Application Portfolio Management: AI is changing make-or-buy decisions

Many banks and insurers follow a proven logic: core systems safeguard the transactional core business, while a considerable amount of standard software or SaaS solutions (surrounding systems) are used for additional functions. This creates complexity and drives up the effort required for operations and maintenance. At the same time, skills shortages, regulatory requirements, and dependence on software and cloud providers increase the pressure to make Make-or-Buy decisions in a more differentiated way. 

Generative AI can accelerate development, testing, documentation, and software creation. However, this does not mean that in-house development automatically becomes cheaper. What matters are the total costs across the entire lifecycle: from architecture, integration, and testing to security and regulatory evidence, through to operations, further development, and controlled decommissioning of the application. This leads to the following three hypotheses: 

Hypothesis 1: The marginal costs of customization are decreasing 
AI makes it easier to implement clearly delineated business requirements. This can make functions economically attractive that previously were hardly candidates for a custom implementation due to development effort or time-to-market. This is particularly attractive for functions with high differentiation value, controllable interfaces, and manageable operational risk—such as specific credit or claims processes, digital customer services, or the intelligent orchestration of existing applications. 

At the same time, faster development speed increases requirements for governance and quality. Security, architecture, testing, compliance, operations, and further development do not disappear with AI. Institutions need clear guardrails for AI-generated code, the models used, data access, approvals, vulnerability management, and long-term maintainability. 

Hypothesis 2: “Buy” also becomes smarter 
At the same time, providers of standard software are increasingly integrating AI directly into their products and development platforms. This makes standard solutions more flexible and more customizable. Where processes offer little differentiation potential, “Buy” therefore remains attractive. The key is whether a solution performs its task economically, securely, and reliably while also providing sufficient transparency, portability, and exit capability. The boundary between Make and Buy thus becomes less clear, making the quality and broad support of sourcing decisions all the more important. 

Hypothesis 3: Make-or-Buy becomes Make, Buy, and Compose 
The greatest room for maneuver arises where banks and insurers design their architecture so that they can flexibly combine standard components and custom services. Stable core systems remain the foundation for transactions, policies, contract administration, and robust operations. Using APIs, integration layers, and orchestration, new services can be connected, selectively developed in-house, or efficiently replaced as needed. 

At the same time, clear responsibilities are needed for components, data, interfaces, and models, as well as end-to-end governance from design through to operations. How Inventx sees the future of IT architecture for banks and insurers can be read about in the booklet of the same name. 

What does this mean for the IT roadmap? 
For CIOs and IT leaders in banks and insurers, five decisions move to the forefront: 

1. Active portfolio management? 
   Deliberately steering and consolidating the application landscape to reduce redundancies, lower complexity, and sustainably optimize costs. 
2. What do we standardize consistently? 
   Functions without strategic differentiating value should, wherever possible, be moved into standardized platforms or SaaS solutions. 
3. Which capabilities do we want to control ourselves? 
   In-house development makes sense where it creates customer value, speed, or strategic differentiation—internally or together with specialized partners (community effects). 
4. Are architecture and governance ready? 
   Interfaces, data access, security, quality controls, operating models, and responsibilities must keep pace with the higher development speed. 
5. How do we measure the economic benefit? 
   Decisions should be based on lifecycle costs, time-to-market, risk profile, and ability to exit—not solely on development costs. 

AI does not end make-or-buy; it changes the decision logic. The institutions that will succeed are those that combine standardization, targeted customization, and modular architecture into a manageable operating model.