A compliance analyst spends an afternoon with a large language model. She gives it 40 partner ads and asks it to flag missing APR disclosures. Within minutes, it finds several. By Friday, someone in leadership asks a fair question: Why pay for a marketing compliance platform when the team just built one?
It’s the right question to ask. But the build vs. buy marketing compliance software decision was never really about whether a tool can catch a problem. It’s about whether your institution can own that tool for years and defend every result to an examiner.
The prototype answers the easy question
Generative AI has changed what a small team can build. A model can read an ad, compare it with a disclosure rule and explain what it found. That’s real progress, and it’s why more compliance teams are asking whether they still need a vendor.
But a working demo answers only the first question: Can this catch problems? A compliance program has to answer harder ones. Will it flag the same issue the same way every time? Can you show an examiner why a piece of content passed? Who updates the rules when guidance changes?
A tool that reviews content doesn’t change who is accountable for it. If the prototype misses a misleading claim, the institution owns the miss, not the model. Regulators have been clear that there’s no AI exemption from existing consumer protection law.
Month six is the real test
We hear a version of this story more often than we used to. A team builds a minimum viable product. It works, and it earns praise inside the company. Six months later, the model provider deprecates the original model used, and the tool needs some rework, retesting and relaunch. That work isn’t anyone’s job, so it lands back on engineering.
Large language models do make it realistic to build a working tool for a few use cases. They can write the code and help ship it. The harder part is the layer that judges whether the model’s answers are right, that aligns the appropriate context with the problem being solved, that doesn’t burn through thousands of dollars of tokens a month, and keeping that layer accurate past the first six months. That takes engineers dedicated to the tool, not borrowed for a few sprints, no matter how capable. Every new use case adds to the bill. You can build it. It will likely cost more than you expect.
What you’re actually signing up to own
Marketing compliance isn’t one task. A program that holds up in an exam does five jobs across every channel where your brand appears:
- Discovery: finding where your brand, products and offers appear, including pages you didn’t create
- Capture: recording content as consumers saw it, when they saw it
- Scoring: checking content against regulatory and brand rules, the same way every time
- Remediation: routing findings to the right owners and tracking each fix
- Documentation: keeping an audit trail of who reviewed what, when and why
An AI prototype usually starts with scoring. The other four jobs are where most of the long-term work lives, and each one multiplies with every channel you add.
For a closer look at evaluating these capabilities, see Choosing the Right Marketing Compliance Software.
When building is the right call
Building can be the better choice. It tends to make sense when:
- Your scope is narrow. You review owned channels only, at modest volume, with few or no marketing partners.
- You need tight control. Data must stay in your environment, or review must fit deeply into a proprietary content system.
- You have a stable bench. Engineers and compliance subject matter experts can maintain the tool for years, not months.
- The review itself sets you apart. How you review content is part of what differentiates your business.
Many institutions land in the middle. They buy a platform for the core work of discovery, scoring and audit trails, then build integrations that connect it to their own systems and workflows. That hybrid path keeps engineering time focused on what’s unique to the institution.
The costs that don’t show up in a build estimate
Most build estimates price the first version. The larger costs arrive after launch, and they rarely appear on the original spreadsheet.
Keeping pace when the models change
AI tools don’t stand still. Model providers release new versions, retire old ones and change how outputs behave. Each change can shift what your tool flags, which means retesting, revalidating and documenting before you trust it again.
That creates a capacity and scheduling problem in-house teams often underestimate. Can the team ship a new, validated version every time the underlying models change? And can it match the explainability dedicated AI compliance vendors have already built in?
Competing for your own engineering roadmap
An in-house compliance tool competes for engineering time with everything else the business wants built, and engineering teams know it.
At one financial services firm, the internal team told its compliance leader that a compliance build wouldn’t outrank client work, and that keeping pace with regulatory and market changes would be difficult. The firm chose a third-party compliance vendor instead.
Compliance and marketing leaders at banks, lenders and fintechs describe the same pattern. The developers building new product features are the same ones asked to close compliance gaps. That turns every sprint into a choice between revenue now and cost avoidance later. Revenue now usually wins.
The sprint itself creates the next problem. Engineering gets a quarter to build the tool, ships it and goes back to its regular work. Now the compliance leader has to justify, every quarter, why someone should keep maintaining it.
One compliance leader framed the decision as capital allocation. Put engineering dollars into core competencies and the products that bring in revenue. Partner for cost avoidance. His firm faced this choice years ago, with a large engineering team that believed anything was possible given enough time and money. It chose to buy. The alternative was pulling engineers off revenue work every time a state issued new interpretive guidance.
Another leader put it more bluntly. Being a technology company doesn’t make you a marketing compliance expert.
