Build or Buy an AI Agent? Decide on Control, Data and Exit Cost

For most Singapore SMEs, the right first AI agent is bought, with the controls kept in your own hands: a hybrid. Build only when the workflow is how you compete and you can staff its upkeep for years. Buy outright only when the agent reads and drafts but cannot act. Ignore feature lists for this decision. Compare who controls the agent's permissions, where your data goes, and what leaving would cost. It includes a two-minute decision tool for owners and whoever will run the agent.

The timing matters. A Ministry of Manpower survey published in April 2026 found 71.5% of Singapore firms had not started on AI, and only 3.8% had it built into core processes. The grant rules changed on 30 September 2026. And on 13 October 2026, IMDA will honour SMEs that built their own AI alongside SMEs that bought it.

Why are feature lists the wrong way to choose an AI agent?

Feature lists are the wrong axis because features are easy to copy, while the differences that cause damage sit underneath. Those differences are who can change what the agent may do, where its data travels and how hard it is to leave. Singapore's agentic AI framework from IMDA (version 1.5, May 2026) lists a vendor-operated agent as a risk factor in its own right.

First, a definition. An AI agent here is software that takes actions in your systems by itself: it reads an inbox, updates a customer record, sends a message, raises a purchase order. Acting is what separates it from a chatbot. Once software can act, "what can it do" matters less than "who decides what it may do, and who can stop it".

IMDA's Model AI Governance Framework for Agentic AI says this directly. Among the factors that make an agent more likely to go wrong, it lists an agent "provided or operated by an external party", and asks organisations to "consider to what extent their visibility and control over the agent is limited" (section 2.1.1). The framework is voluntary guidance, not law, but it is the clearest statement of what Singapore's regulator expects a careful buyer to weigh. Feature counts do not appear in it.

A case study in the same document shows the instinct in practice. The pharmaceutical company MSD keeps the agent features inside its software-as-a-service tools "by default restricted to within their own ecosystems", so a vendor's agent cannot roam across the rest of its data (page 22). That is a decision about control, taken before anyone compared features.

What are the three axes for choosing an AI agent?

The three axes are control surface, data boundary and exit cost. Control surface is who can grant or revoke the agent's permissions and switch it off. Data boundary is where prompts, outputs and logs are stored, and who may reuse them. Exit cost is what you can take with you, in what format, when you leave. Each axis can sit with you or with the vendor.

Control surface is the most practical of the three. Does the agent get its own login with only the access its job needs, rather than a shared admin password? Can an approval step sit in front of actions you cannot undo? Can you revoke it in minutes yourself, without opening a ticket with the vendor's support desk? Control surface decides how bad a wrong action can get; running cost is a separate question, covered in our guide to what an agent costs per completed task.

Data boundary covers more than the customer database. Agents create new data: the instructions you write, every message they read, every tool call they make (a tool call is the agent using another system, such as your accounting software). The questions are where that lands, for how long, and whether the vendor may use it to train its models.

Exit cost is the axis buyers forget until renewal. Your rules and prompts are the asset, and so is the record of what the agent did and who approved it. If they live only in a vendor dashboard and export as a PDF report, the vendor owns your switching cost. Open standards help at the edges: A2A, the protocol for agents talking to other agents, joined the Linux Foundation's Agentic AI Foundation alongside MCP, the common standard for connecting agents to tools (A2A project announcement, 27 August 2026). A standard only lowers your exit cost if the product you buy speaks it.

Here is how the three routes usually compare on each axis, with the two practical constraints owners raise first.

What does Singapore law say when you buy an agent?

Singapore law and guidance keep responsibility with the business that deploys the agent, whoever built it. Under section 4(3) of the Personal Data Protection Act 2012, which is binding law, you carry the same obligation for personal data a vendor processes for you "as if the personal data were processed by the organisation itself".

This is general information, not legal advice. The PDPC's advisory guidelines on personal data in generative AI, issued 20 July 2026, say the same thing in plain terms: "System Deployers bear primary responsibility for ensuring that the Generative AI Systems they have chosen to use can meet their obligations under the PDPA" (para 9.1). Primary, not sole: the vendor keeps its own protection duties. Buying hands off the work. It does not hand off the accountability.

The most useful sentence for a buyer sits in section 2.2.1 of IMDA's framework. It tells organisations to request "scoped API keys, per-agent identity tokens, and observability such as the logging of tool calls and access history", then adds: "Where such features are lacking, organisations should consider alternative or in-house solutions, or scoping down the agentic use case, such as restricting access to sensitive data." Read that as a build-or-buy rule written by the regulator. The test for buying is the control surface. If the product lacks it, you build that part yourself, narrow the job, or pick another product.

Each role reads that rule differently:

• Owner or MD: the vendor's brand does not carry your risk. Ask whether you can switch the agent off and prove what it did.
• CTO or technical lead: ask to see per-agent credentials and an exportable tool-call log in the demo, not at contract stage. If either is missing, that is your signal to own the control layer.
• Compliance: write training use, data region and deletion on exit into the contract. The PDPA does not require data to stay in Singapore; section 26 instead requires overseas transfers to get comparable protection. Few SMEs can negotiate a region into a standard contract, so pick a vendor whose offered region you can accept and get it in writing.
• The person who runs it: you need an approval queue you can clear from a phone, and a named owner to call when the agent misbehaves.

