The actual decision
The framing of "build vs. buy" does not capture this choice well. ChatGPT Enterprise and Microsoft Copilot are managed assistants — productivity tools for individual users. A custom AI system is an application: scoped to a specific workflow, integrated with your data, deployed inside your tenancy. They are different categories of thing.
The question is not which one is better. The question is which category your problem belongs in.
When ChatGPT Enterprise / Copilot is the right answer
A managed assistant is the right tool when:
- The use case is general knowledge work — drafting, summarizing, brainstorming — not a clinical or operational workflow.
- PHI is not in scope. Either the work does not touch PHI, or you have a process to keep PHI out of the assistant entirely.
- The data the assistant needs to see is general internal documents, not regulated patient records.
- A per-seat subscription cost model fits your usage pattern.
- You want minimal IT overhead and immediate availability for your users.
Both ChatGPT Enterprise and Microsoft Copilot offer BAAs in their enterprise tiers, but a BAA does not automatically make every workflow you build on top of them appropriate. The BAA is a necessary condition; whether to handle PHI through a managed assistant is still a design decision.
When custom AI is the right answer
A custom AI system is the right tool when:
- The workflow involves PHI, and you need full control over the data path, retrieval, and audit log.
- The workflow has specific tools — retrieving from your policy library, writing to your case management system, calling your eligibility API — that a managed assistant cannot expose.
- You need an audit log that captures every model invocation tied to a specific user, case, and clinical context, in a format your compliance team can query.
- The AI is part of a product you ship — not a tool used internally — and the product needs to be defensible end-to-end.
- The use case has volume and value that justifies the engineering investment.
What custom does not mean
Custom does not mean training your own model. The model is almost always a foundation model from Amazon Bedrock, Azure OpenAI, or Anthropic — selected because the provider has a BAA and runs the model inside your covered cloud.
Custom means: the application that wraps the model, the retrieval that grounds it, the tools it can call, the guardrails on its outputs, and the audit log of everything it does. Those are yours.
A decision framework
Ask the following:
- Does the workflow touch PHI? If yes, custom is the default. Managed assistants can be made to work, but the burden of proof is on the deployer.
- Does the workflow need to call your systems? Managed assistants offer plugins and connectors, but they are limited compared to a system designed against your APIs.
- What does your audit log look like? If a Security Officer cannot get the answer to "show me every AI interaction this user had with this patient's data" from a managed assistant, you may need custom.
- Will this AI be embedded in a product you sell? If yes, custom — your customers' compliance posture depends on yours.
Hybrid is fine
The two are not mutually exclusive. Many teams use a managed assistant for general productivity and a custom system for the workflow that has compliance teeth. The mistake is using a managed assistant for the workflow because it was easy, then trying to retrofit it for compliance later.
Engagement starting point
If you are unsure which side of the line your workflow falls on, an architecture review is the right first step. We will look at the data, the regulatory exposure, and the cost model and tell you what we think — not what we hope you will want to buy.