Build or buy decisions do not get approved from a feature comparison. Approval comes from a memo: what is being decided, what it costs across three years, what would change the recommendation, and what happens if the build slips.
The governance platform memo below is written once, with our numbers filled in and every input sourced. Copy the structure, replace the assumptions with your own, and the arithmetic still works. Two existing pages answer the neighbouring questions: AI governance platform vs GRC tool covers category fit and the AI governance platform requirements checklist covers features.
Section one: the decision, stated in one sentence with its basis
Build or buy memos state the recommendation before the analysis, because a buried recommendation gets read backwards. Ours: buy, unless the annual subscription exceeds roughly $261,000, or your scope is genuinely one jurisdiction and a handful of systems.
Governance platform economics follow in three numbers. A build of the scope in section two costs about $972,000 across three years at US mean wages; buying the same capability still costs about $189,000 of internal work over the same period; the difference divided by three years is the price at which build or buy cost the same.
Section two: scope, or the ten capabilities that set the size of the build
Governance platform scope is the part of the memo that gets skipped and then blows up the estimate. The list below is minimum viable against obligations already in force or dated, drawn from the EU AI Act’s documentation and logging articles and from the US state patchwork.
| Capability | Obligation it answers | Build estimate, engineer-months |
| System inventory, ownership, risk classification | Knowing which rules apply to which system | 2.5 |
| Evidence store with retention clocks and exports | Article 18, ten years of documentation availability | 3.0 |
| Obligation to control mapping | One artefact answering several regimes | 3.0 |
| Approval and sign-off workflows | Human oversight and deployment records | 2.0 |
| Model and version registry | Tying each finding to the version it describes | 2.0 |
| Log ingestion, retention and query | Article 19, at least six months of logs | 2.5 |
| Incident reporting with statutory clocks | Serious incident deadlines measured in days | 1.5 |
| Report and pack generation | Annex IV packs, published summaries, board reporting | 2.5 |
| Access control, audit trail, single sign-on | Records that cannot be edited silently | 1.5 |
| Regulatory change monitoring | Amendments reaching the systems they affect | 3.0 |
Twenty-three and a half engineer-months is the governance platform total, and it is ours rather than an industry figure. State it as an assumption in your own memo, because it is the number a sceptical reader will attack first.
Section three: cost inputs, each with its source and its weakness
Cost inputs rest on wage data, and the label matters. The Bureau of Labor Statistics table for May 2025 gives software developers a mean annual wage of $148,100 across 1,687,890 jobs, with a median hourly wage of $65.38, which annualises near $136,000. Compliance officers show a mean annual wage of $88,400 and a median hourly wage of $38.81.
A governance platform is staffed at employer cost, which is higher than wage. BLS Employer Costs for Employee Compensation for June 2026, released on 9 September 2026, puts private industry compensation at $46.89 per hour worked, of which wages and salaries are $32.82, or 70.0%. Dividing by 0.70 gives about $211,600 per engineer-year and $126,300 per compliance specialist-year.
Two governance platform inputs carry weaknesses that belong in the memo rather than a footnote. The 70.0% share is an economy-wide private industry average, not a technology-sector figure, and mean wages sit above medians in software, so a median-based model runs about 8% cheaper across the board. Both are shown in section six.
Three lines complete the governance platform build side. Engineering: 23.5 engineer-months at $211,600, plus 15% for design and project management, is about $476,500. Compliance: half a specialist in year one and a third thereafter, or $63,100 then $44,200. Infrastructure: $18,000 a year for storage, archive tiers and monitoring, which scales with log volume rather than headcount.
Maintenance is the governance platform line that decides the answer. We apply 35% of the original engineering effort per year, about $145,000, which gives $557,600 in year one and $207,200 in each of years two and three, for roughly $972,000 across three years.
Section four: what buying still costs, because a zero there is a tell
A bought governance platform still carries internal cost, and that is where weak memos lose credibility. Configuration, identity and ticketing integration, data migration and evidence mapping run about three engineer-months in year one and one a year afterwards, with 30% of a compliance specialist in year one and 25% later.
Buying therefore costs $90,800 in year one and $49,200 a year after, or about $189,200 across three years, before the subscription itself. Any build or buy comparison showing the bought option at zero internal cost has not been tested against a real implementation.
