Build vs Buy Is Dead. Who Owns the Model Is What Matters

Your SaaS vendor is training a model on your company's data right now. Not maliciously. It's in the terms of service you clicked through in 2023. And in twelve months that vendor will sell an "AI agent" back to you that does the job of three people on your team, using patterns learned from your own workflows. You didn't build it. You didn't buy it either. You funded it.

That's the part nobody in the build vs buy conversation wants to say out loud. I've watched CEOs in Jönköping and Stockholm spend hours in workshops drawing two columns on a whiteboard, cost of building internal tools versus cost of licensing a vendor platform, like it's still 2019 and the biggest risk is a late Jira ticket. That framework is dead. It died the moment AI stopped being a feature bolted onto software and became the thing that decides what the software is worth.

Build vs Buy Software Was Always the Wrong Question

Build vs buy software made sense when software was static. You wrote code once, it ran the same way for five years, and the decision was really about total cost of ownership and speed to market. Buy if you needed it fast and generic. Build if it was core to your differentiation. Simple. AI breaks that math completely. Software that learns from your data compounds in value the longer you run it and own it. Software you rent from a vendor compounds in value for the vendor, not you. Every ticket your support team resolves, every workflow your ops team refines, every dataset your product generates, all of it becomes training signal. If that signal lives inside a vendor's platform, you are paying rent AND handing over the raw material for the vendor's next product tier. Forbes ran a piece this week pointing out that AI is inverting the build-vs-buy playbook specifically in banking, an industry that has spent thirty years assuming "buy" is always safer because it's audited and regulated. That assumption doesn't hold anymore when the vendor's AI layer becomes the actual decision-maker in your risk models, your underwriting, your compliance flags. You're not buying a tool. You're outsourcing judgment.

The Real Split: Rent the Intelligence or Own It

Here's the framework I actually use with clients now. Forget build vs buy. Ask this instead: who owns the model that makes the decisions? If the answer is "our vendor," you are renting intelligence. Fine for commodity functions, payroll, expense reports, calendar scheduling. Nobody needs to own the AI that books meeting rooms. If the answer needs to be "us," because the decision touches your core product, your customer data, your competitive edge, or a regulated outcome, then you need to own that layer outright. Not license it. Own it. That means the model weights, the fine-tuning data, the inference pipeline, ideally running on infrastructure you control or can move without a six-month migration project. GitLab published a solid breakdown this week on the real cost of build vs buy for agentic AI in regulated industries, and their numbers echo what we see at HEIMLANDR when we scope AI agent projects for fintech and healthtech clients here in Sweden. The build cost isn't the code anymore. It's the data pipeline, the compliance guardrails, and the ongoing evaluation loop. But renting that from a vendor doesn't remove those costs, it just hides them inside a subscription fee that goes up every renewal while your negotiating power goes down.

Sweden Is Sleepwalking Into Vendor Lock-In

This is where I get frustrated as a founder building from Jönköping instead of San Francisco. Sweden has real engineering talent, a strong public sector digitalization push, and a genuine shot at owning parts of the European AI stack. Instead, I watch companies do the opposite. Google just announced it's betting on partners to run sovereign Google Clouds in the Nordics rather than building its own regional data centers outright. Read that carefully. Google isn't saying "we'll give Sweden full sovereignty over its cloud infrastructure." It's saying "we'll let a local partner wear the sovereignty costume while the actual intelligence layer, the models, the APIs, the training loops, stays exactly where it always was." That's a rent structure disguised as independence. Swedish public sector buyers who think "sovereign cloud" solves their AI ownership problem are about to find out it solves their data residency problem and nothing else. Meanwhide, Lovable Labs Sweden AB is actively hiring IT engineers right here in the Jönköping region. Good. More AI-native companies building here is exactly what this country needs. But hiring engineers and owning your model are two different things. You can have brilliant Swedish engineers integrating a rented model from OpenAI, Anthropic, or Google and still end up in the exact same trap: your product's core intelligence lives on someone else's infrastructure, under someone else's pricing, subject to someone else's roadmap changes. I've seen contracts where the vendor reserves the right to deprecate a model version with 90 days notice. Try running a regulated healthtech product on a 90-day notice period for your core decision engine.

Compare That to the US and Asia

In the US, the biggest banks and health systems are already building internal model layers, not because they distrust vendors philosophically, but because they've done the math on data leverage. If your fraud detection model trains on ten years of proprietary transaction data, that model is a moat. License it out and your moat becomes a subscription line item for your competitors too. China's approach is blunter: state-directed model sovereignty, full stop. No ambiguity about who owns the intelligence layer for anything touching critical infrastructure. Sweden and the EU sit in the middle, technically capable, politically slow. The EU AI Act gives us rules about transparency and risk classification, which matters, but it says almost nothing about who should own the model powering a regulated decision. Ownership isn't a compliance question in the current framework. It should be. Right now a Swedish bank can be fully AI Act compliant while being one contract renewal away from losing control of its own underwriting logic.

