Build or buy software? How to decide

The German business dictionary Gabler Wirtschaftslexikon describes off-the-shelf software as software made for an anonymous market. It defines custom software as software developed for use in one particular business. The business either builds it itself or commissions a software company (Gabler Wirtschaftslexikon: Standardsoftware and Gabler Wirtschaftslexikon: Individualsoftware, both Feb 19, 2018).

Typical examples of off-the-shelf software are programs for email, office work and accounting, for enterprise resource planning (ERP) and for customer relationship management (CRM). Examples of custom software include an order management system that mirrors exactly how one business works, and a portal where a company’s customers check status updates and documents. If a company commissions software to sell to its own customers, the development is contract work for that company. For its customers, the result is off-the-shelf software.

The BSI also classifies base products with typical core functions as custom software once a business has them customized and extended with its own features. It names ERP systems and content management systems (CMS) as examples. Under IT-Grundschutz, the BSI’s framework for baseline information security, the same requirements apply to them as to new development (BSI, IT-Grundschutz module APP.7).

The IEEE Computer Society’s Guide to the Software Engineering Body of Knowledge (SWEBOK) distinguishes several ways to acquire software (SWEBOK Guide, v4.0a, Aug 2026):

• commercial off-the-shelf (COTS) software, an existing product you take “as is” under the vendor’s license terms
• software that another party develops exclusively for your organization, sometimes by customizing an off-the-shelf product
• open-source software, which is “nominally free”
• software as a service (SaaS), software you rent

Germany’s Federal Statistical Office reports that 54% of companies in Germany with 10 or more employees used paid cloud services in 2025. The most common uses were email, data storage and office software (Destatis, Nov 24, 2025). Our guide to SaaS explains what SaaS is and how providers run it.

The numbers in the “Sources” column refer to the source list at the end of this article.

Figures from Eurostat, the EU’s statistical office, show how widespread off-the-shelf products are. In 2025, of all companies in Germany with 10 or more employees, 31% used finance or accounting software as a paid cloud service, 13% ERP software and 12% CRM software. The EU averages were 31%, 16% and 15% (Eurostat, cloud computing services, as of Feb 27, 2026). Counting cloud and on-premises systems alike, 37% of German companies with 10–49 employees used an ERP system, as did 68% of those with 50–249 employees. Across the EU, the figures were 41% and 70% (Eurostat, integration of internal processes, as of Feb 27, 2026). Our comparison CRM vs. ERP for small businesses shows whether you need a CRM, an ERP or neither, with official adoption figures by sector.

Strengths: The product already exists. You can compare several offerings on a rating scale and check before you buy whether they meet your requirements. That’s how the BSI expects software to be selected (BSI, IT-Grundschutz module APP.6). Gabler lists two advantages over in-house development: lower development and maintenance costs, and faster availability within the company. Fixing security vulnerabilities is the vendor’s job: the BSI recommends buying software with a maintenance agreement that commits the vendor to fixing them promptly for the entire period of use.

Limits: The product won’t fit out of the box. According to Gabler, off-the-shelf software has to be adapted to its users’ requirements and sometimes aligned with how the entire business is organized. Whatever the settings can’t handle, you solve by adapting your process. With subscription software, there’s even less room. Under the definition of the US National Institute of Standards and Technology (NIST), customers control neither the infrastructure nor individual application capabilities. At most, they’re left with “limited user-specific application configuration settings” (NIST, SP 800-145). When a product fits poorly, staff work around it: the BSI describes users avoiding cumbersome software and repurposing other programs instead (BSI, APP.6). If your team keeps its own lists alongside the product, treat that as a warning sign.

Use case: tasks that follow fixed rules that are the same for everyone, such as email, office work, accounting and payroll. Also any process for which a product meets all must-have requirements through configuration. In our view, off-the-shelf software is almost always the better choice here.

The BSI draws the line the same way. If no existing product meets the requirements, even with an adjusted configuration, IT-Grundschutz also applies its module for custom software development (BSI, APP.6).

Strengths: You decide which features the software has and in what order they’re built. You also determine where it runs and how it exchanges data with other programs. The BSI recommends defining these interfaces in standardized technical formats (BSI, APP.7). Your own software has no license fees per user account. Cloud services, by contrast, meter usage, for example by storage, processing, bandwidth or active user accounts, and usually bill on that basis (NIST).

Limits: You carry the project risk. Among the typical threats, the BSI lists a development project running late, priorities being set wrong and unsuitable developers getting the contract (BSI, APP.7). You also have to contribute: the BSI expects you to decide who steers the development and to involve the people responsible for the process in testing early on. And the software is never finished. According to SWEBOK, over 80% of maintenance goes into enhancing and adapting software. One of the laws of software evolution that SWEBOK traces to research by Lehman and others says software “must be continually adapted, or it becomes progressively less satisfactory” (SWEBOK).

Use case: processes that define your business and that no product covers. Apps that bring together data from several programs. Portals where your customers check status updates, documents and invoices. And software you want to sell to customers yourself: our cost guide How much does it cost to build a SaaS product? shows what a first sellable version costs.

Total cost of ownership (TCO) provides the framework. SWEBOK defines the TCO of a software product as “the total cost for acquiring that product, activating it and keeping it running.” One-time costs dominate at first. Operating and maintenance costs, by contrast, “tend to start low and increase over time” (SWEBOK).

