Direct answer: do not treat an in-house AI team and an AI consulting firm as mutually exclusive choices. Keep problem definition, risk acceptance, process knowledge and outcome ownership inside the company. Use a partner when there is a material gap in speed, multidisciplinary expertise or production experience. For many organizations beginning serious AI work, the strongest model is co-build: internal leadership and governance, an external squad to accelerate delivery, and a contractual capability-transfer plan from day one.
Two shortcuts create most sourcing problems. The first is outsourcing everything for speed, then discovering that nobody inside the company can govern or evolve the system. The second is committing to build everything internally before the use-case portfolio is understood, creating fixed capacity for uncertain demand. AI requires experimentation and continuous operation. The sourcing model must fit both phases.
The MAKINAI Control–Capability Matrix
Place each initiative on two axes. Strategic control measures how much the capability differentiates the business, concentrates proprietary knowledge, affects customers or creates material risk. Capability gap measures the distance between what the organization can deliver today and what the initiative requires across speed, product, data, engineering, security, design and change. Their intersection produces four practical delivery models.
Quadrant 1 — High control, low gap: build in-house
Build internally when the capability is core to competitive advantage and the organization already has sufficient product, data, engineering, operational and leadership capacity. This often applies to systems that encode exclusive knowledge, influence critical decisions or need weekly evolution alongside the business. Vendors may still support assurance, workload spikes or specialist components, but architecture, backlog and operations remain under internal command.
Quadrant 2 — High control, high gap: co-build and transfer
This is the most common quadrant for new strategic capabilities. The company must retain control but cannot wait to recruit an entire team and does not yet possess every discipline. Form an internal nucleus with an executive sponsor, product owner, process owner, security, data and risk accountability. The partner adds architecture, engineering, design, evaluation and deployment. The contract should require documentation, pairing, accessible repositories, acceptance criteria and a measurable decline in dependency.
Quadrant 3 — Low control, high gap: partner-led delivery
When the capability does not differentiate the company but urgency or complexity is high, a partner can lead delivery. Examples include support automation, platform configuration, standardized integrations and proofs of value outside the core. The buyer still owns data, compliance, risk approval and outcomes. NIST advises organizations to apply governance approaches to third-party AI systems and data as they do to internal resources. Outsourcing delivery does not outsource accountability.
Quadrant 4 — Low control, low gap: configure or buy
If the problem is common and the organization can already operate it, avoid custom development by default. Configure a platform, integrate an existing product or use deterministic automation. A credible consulting partner should be willing to recommend less building. The question is not “who will develop the AI?” but “what is the minimum solution that produces the outcome at acceptable risk and cost?”
Five tests before choosing a model
- 1. Differentiation: Does the way the solution works create advantage or support a common activity?
- 2. Speed: What is the business cost of waiting to recruit and form the team?
- 3. Scarcity: Does the work require product, data, engineering, security, UX and change skills not currently available together?
- 4. Operations: Who will monitor quality, cost, incidents and evolution after launch?
- 5. Reversibility: Can code, data, evaluations, connectors and documentation be transferred or replaced?
Score each test from zero to two. High differentiation, operations and reversibility scores increase the need for internal control. High speed and scarcity scores increase the value of a partner. Do not collapse the results into one average. Use them to locate the initiative on the matrix: high control and high gap indicate co-build; low control and high gap suggest partner-led delivery; high control and low gap favor an in-house team.
What must remain internal in every model
The organization must own the business question, authority to accept risk, data inventory, backlog priorities, success criteria and the production decision. NIST organizes AI risk activities through Govern, Map, Measure and Manage. ISO/IEC 42001 similarly frames policies, objectives, processes and continual improvement as an organizational management system. A supplier can perform activities but should not replace client governance.
- Minimum internal ownership: executive sponsor; process owner; product owner; security and privacy approval; evaluation criteria; budget and unit economics; launch decision; supplier oversight; continuity plan.
What a partner should accelerate
A partner should reduce uncertainty and time to evidence, not merely sell technical hours. Look for the ability to frame use cases, design architecture, prepare data, create evaluations, integrate systems, test risk, deploy observability and enable teams. A consultancy that delivers only slides leaves the execution gap untouched. A development shop that codes without challenging the use case may accelerate the wrong solution.
How to structure a co-build that transfers capability
Split the engagement into three phases. In discovery, the partner leads methods and options while the client supplies context, constraints and value. During build, mixed squads share the same backlog, repositories and quality criteria. In transition, the internal team runs releases and incidents with declining external support. Define evidence of transfer: tested runbooks, recorded architecture decisions, reproducible evaluations and at least one operating cycle led by the client.
Tie payments to outcome and capability milestones, not just deliverables. Examples include critical test cases passed, verified cycle-time reduction, cost per task within a limit, simulated incidents resolved and internal staff able to operate the system. UK AI procurement guidance spans preparation, selection, evaluation, contract implementation and ongoing management—a useful reminder that procurement does not end when a provider is selected.
Red flags
- The partner requires inaccessible hosting, code or data without a clear reason; no internal product owner is named; “knowledge transfer” means a final presentation; the proposal excludes operations and monitoring; the initial price is low but every change becomes a new project; the entire team is outsourced with no accountable internal owners; the decision to build precedes problem validation.
Next step
Place your three priority use cases on the Control–Capability Matrix before issuing a competitive request. Use MAKINAI’s provider scorecard to compare firms: https://makinai.co/insights/en/how-to-choose-ai-implementation-company-brazil-scorecard. Structure requirements and transfer with https://makinai.co/insights/en/how-to-write-rfp-ai-services. If you need to define the portfolio and design a hybrid delivery model, see MAKINAI’s AI strategy and transformation consulting service: https://makinai.co/services/en/ai-strategy-transformation-consulting.