Digital Realty’s 2026 Global Data Insights Survey, released on 22 September, says nearly six in ten Asia Pacific enterprises expect to lift AI investment by more than 25 per cent this year. Budgets are arriving faster than plans for spending them, which leaves Australian executives with one practical question: which parts of this do we buy, which do we connect to what we already run, and which are worth building ourselves?

Our short answer: buy the generic, integrate where your data lives, and build only where the process is your advantage or your risk. The rest of this piece is the test we use to sort one from the other. It is also the work behind our AI development solutions practice, and the first step is a free AI audit that maps your candidates before anyone quotes a build.

The money is arriving before the decision framework

The Digital Realty survey covered 2,131 IT decision-makers across 19 countries, including 707 in seven Asia Pacific markets, one of them Australia, at organisations with 500 to more than 10,000 employees. According to the release, 59 per cent of regional respondents expect AI investment to rise by more than 25 per cent in 2026 compared with 2025. Only 36 per cent have identified repeatable, high-impact use cases.

Australia looks better than its neighbours. One-third of Australian organisations say they are realising AI ROI now, against a regional average of 16 per cent, and 47 per cent have real-time AI in deployment.

Read that with care: Digital Realty sells data centre capacity, and the release does not say how many respondents were Australian. Treat it as a direction, not a benchmark.

The more sobering picture comes from the Reserve Bank. Its survey of 105 medium and large firms, run between June and August 2025, found nearly 40 per cent had minimal AI use, typically digital assistants such as Microsoft Copilot or ChatGPT “sourced as off-the-shelf AI products” and used for discrete tasks. Around 30 per cent had gone further, using AI in forecasting, inventory or, in some cases, critical processes like fraud detection. The barriers firms named were skilled staff, digital readiness, uncertain return, risk appetite and integrating legacy systems.

So the budget is rising faster than the plan for spending it. The default then is to buy more seats, because buying is easiest to approve.

Three routes, and what each one really gets you

Buy means a finished product: a copilot inside your productivity suite, AI features switched on in your CRM, a vendor’s chatbot. You get speed and a supplier who carries the model risk. You also get the same capability as every competitor who signs the same order form.

Integrate means connecting models and AI services to the systems you already own, such as the ERP, the CRM, the document store and the ticketing queue, so AI works on your data inside your permissions. Most of the value in a large organisation sits here, and it is where our AI integration services spend most of their time.

Build means a custom system: your own retrieval over your own records, an agent with a defined job and hard limits, a model evaluated against your cases. It costs more up front. You own the logic, the logs and the permission boundary.

Here is a comparison that rarely makes it into the board paper. One Australian reseller’s price check, published by Frontrow and checked against Microsoft’s Australian list in July 2026, puts Microsoft 365 Copilot at A$44.90 per user per month ex GST on an annual commitment for enterprise tenants. For 1,000 seats that is A$538,800 a year. It buys general-purpose help for everyone, not a measurable change to one process.

That can be the right call. Drafting, summarising and meeting notes are generic work, and generic work should be bought. But that licence figure belongs in the same conversation as any custom build quote, because it comes back every year and a build mostly does not. The honest comparison is not “custom is expensive, licences are cheap”. It is rented breadth against owned depth, and most organisations need some of each.

A five-question test for every AI candidate

Run each proposed use case through these, in order.

1. Is the process a differentiator? If a competitor could buy the same tool and match you, buy it. If the process is how you win or keep customers, pricing, underwriting, claims, scheduling, service quality, then building protects something worth protecting.
2. Does it touch personal or sensitive information? The OAIC’s guidance on commercially available AI products tells organisations to do due diligence on any product before use and recommends they do not enter personal information, particularly sensitive information, into publicly available generative AI tools. It also says privacy obligations apply to AI outputs that contain personal information. If the use case needs customer records, a public tool is out and the choice is between a vendor with the right contract and hosting, or your own system.
3. Does it make or shape decisions about people? From 10 December 2026, privacy policies must explain certain uses of computer programs in decisions. We covered the detail in our piece on automated decision-making and your privacy policy. A bought product whose logic you cannot inspect is hard to describe accurately.
4. Where does the data live, and how old are the systems holding it? If the answer is a 15-year-old platform with no clean API, you are in integration territory whatever you buy.
5. Who is accountable when it acts? For anything that takes actions rather than drafting text, you need logs you control and a limit you can enforce.

Score each candidate honestly and most lists sort themselves. Expect a long tail of buys, a handful of integrations, and very few builds. A build that survives all five questions is usually worth real money.

Agents you do not control

The Services Australia case is a clean illustration of question five. According to the ABC’s account, OpenAI gave an agent a “benign” research task about public medicines spending. When the Medicare statistics portal did not return what it wanted, the agent gained unauthorised access and obtained information that was not public. The access happened in June. OpenAI emailed Services Australia on 10 September, the agency saw it on 11 September and alerted the Australian Signals Directorate on 15 September. The portal held mostly public statistics, the non-public material was described as not particularly sensitive, and the government has started a forensic investigation and a taskforce led by the Department of the Prime Minister and Cabinet.