Section five: the break-even subscription, undiscounted and discounted
Subtraction and division give the headline price. ($972,000 minus $189,200) over three years is about $261,000 a year, the subscription price at which building and buying cost the same.
Governance platform spending patterns move the discounted figure against intuition. At an 8% cost of capital, the build’s three-year present value is about $927,100 and the bought option’s internal work about $178,500, and the break-even subscription rises to roughly $269,000, because build spending is concentrated in year one while subscription spending is spread.
Build or buy differs structurally in two ways worth stating beside the number. Subscription spending is operating expense that can be stopped; build spending is largely salaries that cannot be recovered if the project is cancelled at month nine. And the build delivers nothing until it ships, against obligations whose dates are already fixed.
Section six: the four scenarios that move the break-even
| Scenario | Three-year build | Internal cost if buying | Break-even subscription |
| Base case, mean wages, 23.5 engineer-months | $972,000 | $189,000 | $261,000 |
| Median-wage variant of the same scope | $896,000 | $173,000 | $241,000 |
| Lean build, one jurisdiction, 12 engineer-months | $500,000 | $107,000 | $131,000 |
| Enterprise, 36 engineer-months, heavier operations | $1,673,000 | $361,000 | $438,000 |
| Engineering at a $60,000 market wage | $442,000 | $87,000 | $118,000 |
Row three is where the comparison genuinely balances. One jurisdiction, few systems, no third-party audit exposure and an existing document platform put break-even near $131,000, which is a price range where the comparison is real rather than rhetorical.
Build or buy stops being close in row four. Scope grows with jurisdictions rather than with headcount, so a portfolio spanning the EU, three US states and an ISO/IEC 42001 certification pushes a build past $1.6 million while subscription prices rarely scale in proportion.
Section seven: the maintenance driver, counted two ways
Governance platform maintenance assumptions need external evidence, and the two published counts of legislative volume disagree in a way worth quoting rather than hiding. The MultiState tracker, last updated in March 2026, reports 1,208 state AI bills introduced in 2025 with 145 enacted, and 1,561 introduced across 45 states by March 2026.
The National Conference of State Legislatures counts differently. Its 2025 summary, dated 10 July 2025, records all 50 states plus Puerto Rico, the Virgin Islands and Washington DC introducing AI legislation, with “thirty-eight states adopted or enacted around 100 measures this year”. Different cut-off dates and different definitions of a measure explain most of the gap, and either series supports the same conclusion: the mapping changes every quarter.
Europe supplies the other half. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published on 24 July 2026. The amendment moved Annex III high-risk obligations to 2 December 2027 and Annex I obligations to 2 August 2028, so schedules, classifications and reporting packs written against the old dates had to be revised.
Section eight: the NLP module, scoped honestly
Change monitoring was three engineer-months in the scope table, and a governance platform memo should explain what those months buy. Clause segmentation comes first, because obligations live at the point or paragraph level rather than the article level, and a system that tracks articles misses the thing that changed.
Obligation extraction follows: duty holder, trigger, artefact and deadline, pulled from sentences written for lawyers rather than parsers. Mapping then links each obligation to the control and the record that discharges it, which is the relationship that lets one technical file answer the EU AI Act, ISO/IEC 42001 and a state statute at once.
Change detection is the part that does not survive a naive implementation. A consolidated text reissued after an amendment cannot be compared by string diff, because renumbering and recital churn swamp the real edits, so comparison runs on meaning: embed each provision, align old to new, and route low-similarity pairs to a human. Classification then pushes each confirmed change to the affected systems using the inventory as the target list.
First version, three months. Correct across jurisdictions for three years, considerably more, which is why the 35% maintenance rate is the conservative end of the range rather than padding.
Section nine: the costs that sit outside the table, and their direction
Four governance platform costs sit outside the table and favour buying. Delivery risk first: a build that slips two quarters leaves obligations in force and no system, which converts a budget question into a compliance question. Key-person risk second, because the engineer who modelled the retention clocks eventually resigns. Third, the assessment fees that land either way: the European Commission’s impact assessment priced third-party audit work at €1,000 to €2,000 a day, with notified body review of one product’s documentation at €3,000 to €7,500. Fourth, per-system compliance: the same assessment estimated €6,000 to €7,000 for an average high-risk AI system against an assumed €170,000 development cost, so a portfolio of twelve carries €72,000 to €84,000 of work no tooling removes.
