification and stop it.
The wider sequence for each agent is in our guide to deploying an AI agent.
Where Pryme fits
Pryme is the governing layer. Attest certifies each agent on your own cases, and authority is enforced at the moment of action, per capability and per customer. Pre-Trained Agents cover common jobs, but they earn depth on your cases exactly as an agent your own team describes would.
Questions people ask
Is building cheaper over time?
Building the agents usually is. Building the governing layer rarely is, once you count upkeep, security, records and certification as models and regulations change.
Can we start by buying and move to building later?
Yes, if the briefs, sources, bounds and case sets are yours and exportable. Check that before you sign, not when you want to leave.
Do bought agents still need certification?
Yes. A vendor's results show how an agent performs in general. Your depth should rest on how it performs on your cases.