Risk Tiers and Incentives: Why High-Consequence AI Is Co-Built, Not Bought

For the agentic AI use cases where a wrong output matters most, the recommendation is co-build and strategic partnership, not a product purchase. That is not our line. It is what the procurement research itself concludes once you read its risk table honestly. The higher the consequence, the less you can buy off the shelf.

Inverto, a BCG company, in "Scaling Agentic AI in Financial Services: Procurement as a Strategic Enabler" (2026), sets a governing principle: the closer an agent sits to a client or a regulated decision, the tighter and more bespoke the sourcing must become. This post takes the risk-tier and incentive strand of the argument we make in full in Stop buying agents. The procurement gaps sit in Why agentic AI pilots never industrialise, and the contract and data side in Accountability, contracts and data.

Three risk tiers, and what they recommend at the top

Inverto sorts use cases into three tiers by exposure, and attaches a recommended sourcing posture to each.

• Front office. Client-facing advice and personalised recommendations. The requirement is strict explainability, human oversight and conduct KPIs. Recommended posture: co-build or strategic partnership.

• Middle office. AML triage, fraud, claims and risk monitoring. The requirement is clear allocation of responsibility, audit rights and model-switching. Recommended posture: hybrid, multi-party.

• Back office. Regulatory reporting, IT automation and documentation. The requirement is standardisation, interoperability and cost control. Recommended posture: standardised sourcing.

Read the right-hand column again. For the two tiers where exposure is highest, the paper's own recommendation is co-build and strategic partnership, not a product purchase. That is an embedded applied-AI engagement described from the buyer's side of the table. Standardised sourcing is the right call for the back office, and it is also where the least value sits. Their table says the higher the consequence, the less you can buy off the shelf. So does ours.

Two gates, not one: funding and autonomy

Inverto sets out three procurement phases, and our three engagement stages are the same shape. The difference is what each gate produces.

• Governed proof of concept, or Assess. Their gate validates feasibility and readiness at low exposure, with predefined data boundaries and rapid evaluation against risk thresholds. Ours maps the workflow with the people who run it, produces working prototypes in days on your documents, and reaches an honest build, buy or automate decision. Go or no go.

• Minimum viable product, or Build. Their gate evaluates value, fit and governance performance through cross-functional reviews, with funding tied to outcome metrics and early audit trails. Ours builds inside your stack alongside your team, with approved inputs, deterministic checks, review points and escalation encoded, and ownership named before go-live.

• Scale development, or Prove and scale. Their gate industrialises under full supervision, with gain-share models, continuous monitoring and drift detection. Ours runs an evaluation gate against the process it replaces, on real work, emits the audit trail from the first run, and replicates to a second team before widening reach. Software you keep.

The distinction is the point. Their gates release funding to a vendor on validated performance. Ours release autonomy to a workflow on validated performance, and leave the validation record behind as a working part of the system. Both match what supervisors expect, and only one leaves you holding the code. Funding gated to outcomes is good procurement. Autonomy gated to outcomes is good engineering. Do both.

The incentive bottleneck

Inverto's fourth bottleneck is the one that decides whether a launched system keeps earning its cost: vendor incentives reward one-off delivery, so systems stagnate before they are worth what they cost. Four features cause it.

• Fixed scopes discourage iteration.
• Fixed budgets limit experimentation.
• IP restrictions block co-development.
• No post-launch reward, so nothing improves.

Nobody hands you an agent that maintains itself. A system in a regulated workflow needs to keep pace with the process, the data and the rules around it, and a commercial model that pays for delivery and stops has no reason to fund that upkeep.

An embedded applied-AI model is built to have none of these. Scope is one workflow at a time, so iteration is the job rather than a change request. The IP transfers, so co-development is the default rather than a clause. And the firm is paid to extend to the next workflow, not to renew a licence, so the incentive after launch points at the same place yours does. Choose a partner whose next invoice depends on the workflow still working. That is the same operating logic as who owns the wait?, read from the commercial side.

The way through

The research and our own practice converge on four moves, and we would sharpen each of the early-adopter behaviours it observes.

• Start narrow and high-frequency. Their observation. Ours: start where the evidence gap is largest, because that is where the workflow waits longest.
• Keep autonomy constrained until governance is in place. Their observation. Ours: put the governance in the substrate, so widening autonomy is a threshold change with a record, not a committee.
• Treat data segregation as foundational. Their observation. Ours: it is foundational because the build runs in your perimeter, not because a vendor promised it.
• Involve procurement early. Their observation, and ours too: bring the CPO into the first fortnight, when the decision is build, buy or automate, not after a contract has fixed the shape.

If the workflow that matters most is also the one an RFP has stalled on, that is exactly where a co-build starts. Download the field note for the full argument, or send us the workflow and we will map it in a fortnight, tell you honestly whether to build, buy or automate, and if it is a build, deliver it inside your stack with the evidence attached.

Figures and framing are from Inverto (a BCG company), "Scaling Agentic AI in Financial Services: Procurement as a Strategic Enabler", 2026.