Buyer’s guide

The C-Suite Guide to the Agentic Enterprise

The three questions an investment committee actually argues about before it funds an AI programme, and what a defensible answer to each looks like.

1. The capital case: three-year TCO

The comparison is rarely close on speed. Standing up a senior in-house AI team is six to nine months of hiring and seven figures in loaded cost before a single release reaches production. The total cost of ownership an enterprise actually carries includes recruitment, retention, infrastructure and those idle months, not just salaries.

An embedded senior squad ships a first release in six weeks with no data hires. That is the honest shape of the trade: you are buying time-to-evidence, not cheaper engineering.

When building in-house is the right answer

When AI is your product rather than a capability inside it. If the model and the data loop are the thing customers pay for, that competence has to live inside the company, and a consultancy is at best a bridge. The common pattern is to prove the architecture with a firm, then hire into something that already works rather than into a blank repository.

Engagement bands by company size are published on our investment model.

2. The vendor vetting matrix

Five rows separate firms. Everything else on a typical scorecard is noise that every bidder passes.

1. 1

   Who holds the architecture

   A named person on the contract, or a rotating pool. Ask who scoped it and whether that person is on the delivery team. This single question eliminates more bidders than any other.

2. 2

   What is measured, and how it is counted

   Not the headline percentage. The baseline it was measured against, the evaluation set, and the definition of a failure. A number without a published method is marketing.

3. 3

   Who owns the output

   The graph, the pipelines, the evaluation harness, the prompts and the code, on delivery. Watch for shared-IP clauses and derivative-works carve-outs that your successor has to unwind.

4. 4

   Which frameworks delivery runs against

   SOC 2, HIPAA, GDPR, the NIST AI RMF, the EU AI Act. Ask whether these are frameworks they build against or certifications they hold, and get the answer in writing either way.

5. 5

   What happens commercially if the first milestone is missed

   A guarantee that exists only in a sales conversation is not a guarantee. Ask where it is published and what the acceptance criteria are.

Run it as a due-diligence checklist rather than a pitch review, and ask for artefacts: an eval design, a redacted architecture diagram, a reference who reached production. Our own evaluation frameworks, written so they work against us as well as for us, are on the guides index.

3. What an EU AI Act review asks you for

Reviews do not open with the model. They open with paperwork most programmes discover they are missing.

• A model inventory: every model in use, with an owner, a purpose and a risk tier.
• A risk classification per use case, not per system. The same model can be minimal risk in one workflow and high risk in another.
• Human-oversight design: who can review, override or halt a decision, with the authority and the information to do it.
• Retained logs showing what the system did, on what evidence, under whose approval.
• Evidence that accuracy was measured rather than asserted, against a stated baseline.

The pattern worth noticing: four of the five are about traceability, not about the model. An agentic programme that starts with the grounding layer and the audit trail arrives at review with these already in hand. One that starts with a demonstration spends its second quarter reconstructing them.

The governance layer is covered in more depth on AI security & governance.

Where to start

Scope the first programme to reach production rather than to impress. One domain, acceptance criteria agreed in writing before work begins, and a measurable accuracy target against a named baseline. That is a decision a committee can actually take, because it is bounded and the failure condition is defined.

What that looks like in practice is set out on the agentic enterprise, and the methodology behind every number we publish is on /proof.