Where This Actually Goes

Push this forward three to five years and the picture gets sharper, not blurrier. As we get closer to genuinely general-purpose AI systems, the gap between "own your model" and "rent your model" stops being a cost question and becomes an existential one. A company that owns its fine-tuned model, its evaluation data, and its inference infrastructure can adapt that system as capabilities improve. A company renting a vendor's general model is entirely dependent on that vendor's roadmap, pricing, and risk appetite. When the vendor decides to compete directly in your market, and several already are, you don't get a warning. You get a new pricing tier that undercuts you, built on your own historical usage patterns. That's the outsourcing trap in the editorial framing I'd push hardest on: Swedish companies are not going to get disrupted by scrappy startups in this cycle. They're going to get quietly outsourced by their own AI vendors, the ones they trusted, the ones with the SLAs and the account managers and the friendly Stockholm sales team. The vendor doesn't need to steal your customers. They just need your workflow data for eighteen months and a product roadmap. Regulators are not close to ready for this. The EU AI Act addresses risk and transparency. It does not address structural dependency. Nobody in Brussels or Stockholm is asking "should critical national infrastructure run on a model owned by a single foreign vendor with no local override capability." They will ask that question. Probably after the first serious incident, not before. That's how regulation usually goes, reactive rather than architected.

What Builders Should Actually Prepare For

Three things I'd tell any Nordic CTO right now: First, classify your decisions, not your software. Stop asking "build or buy this tool." Ask "does this decision touch data or logic core to our advantage." If yes, that layer needs to be ownable, not just licensable. Second, build your evaluation and data pipeline in-house even if you rent the base model. The model is replaceable. Your fine-tuning data and your evaluation harness are not. This is exactly the kind of infrastructure work we do at HEIMLANDR when we scope AI solutions for clients who want optionality, not lock-in. Third, treat MVP speed and ownership as compatible, not opposing goals. This is the myth I hear most often: "we need to move fast so we have to buy." Wrong. A well-scoped rapid MVP built on infrastructure you control can ship in weeks and still leave you owning the intelligence layer. Speed was never the actual tradeoff. Ownership discipline was.

What to Look At This Week

If you're an engineering leader trying to figure out where to put your attention right now, four things worth your time: Graphify is genuinely useful if you're serious about owning your intelligence layer. It turns your codebase, docs, SQL schemas, and configs into a queryable knowledge graph using deterministic AST parsing, no vector store required. That's exactly the kind of internal infrastructure that keeps your institutional knowledge inside your walls instead of feeding a vendor's fine-tuning set. ECC is worth watching for anyone building agent workflows on Claude Code, Codex, or Cursor. Skills, memory, and security-first agent harnesses are becoming the actual differentiator between teams who own their agentic stack and teams who are one API change away from a broken production system. rtk deserves attention too, it's a Rust CLI proxy cutting LLM token consumption 60-90% on common dev commands. Owning your model matters less if you're burning your margin on inference costs you didn't need to spend. And read GitLab's build vs buy cost breakdown for agentic AI in regulated industries. It's one of the more honest pieces of vendor content I've seen this year, probably because GitLab has skin in both games.

The Practical Move

If you're running a Swedish company right now and you haven't audited which of your core decisions run on rented intelligence versus owned intelligence, that's the first thing to do this month. Not next quarter. This month. Map your critical decision points, fraud detection, underwriting, diagnosis support, pricing engines, whatever your version of "the thing that actually matters" is, and ask honestly who owns the model behind it. Where you find you're renting something that should be owned, that's a build conversation, but a smarter one than the old framework allowed. It's not "should we build this from scratch." It's "how do we build the ownership layer, fast, without reinventing commodity infrastructure underneath it." That's the actual work. We do it through fullstack development that keeps the intelligence layer yours while using proven tooling everywhere else. That's not idealism. That's just how you avoid becoming a line item in someone else's roadmap.

I'll say this plainly because nobody else running a Swedish tech company seems willing to: the next decade of Nordic competitiveness gets decided by who owns their models now, not who has the best pricing deal with a vendor. Denmark, Norway, Finland, we're all making this decision right now whether we admit it or not. The companies who understand the difference between renting speed and owning advantage are the ones still standing in 2031. The rest will be very efficient, very compliant, and very replaceable.

Fredrik Brunnberg is the CEO of HEIMLANDR.IO, building AI and software solutions from Jönköping, Sweden. This is the daily HEIMLANDR briefing. If you found this valuable, share it with someone who builds things.