Build vs. buy: assembling the AI vendor binder yourself

There's an honest version of this comparison that most vendors won't write, so let's write it: you can build the AI vendor binder yourself. Nothing about it requires a product. It requires an inventory of the AI your institution uses, a documented assessment of what each vendor does with your data, and a crosswalk from those findings to the language your examiner uses. All three are things a competent compliance owner can produce. The real question isn't can you build it. It's whether the hours it takes are the best use of the one or two people you have — and whether what you build will still be true at your next exam.

This piece is the math and the decision, not a sales pitch. There are institutions that should build. Let's figure out whether you're one of them.

The build, step by step — and the hours each step really costs

Here's what "build it yourself" actually contains. We're not padding the estimate; these are the tasks, roughly ordered, with honest ranges for a small program doing this for the first time.

1. Inventory the AI you actually use. Not the sanctioned list — the real one. That means reading OAuth grants in Google Workspace and Microsoft Entra, walking department by department, and reconciling what people say they use against what the logs show. This is the step everyone underestimates. The Ncontracts 2026 State of TPRM survey (n=173) found 72% of institutions are only partially aware which of their vendors even use AI — because this step is genuinely hard. Realistic first pass: 8–16 hours, and more if your OAuth hygiene has never been audited. (How to run an AI data call and Reading OAuth grants — the shadow-AI map in your Workspace and Entra are the build-it-yourself guides for exactly this.)
2. Assess each vendor's data handling. For every AI vendor on the list: does it train on your data, what's the retention, who are the sub-processors, where does the data live, what's the breach-notice commitment, what certifications back the claims? The published answers are scattered across a DPA, a trust page, a sub-processor list, and a security whitepaper — and often contradict each other. Realistic: 2–5 hours per material vendor, and a small stack still has 8–15 of them. That's the bulk of the project.
3. Map findings to your exam vocabulary. A finding is only evidence if it's tied to an obligation. That means crosswalking each result to NCUA's proportional vendor due-diligence framework (07-CU-13 / SL 07-01) or the Reg S-P requirement for written oversight of service providers, in language a reviewer recognizes. Realistic: 6–12 hours to build the crosswalk the first time; faster after.
4. Assemble the binder. Structure it, redact what needs redacting, write the summary an examiner reads first. Realistic: 4–8 hours.

Add it up and a careful first-time build is roughly 40–80 FTE-hours — one to two full working weeks for a person who, in most programs, is also doing four other jobs. And that's the first number, not the recurring one.

The part the hour-count hides: it decays

The binder isn't a monument; it's a photograph. Vendors add AI features on their own cadence — the whole premise of Your vendors are adding AI without telling you — and every time one does, a cell in your binder quietly goes stale. Sub-processors change. Retention terms get revised. A vendor you cleared last spring ships an AI assistant this fall that trains on prompts by default.

So the build cost isn't 40–80 hours once. It's 40–80 hours to stand it up, plus a re-verification burden that never goes to zero. For a program running on 1–2 FTEs — about 63% of them, per the same Ncontracts survey — that recurring drift is the tax nobody budgets for. You didn't buy a binder; you adopted a chore.

When building is genuinely the right call

We mean this — there are real cases where in-house build is the correct decision, and the honest close is the brand:

• You have the hours and they're not scarce. If your program has slack — a compliance analyst whose plate isn't full, or a quarter where the exam calendar is quiet — those 40–80 hours are yours to spend, and spending them builds institutional knowledge that outlives any vendor.
• Your AI footprint is small and stable. A handful of vendors you chose deliberately, none of them shipping new AI every quarter, no shadow-AI sprawl. If the photograph won't move much, the decay tax is small, and a DIY binder holds up.
• You want to own the muscle. Some CCOs and risk officers, reasonably, want to understand their AI vendor risk in their own hands, not receive it as a deliverable. Building it once is the best way to learn it. Our playbooks exist partly for you — The AI vendor due-diligence questions that actually matter is the question set we'd use ourselves.
• You have a real GRC function already. If you're staffed and tooled to run vendor diligence at scale, AI is just another vendor category, and you don't need a separate artifact. (That's the Enterprise GRC vs an examiner-ready report for a 1-2 person program conversation.)

If two or more of those describe you, build it. You'll do it well, and you should.

When the finished artifact wins

Buy — or rather, have it run with you — when the opposite is true:

• Your hours are the scarce resource. If the person who'd build this is the same person who owns BSA, complaints, and the audit response, 40–80 hours isn't free time; it's the thing that doesn't get done. The report converts a two-week internal project into a reviewed deliverable.
• Your footprint is sprawling or moving. Lots of vendors, active shadow AI, features shipping constantly. The decay tax is high, and a static self-build is stale before the ink dries. This is where a maintained research library earns its keep.
• You need it before an exam that's already scheduled. DIY runs at the speed of your calendar. A concierge assessment runs at the speed of the people running it.

Side by side

The bottom line

Build-vs-buy on the AI vendor binder isn't a trick question with a foregone answer. If you have the hours and a stable footprint, building it yourself is a legitimate, even admirable, call — and our playbooks are written to help you do exactly that. But be honest about the real number: 40–80 hours to stand it up, plus a drift tax that recurs forever, spent by the one or two people who can least spare it. When those hours are your scarcest resource and the footprint won't hold still, the finished artifact is the better trade.

Your Discover report is that finished artifact, produced by the AI Discover scan and run with you — the inventory read from your OAuth grants, the vendor findings backed by NobleCloak Vendor Intelligence, the research library behind every report, and the crosswalk to your exam vocabulary already done. **Request your Discover scan** if the math above says the hours are better spent elsewhere.

If you'd rather see exactly what you'd be building before you decide, read What an examiner-ready AI evidence binder contains — that's the table of contents, section by section.