Explainability you can defend to an examiner
A flag isn’t useful if no one can explain it. In a regulated environment, sign-off depends on explainability and auditability you can defend to a regulator: every flagged decision tied to a specific regulatory requirement, and a record of who approved each piece of content and why.
Building that layer is a product of its own. It means cataloging every model decision, versioning every rule and storing the evidence an examiner may ask for months later.
Remember what you’re building. An in-house review tool is a control, and controls get examined. Expect a state or federal regulator to ask how the tool works, how it was tested and how each result was produced. The paper trail has to exist before that question arrives.
Keeping rulebooks current
Rules change faster than most roadmaps. Federal guidance shifts, state requirements diverge and new products bring new disclosures. The same ad can pass federal review and still create risk in several states.
An established rulebook can absorb those changes quickly. One leading bank prepared for impending regulatory changes in less than 48 hours with PerformLine. An internal team would need to research, write, test and deploy the same update on its own.
The newest version of this problem is AI agents. Some teams are training their own agents for first-line review, one per product. One leader taking that route told us the hard part isn’t standing the agents up. It’s training them on the nuances of each product, then keeping every one of them current as regulators issue new guidance. That means retraining several models independently, every time. His conclusion: he’d rather not build it.
Every new channel is a new build
Marketing rarely stays in one place. A program that starts with web pages and email adds social media, influencers, call centers, text messages and video. Now AI assistants answer consumer questions about your products, too.
Each channel needs its own discovery and capture approach. Reviewing a video reel is a different engineering problem from scanning a landing page. Checking a disclosure in a video means reading what logos and promos are presented visually on screen, not just the transcript. Compliance leaders already rank social media, email marketing, and affiliates and influencers as the hardest channels to monitor for compliance, according to PerformLine’s 2025 State of Marketing Compliance report.
For an in-house tool, each expansion reopens the build, and coverage has to exist before the campaign launches. One partner bank made its call review 99% more efficient, saving more than 4,900 hours a month compared with manual review. An internal team would first need to build that call capability from scratch. The newest channel raises the same question: who monitors what AI assistants say about your products?
The run cost nobody budgets
After launch comes maintenance, retesting, compliance expert time, infosec reviews and the risk that the one person who built and understands the tool moves on. So the useful question isn’t “What will it cost to build?” It’s “What will it cost to own for the next five years?”
See how much time and money PerformLine can save you each month.
The third-party problem: You can’t review what you can’t find
Every cost above grows when the content isn’t yours. Banks increasingly reach consumers through affiliates, comparison sites, fintech partners, influencers and individual loan officers. That reach is valuable. It also means much of the content carrying your brand was written by someone else, published somewhere you don’t control and changed without notice.
A common assumption is that if we didn’t produce it, it’s not our problem. Supervisory expectations point the other way. Under the 2023 interagency guidance on third-party relationships, ongoing monitoring is one stage of the relationship life cycle banks are expected to manage.
The volume problem
The scale is hard to picture until you see it. One top bank now monitors more than 24,000 web pages daily and oversees 3,200 partners. Any of those pages can change without notice.
The visibility problem
The harder part is content you don’t know exists. In PerformLine’s benchmark of assets promoting leading U.S. banks, about 8% of discovered assets presented a potential compliance risk. The report ties that risk to gaps in discovery and oversight, not to missing policies.
For an in-house build, that’s a separate engineering problem. Scoring content you already know about is one job. Finding pages you don’t own, which change every day, is another.
The growth problem
This is where the decision affects growth, not just risk. In PerformLine’s 2024 State of Marketing Compliance research, 48% of banks and fintechs expected their partnership programs to grow, and half of banks said reviewing fintech marketing materials was already creating bottlenecks.
When oversight can’t keep up, the cautious choice is to slow partner growth. That’s a capacity problem, not a risk decision, and it shouldn’t set the pace of distribution. For the signals that oversight has fallen behind, see When Marketing Outgrows Compliance: 10 Signals Bank Executives Can’t Ignore.
There’s a flip side. A marketing leader at a fast-growing lender described monitoring as a negotiation tool. His team wanted to launch video ads, new landing pages and split tests faster than manual review allowed. A system his compliance partners trusted gave them room to say yes. Compliance now spends its time on complex cases and on testing the tool, not on reading every asset. Systems handle the high-volume, repetitive work. People handle the judgment calls.
That’s the real return on buying. It isn’t fewer people. It’s redeploying the people you have to higher-value work, and letting marketing move at the pace the business needs.
Buying has risks, too
A platform isn’t automatically the safer choice. Vendors raise prices, change roadmaps and sometimes overpromise on AI. Before you sign with anyone, including us, test for these risks:
- Lock-in: Can you export your data, findings and rule history if you leave?
