When a bank asks me whether it should build or buy its decisioning platform, I usually answer with a different question: What do you need to own to compete, and what should you never build yourself?

Answering starts with recognizing that decisioning isn’t one capability anymore. It’s three.

The platform is the governed environment that orchestrates data, models, and increasingly AI agents, executes decisions in real time, and connects to whatever core systems you run. The differentiation is your credit policy, your risk appetite, your data, and the models trained on it: the judgment that makes the bank yours. The learning loop is how outcomes feed back to sharpen those decisions over time: changes simulated before they go live, performance monitored after, and evidence of what worked. These are different problems, and they have different answers.

McKinsey has argued that banks can take next-generation credit models from concept to deployment in under six months, compared with the 12 to 24 months that had been typical, by building on their own data and business expertise. For a bank with €50 billion in assets, it put the prize at €100–200 million in additional annual profit. Look at where that value sits: in the models and the judgment behind them, not in the engine. I’ve rarely seen a bank win on the engine, and I’ve seen several quietly write off an in-house build that took three years to almost work.

So, the skill isn’t choosing to build or buy, but drawing the line in the right place. Own the judgment: your policy, your risk appetite, your data, and the models trained on it, including the right to take them with you. Buy the platform. Let it run the learning loop but make sure you own what the loop learns. And where you buy expertise, buy it in a form that builds your team’s own capability.

Then press hard on whoever sits on the buy side of that line. These are the questions I’d put to any decisioning vendor. I run applied intelligence at a decisioning platform company, so read them knowing my bias, and knowing I’ve kept in the ones that are hardest for firms like mine to answer. Ask them of my company too. Many of them also appear in IDC’s advice to technology buyers in its 2026 assessment of decision intelligence platforms (Provenir was among the vendors evaluated).

If the honest answer is a statement of work and a six-week queue for professional services, you haven’t bought a platform, you’ve rented a dependency. The reason to buy is to move faster than you could alone, so test it in the room. Ask them to change a live policy rule while you watch.

This is the question vendors least like being asked, which is exactly why you should ask it.

Find out where your rules, models, decision history, and the lessons learned from your outcomes actually live, and in what form they leave the building if you walk. Ask where it all runs, too: which cloud or data center, which jurisdiction, and what happens to your decisions on the vendor’s worst day. For EU banks, this isn’t optional. Under the Digital Operational Resilience Act, you already need a documented exit strategy for any ICT provider supporting a critical or important function. A vendor confident in its value doesn’t flinch at the exit question.

Ask whether logging, versioning, explainability, and human override are built into the platform, or bolted on the day an examiner asks why a customer was declined. Ask whether your model risk team can validate every model in the flow, including the ones the vendor supplied. The pressure is coming from every direction.

Under the EU AI Act, credit scoring is a high-risk use; the Digital Omnibus pushed the deadline to December 2027 but didn’t remove it, and the Fundamental Rights Impact Assessment sits with you, the deployer, even when the model came from a vendor. In the US, adverse action rules already require specific reasons for every decline, whatever model produced it. Governance you can’t reconstruct isn’t governance.

Nearly every vendor deck in 2026 has an agent on it. IDC found that most vendors expect agentic AI to be used for authoring, updating, or explaining decision logic, not for making the decision itself, and that regulated use cases keep the final decision deterministic. That’s the right instinct for a bank. Don’t ask whether the AI is autonomous. Ask whether every automated decision can be traced to the data, rule, and model version that produced it, then replayed, explained, and overridden. If it can’t, it doesn’t belong anywhere near your book.

Your advantage over the next five years will come from signals and models that aren’t in your stack today: cash-flow data, new bureau attributes, a sharper fraud model, whichever large language model you trust next year.

So, ask two things. How long does a new data integration take: weeks, or months? And can you bring any model into the decision flow, whether your own data scientists built it, a third party did, or it comes from a provider you haven’t chosen yet, under the same governance and without re-platforming? A platform that only works well with its own models and its own data partners is a ceiling, not a foundation.

A platform makes you more capable of doing your own work. A project makes you dependent on someone else doing it for you. You’re almost certainly not starting from scratch, so start with the path: ask how you move off what you run today, use case by use case, without a big-bang cutover. Then ask the vendor to name what your team will be able to do alone in year three that it can’t do today. A good partner can answer both.

Agree on the baseline and the KPIs before you sign, not after go-live: approval rates, loss rates, decision speed, and how quickly you can make changes. Ask to see a proposed change simulated against your own historical data before it goes live, with the shift in approval, referral, and decline rates in front of you. Then model the total cost as your volumes grow, not just the year-one license. A vendor that wants to be measured will help you set the bar. One that doesn’t will want to talk about features.

Gartner published its first Magic Quadrant for Decision Intelligence Platforms in January, and IDC followed with its MarketScape in September. When a category draws that kind of attention, the market is telling you this is infrastructure you buy and build on. But an analyst assessment tells you who the serious vendors are, not where your own line should sit. IDC’s lead analyst put the remaining question well: leaders need to consider “how much control the organization retains over decisions that carry regulatory or operational significance.” No analyst and no vendor can answer that for you.

So, here’s where I land. Stop treating build versus buy as a single switch. Decide deliberately which part of the decision layer you must own: your policy, your models, your data, what your decisions learn, and your exit. Then buy the platform that makes owning those things faster and more defensible and hold it to the seven questions above. Buy leverage, not dependency.

The banks that win the next decade won’t be the ones that built the most, or the ones that outsourced the most. They’ll be the ones that were clearest about the difference.

If you’re drawing that line right now, I’m happy to compare notes.

Written By