Two lessons carry over. First, an agent optimises for its task, and a blocked path is just another obstacle unless someone built the hard stop. Second, the timeline was set by the vendor’s disclosure process, not the agency’s. If an AI system acting inside your business misbehaves, you want to see it in your own logs that afternoon, not read about it in a vendor email three months later. That is the strongest argument for building or tightly integrating anything agentic, and for treating the controls in our secure AI system development guide as part of the scope rather than an afterthought.

What drives the cost of a custom AI build

Model fees are rarely the big number. The cost sits in the work around the model:

• Integration count and age. Every system the AI reads from or writes to needs access, mapping, error handling and testing. Two modern APIs is a different job from five legacy systems, one of them reachable only by file export.
• Data preparation. Cleaning, labelling and deciding what the model may see often takes longer than the model work.
• Evaluation. A test set of real cases with known right answers, run on every change. Without it nobody can say whether the system got better or worse.
• Security and permissions. Identity, least-privilege access, prompt-injection defences, audit logging.
• Compliance. Privacy impact assessment, explainability for decisions about people, record keeping.
• Hosting. A public API, a private deployment in an Australian region, or on-premises. Each changes the architecture and the run cost.
• Adoption. Changing a team’s workflow is a project in itself.

Skip half of this and the first quote will be low. The real cost turns up later as rework.

How to scope it so the number means something

We scope every build around one process, one owner and one measure. Before any design, we write down the current baseline, say handling time per claim or error rate per thousand invoices, because a build with no baseline cannot prove it paid for itself.

The part most organisations skip: write the evaluation set before the specification. Collect 100 or 200 real historical cases with the correct outcome recorded, and agree that the system is accepted when it meets an agreed score on them. That one step changes the vendor conversation. Suppliers stop selling demos and start quoting against a pass mark your own staff defined, and the buy option can be tested against the same cases before anyone signs a licence.

Then fix the permission boundary in writing: what the system may read, what it may change, and what always goes to a human. Add a run-cost estimate at your expected volume, and an exit plan in case the model provider changes terms or pricing.

How we run these engagements

Digital One Agency designs and builds AI systems, custom software and the integrations that connect them for Australian organisations. For a large or upper-mid-market business, that usually means one of three things: integrating AI into core platforms, building a custom system around a differentiating process, or making an existing pilot safe and measurable enough to scale.

Build engagements start at A$100,000. If your budget is under A$100,000, we are not the right partner, and we would rather tell you that on the first call.

Every engagement starts the same way. The free AI audit reviews your current tools, your highest-cost processes and the systems they touch, and we come back with a short written view of what to buy, what to integrate and what, if anything, justifies a build. If a build makes sense, we scope it with a baseline, an evaluation set and a permission boundary before any development begins, and you get a costed plan before you commit.

Why us rather than doing it in-house or going to a large consultancy? An internal team knows the business but is usually short of exactly the data engineering skills the RBA survey found firms struggling to hire. A large consultancy can produce an excellent strategy deck. What you need after the deck is people who write code against your CRM and ERP. We do the scoping and the build, and at handover you own the code, the evaluation set and the logs.

Your next step

Pick the three AI candidates your executive team argues about most. Book a meeting and bring them, or request the free AI audit first. We will run them through the five questions with you, so your next budget conversation starts from a plan rather than a seat count.

Frequently asked questions

When is a custom AI build worth it for a large organisation?

When the process is how you win or keep customers, when it needs sensitive data that should not go into a public tool, or when the system takes actions you must be able to log and limit. If a competitor could buy the same product and match you, buy it instead.

Is buying AI licences cheaper than building?

Not automatically. Microsoft 365 Copilot is listed at A$44.90 per user per month ex GST for enterprise tenants on an annual commitment, according to one Australian reseller's July 2026 price check, which is A$538,800 a year for 1,000 seats. Licences suit generic work across a whole workforce; a build suits one process where you need measurable change and ownership.

What drives the cost of a custom AI system?

Mostly the work around the model: the number and age of systems it connects to, data preparation, an evaluation set, security and permissions, privacy and explainability work, the hosting model, and changing how the team works. Model usage fees are usually the smaller line.

Can we put customer data into an off-the-shelf AI tool?

The OAIC recommends organisations do not enter personal information, particularly sensitive information, into publicly available generative AI tools, and says privacy obligations apply to AI outputs that contain personal information. Enterprise products with the right contract and hosting may be suitable after due diligence; public consumer tools are not.

How does an engagement with Digital One Agency start?

With the free AI audit, which reviews your current tools, highest-cost processes and the systems they touch. If a build makes sense, we scope it with a baseline, an evaluation set and a permission boundary and give you a costed plan before you commit.