- Roadmap fit: When you need something new, will the vendor build it or leave you with a workaround?
- Black-box AI: Can the vendor explain every flag and tie it to a specific rule?
- Track record and data handling: Avoid vendors with no track record, unclear AI testing practices or ambiguous data residency.
- Channel coverage: Does the platform cover every channel you use today and the ones you plan to add?
- Over-customization: A platform bent around every exception can become as hard to maintain as a custom build.
One test cuts both ways. Ask any AI vendor about its evaluation sets: how it measures quality and where that evaluation data came from.
Teams building in-house should ask themselves the same thing. What would you measure your tool’s results against?
Build vs. buy marketing compliance software at a glance
Neither option wins every row. The right choice depends on which trade-offs your institution can carry.
| Factor | Build in-house | Buy a platform |
|---|---|---|
| Control and customization | Full control over logic, data and interface | Configurable within the product; deeper changes depend on the vendor’s roadmap |
| Data location | Stays in your environment | Depends on the vendor; confirm data residency |
| Time to first coverage | Starts after design, build and validation | Starts after configuration and onboarding |
| Ownership after launch | Engineers return to other work; upkeep needs funding every quarter | Vendor owns upkeep; your team oversees the vendor |
| Model and rule maintenance | Your team retests and updates after every change | Vendor maintains; your team validates |
| Adding a new channel | New capture, discovery and rules work for each one | Depends on the vendor’s channel coverage; confirm before you sign |
| Discovery of unknown partner content | A separate engineering project | Included in some platforms; confirm scope |
| Explainability and audit trail | Must be designed and built | Should exist on day one; test it |
| Cost profile | No license fee; ongoing staff, maintenance and key-person risk | Predictable subscription; switching costs if you leave |
| Accountability to regulators | Yours | Still yours; the vendor becomes a third party to oversee |
Questions to answer before you decide
Bring these to the table with compliance, marketing, engineering and risk leadership:
- Who retests and documents the tool when the underlying model changes?
- Who owns the tool after the build sprint ends, and who funds its upkeep every quarter?
- Is every engineering hour spent here worth more than the same hour spent on your product?
- Who updates the rules when federal or state guidance changes, and how fast?
- If the person who built it left tomorrow, who could explain its results to an examiner?
- If an examiner reviews the tool itself, can you show how each result was produced?
- When marketing launches a new channel, who builds coverage for it before launch?
- Can it find partner and affiliate content you don’t know exists, or only review what you send it?
- What happens to review times if your partner count doubles?
- Does the cost estimate cover year three, or just launch?
- For any vendor on your list: Can you export your data, and can they explain every flag?
Where PerformLine fits
PerformLine sells marketing compliance software, so here is the standard we hold ourselves to.
PerformLine has worked in marketing compliance for almost 20 years. In banking and finance, technology has to be responsible, explainable and auditable, not just powerful. After years of working through banks’ third-party risk reviews, we expect the same diligence for AI models, including what data goes into a large language model, and we prepare for it in advance.
Demos are easy. Scalability is the test. That’s the bar we hold ourselves to. It’s also the bar you should hold any option to, including one you build.
If you’re weighing this decision, see how PerformLine holds up against the questions above.
FAQs
It’s the choice between developing your own tool to review marketing content for regulatory risk and licensing a platform from a vendor. The real decision isn’t whether a tool can catch problems. It’s whether your institution can maintain the tool for years and defend every result to an examiner.
Building tends to make sense when your scope is narrow (owned channels, modest volume, few partners), data must stay in your environment, you have engineers and compliance experts who can maintain the tool for years, or how you review content is part of what differentiates your business.
Generative AI makes a working prototype realistic, but a prototype usually covers only scoring. A compliance program also needs discovery, capture, remediation and documentation across every channel, plus consistent results, rule updates and explainability an examiner will accept. That layer is where most of the long-term cost lives.
The largest costs arrive after launch: retesting when AI models change, competing for engineering time, building an explainable audit trail, keeping rulebooks current with federal and state guidance, adding coverage for each new channel, infosec reviews and key-person risk. Budget for five years of ownership, not just the first version.
No. Accountability to regulators stays with your institution whether you build or buy. When you buy, the vendor becomes a third party you’re expected to oversee, so test its explainability, data handling and channel coverage before you sign.
Ask whether you can export your data, findings and rule history if you leave, whether the vendor can explain every flag and tie it to a specific rule, which channels it covers today and on its roadmap, how it handles data residency, and how it measures AI quality with its evaluation sets.
Yes. Many institutions buy a platform for the core work of discovery, scoring and audit trails, then build integrations that connect it to their own systems and workflows. That hybrid path keeps engineering time focused on what’s unique to the institution.