How do the EDGE grant and the AI tax deduction change the maths?

Public support now favours buying, or paying another firm to build, over building with your own staff. Enterprise Singapore closed the EDG and PSG grants to new applications on 29 September 2026 and moved support into the EDGE Grant from 30 September. According to IRAS, the 400% AI tax deduction for Years of Assessment 2027 and 2028 covers AI spend bought from another person, not your own staff.

Three EDGE rules matter for a first agent. Within the overall cap of S$100,000 a year, support for "single-function digital solutions, integrated enterprise systems and selected automation activities" is limited to S$30,000 a year (EnterpriseSG EDGE FAQ). Some activities require a pre-approved vendor; others let you choose. Do not start work or pay a deposit before you submit the EDGE application: the grant question belongs before the purchase order. Your agent project may be eligible. EnterpriseSG quotes up to 70% for SMEs but says support levels differ by activity, so check the specific activity rather than the headline.

The tax side is now defined. The IRAS Enterprise Innovation Scheme page, updated 23 September 2026, gives a 400% deduction on the first S$50,000 a year of qualifying AI expenditure for Years of Assessment 2027 and 2028, with no cash payout. (A Year of Assessment is the tax year that follows your financial year.) Qualifying spend means a subscription to or licence of an AI system "from another person", or an AI business service bought from another person, such as system development, consultancy or compliance work. Hardware is excluded, and so is "any expenditure subsidised by a grant or subsidy from the Government". Our reading, not tax advice: your own developers' salaries are not on that list. They keep their ordinary deduction.

That updates our July explainer on the 400% deduction, written when the qualifying scope was still pending and the PSG was still open.

Illustrative example: a 40-person trading company wants its first agent to match supplier invoices to purchase orders and draft the accounting entries, with a person approving before anything posts. The figures are round and made up.

• Buy: an invoice agent at S$1,000 a month, so S$12,000 a year. It has an approval step, but the logs live in the vendor dashboard and export only as reports.
• Hybrid: the same subscription, plus S$24,000 to a partner who puts the agent behind the company's own credentials, approval queue and log store.
• Build: one in-house developer at S$96,000 a year, plus S$3,000 of model usage.

Suppose an EDGE application filed before signing comes back approved, covering S$12,000 of the hybrid's integration work. The other S$24,000 of vendor and partner spend can qualify for the AI deduction, and 400% of it is a S$96,000 deduction. The build gets the 400% only on its S$3,000 of model usage. The hybrid costs three times the buy route in year one before support and twice after the grant. The grant is never guaranteed, so price the hybrid at three times until approval arrives. Every route keeps the ordinary 100% deduction, the build's salary included; the 400% adds S$72,000 of extra deduction on the hybrid's S$24,000. A deduction lowers taxable profit, not the invoice. What the extra spend buys is the approval history and logs that make leaving cheap, and public support narrows the gap without closing it.

Which route fits your first agent: build, buy or hybrid?

The decision tool below turns the three axes and IMDA's section 2.2.1 test into a few yes-or-no questions. It lands on one of five answers: buy, buy with gates, hybrid, build, or scope down first. Scoping down means running the agent in draft-only mode, where it proposes and a person acts, until the missing controls exist. Every outcome is also written out in the list beneath the tool.

Building outright is the right call less often than owners expect. In MOM's April 2026 survey, 42.4% of firms named a lack of skilled people as a barrier to AI and 37.4% named integration with existing systems. The same survey found firms under 25 employees adopted AI at 23.9%, against 76.4% for those above 500. A build is a promise to staff the agent for as long as it runs, and a small firm with one developer has a single point of failure.

IMDA does not rank building above buying. Its SME AI Impact Awards, to be presented on 13 October at SMEs Go Digital Day, recognise "proprietary AI solutions" and "ready-to-use or off-the-shelf AI solutions" in separate categories, and both require at least six months in production. Running it long enough to prove it matters more than who wrote the code.

Where Origin Pi stands

We think a first agent should be bought for its skills and governed by you. We design the layer that sits between an agent and your systems: a separate identity for each agent with only the permissions its job needs, a confirm step in front of anything that moves money or reaches a customer, and an audit trail stored where you can read it and take it with you. That layer turns a vendor's agent into a hybrid you control, and it is the part worth owning even when everything else is bought. Cerebrum, our own control layer, is in build.

We build the agent itself only when the workflow is how a business competes and someone will own it for years. Our business automation work starts from the same three axes, and the agent-readiness audit checks whether your data and processes can support any of the three routes.

Before your next vendor demo, ask to see three things live: the agent's own credentials and their scope, a switch-off that takes effect while you watch, and an export of one day's tool-call log. If any of them is missing, you are shopping for a hybrid or a smaller first job.