Buying gets you experience on the clock you have. Building leaves the judgement with people who know your business. The deciding factor is how soon the capability has to work.
Build or Buy AI Governance Capability
By James Cotton · Last updated · 6 min read
Part of our topic guides on AI Governance & Data Strategy and AI Skills for Business.
By James Cotton, Founder, iO-Sphere
What you can buy, and what it costs
Buying covers more than a data protection officer. It can mean a consultant brought in to stand up a policy, an interim lead, or a permanent governance hire. The DPO still comes first. It is the one piece the law may already require of you.
The ICO's guidance on data protection officers, last updated in 2023, sets out when UK GDPR Article 37 makes the role mandatory. That covers public authorities, and organisations whose core activities involve large-scale, regular and systematic monitoring of individuals, or large-scale processing of special category or criminal-offence data.
That role can come from outside. In the ICO's words, "You can contract out the role of DPO externally, based on a service contract with an individual or an organisation." A legal duty you meet today can be handed this month to someone who has done the job before.
A hire costs money before anyone starts. In its Resourcing and Talent Planning 2026 survey of 1,014 organisations, run in April and May 2026, the CIPD found a median cost per hire of £3,500 for senior managers or directors and £2,000 for other employees, both up on 2024. Over half the organisations that recruited, 53%, had difficulty attracting candidates. That was in a labour market the ONS measured at 2.5 unemployed people per vacancy for May to July 2026.
Whoever you buy, one decision cannot go with the contract. A contracted DPO advises on your AI systems and checks them. Someone on your side still has to settle what each system is for and how it handles personal data, and that person needs enough governance judgement to do it well.
What building leaves inside the business
Building starts with a question. Who already sees the risk? Usually it is the person closest to the work, the one who would spot an AI tool's answer going wrong before a customer or a process did. They know how the business runs. What they need is the method.
Employers are turning to this route. A small 2025 survey for DSIT, run by Gardiner & Theobald (119 self-selecting organisations that develop or buy AI, fieldwork from January 2025, published January 2026), found apprenticeships rose from 3% of AI hires in 2020 to 19% in 2025. It also found 88% of organisations used on-the-job training. With a sample that size, treat the figures as a direction of travel.
In England the funded way to build this is the Level 4 Data Protection & Information Governance Practitioner apprenticeship, standard ST0967, set out in full in the standard guide. iO-Sphere teaches it as Data & AI Governance, with around 15 months of training and a final assessment over the following three.
Set that against the hiring figures above. The standard's funding band is £10,000. Under the 2026-27 funding rules, an employer pays none of it for a start aged 16 to 24. For an older start, a non-levy employer pays a twentieth (£500), and a levy payer with no funds left pays a quarter (£2,500). The person training does governance work in their own role throughout, so the cases they learn on are yours.
How much time you have decides it
Neither list chooses for you. The deciding factor is how long you have before the capability has to stand up on its own, and many organisations will face situations from both columns at once.
| Situation | Route |
|---|---|
| A regulator has set a deadline, and the answer must exist before anyone could be trained | Buy |
| A DPO obligation applies to you today | Buy (contract the role) |
| A one-off programme with an end date, where the capability has no work to do afterwards | Buy |
| AI use is spreading across teams, so governance questions will keep arriving | Build |
| The person who notices where AI meets a customer decision is already on your staff | Build |
| You have more than a year before the capability must stand without outside help | Build |
If every situation you face falls in the buy column, buying is the whole answer. A contracted DPO or a consultant with a defined scope does the job, and there is no reason to start a build to justify the spend.
If every situation falls in the build column, start the build. The capability then grows at the pace your AI use does, in someone who is already there.
When rows from each column apply, do both. Buy the DPO and build the judgement. The contracted DPO meets the legal duty and advises, while the person you grow makes the calls about purpose that the ICO keeps away from the DPO in any case.
One area, worked through
Picture a regional housebuilder whose sales team has started using an AI tool to draft replies to buyer enquiries. It is one area of the business. Nothing about it has a regulator's deadline attached.
Who feels the consequence? The buyer, if a draft promises something about a plot or a completion date that the firm cannot honour. The first person to notice would be the sales team lead, who reads the replies before they go out and knows which promises the business can keep.
Then the DPO test. The housebuilder is not a public authority, and in this picture its core activity is building and selling homes, with no large-scale monitoring of individuals and no large-scale processing of special category or criminal-offence data. None of the three conditions is met, so there is no DPO duty to meet this quarter.
That puts the area in the build column on two rows: the person who notices is already on staff, and there is time. The housebuilder buys nothing for it. The sales team lead starts Data & AI Governance and uses the enquiry tool as a live case, so the checks on those replies are written by the person who reads them every day.
Frequently asked questions
What does buying cost?
We do not publish figures for outsourced DPO fees or consultant rates, because we have no reliable source for them and a guess would mislead you. Ask each supplier for three things in writing: whether the fee is a retainer or a day rate, how many days it covers, and exactly what is in scope, such as which systems, which policies and whether they report to your board. Quotes compared on those three lines can be judged against each other fairly.
Can one person be both DPO and the AI lead?
Often not. If leading AI means deciding what systems are for and how they use personal data, that person is in the kind of position the ICO rules out for a DPO. Organisations therefore tend to keep the two seats side by side, with the DPO advising and the AI lead deciding, and the guide to the AI governance officer role describes what the second seat usually covers.
How long does building take before it shows?
The apprentice does governance work in their own job while they train, so the work appears in the business during the programme and does not wait for the final assessment. What takes the full length of the route is independence: someone who can run the work without outside direction. If a piece has to be in place before then, buy that piece and keep building behind it.
If we contract a DPO while we build, what should the contract say about handover?
Write the handover in from the start. The contract should name the person you are building, give them a place in the DPO's reviews while they train, and list what the DPO passes across before the engagement changes: the records they keep, the open risks, and the reasoning behind decisions already taken. It should also say what happens to the scope once your own person can take on more, so the arrangement shrinks by design and nobody has to renegotiate it under pressure.
Want to own AI governance in your organisation?
Our Level 4 Data & AI Governance programme builds the frameworks that make data trustworthy and AI accountable, funded through the Growth & Skills Levy.