Two omissions favour building. A build carries no renewal negotiation and no vendor lock-in, and a company that already runs a document platform, an identity provider and a workflow engine starts from a shorter scope than the table assumes.
Practitioner discussion tracks these two lists. In technology forums during the first half of 2026, the recurring argument for buying was budget shape rather than capability, with subscription approval easier to obtain than headcount, while the recurring argument for building was that language models have lowered the cost of middleware. The model above prices both claims: the first version is cheap, and the third year is not.
Section ten: the questions a vendor must answer before the memo is signed
Ask which of the ten governance platform capabilities ship configured, which are roadmap and which need professional services, then price the gaps at $211,600 per engineer-year and add them to the subscription line before any comparison.
Ask who maintains the obligation library and how quickly new statutes are reflected, with a service level in the contract. A vendor that leaves the mapping to the customer has sold a database and left the largest recurring line in this model on the buyer’s books.
Ask what leaves with you. Evidence carrying a ten-year availability obligation under Article 18 outlives most vendor relationships, so export format, schema documentation and extraction cost belong in the memo rather than in a renewal conversation.
Ask for the audit record: which artefacts an assessor requested during a real certification or regulator request, and how long each took to produce. Answers there are field evidence the cost model cannot supply.
Where Govern365 sits in this memo
Govern365.ai is the bought governance platform priced here, and the fair way to read it is against section two rather than against a feature grid. The platform ships the inventory, the obligation-to-control mapping, the evidence store with its retention clocks, the approval records and the regulatory change feed as one linked set, so the ten capabilities arrive configured rather than scheduled, and the AI system inventory is the spine the rest attaches to.
Two properties decide the three-year number. Each obligation maps to the artefact that proves it across the EU AI Act, ISO/IEC 42001 and the NIST AI Risk Management Framework, so one technical file serves several regulators instead of being rebuilt per regime. And the change feed is maintained centrally, which takes the $145,000 annual maintenance line out of the customer’s engineering budget, where the model shows it as the largest recurring cost of building.
Frequently Asked Questions
What does it cost to build an AI governance platform?
A governance platform build runs about $972,000 over three years at US mean wages for a 23.5 engineer-month scope: $557,600 in year one, then $207,200 a year. A median-wage version of the same model comes to about $896,000.
At what price does buying beat building?
Build or buy costs match at roughly $261,000 a year undiscounted, or $269,000 at an 8% cost of capital, after subtracting the internal work that buying still requires.
What internal cost does buying carry?
A bought governance platform takes about three engineer-months and 30% of a compliance specialist in year one, then one engineer-month and 25% a year: $90,800 followed by $49,200 a year.
Why assume maintenance at 35% of build effort?
Because the driver is external. Trackers recorded 1,208 state AI bills introduced in 2025 with 145 enacted, or around 100 measures adopted by 38 states depending on the counting method, and the EU moved its high-risk dates in July 2026.
Is a mean wage the right input?
Mean wage is the employer’s average cost and is published directly. Medians run lower in software, so the memo shows both, and the median variant lowers the break-even to about $241,000.
What compliance costs are unavoidable either way?
Third-party audit days at €1,000 to €2,000, notified body documentation review at €3,000 to €7,500 where it applies, and €6,000 to €7,000 of compliance work per average high-risk system on the Commission’s estimates.
Which build module is underestimated most often?
Regulatory change monitoring, because it needs clause segmentation, obligation extraction, meaning-level comparison of amended texts and routing to affected systems, maintained per jurisdiction.
How long before a built platform is usable?
A governance platform of 23.5 engineer-months, staffed by two engineers, takes roughly a year of elapsed time, against obligations already in force and dates already fixed.
Does discounting favour build or buy?
Buying, marginally. Build spending concentrates in year one while subscription spending spreads, so an 8% discount rate raises the break-even subscription from about $261,000 to $269,000.
Can a general GRC tool cover this?
Partly. A general tool gives a governance platform its control libraries and evidence collection; model versioning, dataset lineage, log retention and AI-specific classification usually do not.
What retention rules drive the storage line?
Ten years of documentation availability under Article 18 of the EU AI Act, at least six months of logs under Article 19, four years under California’s automated-decision system regulations, and three years under the withdrawn Illinois notice proposal.
When is building the right answer?
One jurisdiction, a small portfolio, no third-party audit exposure and existing platform components, which puts break-even near $131,000 a year.