What matters is using the same period for every option. SWEBOK’s own example is the build vs. buy decision itself: buying and adapting an off-the-shelf product, or building a custom application from scratch. If you cost one option over a shorter period than the other, it can “seem like the better choice” even if it isn’t better over the same period (SWEBOK). WiBe, the German federal administration’s framework for assessing the economic efficiency of IT projects, also requires one common period for all alternatives. It warns that the length of that period significantly affects the result (WiBe 5.0, as of Nov 2014). Our example uses five years. Choose a period over which you’re confident you’ll use the software.

The structure follows the WiBe criteria catalog. It separates one-time development and rollout costs from ongoing operating costs, and it also counts the staff costs of using the system. We added the exit row: SWEBOK names high exit costs as a lock-in factor that influences decisions about getting out.

Worked example, subscription: With 20 user accounts, five years come to 1,200 account-months; with 30 accounts, 1,800. Multiply that number by the price per account per month in the quote.

Worked example, workarounds: Three employees each spend two hours a week maintaining their own list alongside the product. With 45 working weeks, that adds up to 270 hours a year and 1,350 hours over five years. Multiply those hours by your staff cost per hour. Both examples use illustrative values, not survey data.

Our cost guide How much does custom software development cost? covers market prices for developing custom software. Our own packages are listed on our software development page.

Dependence on the vendor

The BSI expects a company to decide during planning whether a piece of software would make it dependent on a single vendor (BSI, APP.6). A vendor can decide to stop offering a product. According to SWEBOK, lock-in factors such as technology dependency and high exit costs influence whether and when you can get out yourself.

Microsoft Office is one example of maintenance ending. Support for Office 2016 and Office 2019 ended on October 14, 2025, including the Access database in those versions (Microsoft Learn, as of Nov 14, 2024). If you keep using software beyond its maintenance period, the BSI warns, you risk security vulnerabilities that no one fixes promptly anymore (BSI, APP.6).

For office software and cloud services, most companies see themselves as dependent. In November 2025, 4,686 companies took part in a digitalization survey by the Association of German Chambers of Commerce and Industry (DIHK). Of these, 71% considered their company largely or completely dependent when it comes to office software, and 55% when it comes to cloud services (DIHK, Jan 2026).

Dependence on the development team

With custom software, you depend on the team that built it. Gabler considers off-the-shelf software better documented than custom software, which reduces dependence on the developers. The BSI lists inadequate contracts with external service providers as a threat in its own right (BSI, APP.7). So before the project starts, have these points put in writing:

• The source code is in an account owned by your company from the start.
• Every sign-off includes documentation another team can work from.
• Hosting, domain and access credentials run through your own accounts.
• The contract sets out which usage rights to the code you receive.

How to check each of these points is covered in our how-to Avoiding developer lock-in.

From our perspective, widely used programming languages and open-source components make it easier to find another team later.

Under the NIST definition, cloud services pool the provider’s resources to serve many customers in a multi-tenant model. Customers generally don’t know the exact location, although they can sometimes specify a country or a data center (NIST). Our article on multi-tenancy explains how an application keeps different customers’ data apart.

Germany’s digital industry association Bitkom surveyed 603 companies in Germany with at least 20 employees. For 98% of those that use or plan to use cloud services, the provider’s country of origin matters. Currently, 71% use cloud offerings from US-based providers, while 8% would prefer US providers (Bitkom, Sep 30, 2026).

With custom software, you decide which provider it runs with and in which country. You, or a service provider you hire, then take care of operations, backups and updates. Which contracts you need when a service provider processes personal data on your behalf is a question to settle with your data protection advisor.

Whichever route you take, ask before you sign in which formats you can export all your data and what the export costs. When software is retired, the BSI expects you to clarify how the functions you need will remain available (BSI, APP.6). As a rule, that includes the data.

Off-the-shelf plus an add-on: An application programming interface (API) is a defined way for programs to exchange data. If your off-the-shelf product offers one, your own app can read and write orders or receipts, for example, without changing the product itself. Check beforehand which data the API exposes and whether using it costs extra.

Extending off-the-shelf software: If you have an off-the-shelf product extended with your own features, the BSI already classifies the result as custom software (BSI, APP.7). Document every deviation from the standard configuration, and back up the configuration so you can restore it at any time. The BSI calls for both, and also for installing only plugins and extensions that are strictly necessary (BSI, APP.6).

Open-source software: According to SWEBOK, it’s “nominally free.” You can buy additional support or maintenance, and you must review the license for restrictions on use (SWEBOK). If you run the software yourself, you or a service provider take care of operations and updates.

The spreadsheet that grew: Under Gabler’s definition, an Excel workbook with macros or an Access database that a business built for itself is already custom software. The business created it for its own use. So ask the same questions you’d ask about any in-house development: who besides one person knows how it works, and what happens when that person is away? Our page on custom business software shows how such tools can be replaced. Our how-to How to replace Excel with a web app walks through the switch step by step.

Low-code platform: Whether a low-code platform could replace development is covered in our comparison Low-code vs. custom development. For internal tools and admin panels, our internal tools page compares low-code platforms with a custom build.

The steps follow the BSI’s requirements for planning, selecting and developing software (BSI, APP.6 and APP.7). The order and the branch at step 3 are our recommendation.

1. What does the software need to do? Together with the people responsible for the process and your IT team, write down the process, data, user groups, integrations and legal requirements in a requirements catalog. Separate must-haves from nice-to-haves. Our how-to on writing a software requirements specification shows how.
2. Which products are available? Survey the market, compare two or three products on a rating scale and test them with real data. Factor in training and data migration.
3. Does a product meet all must-have requirements through configuration? If yes, go to step 4. If not, go to step 5.
4. How do you get out again? Check data export in open formats, notice periods, price changes, data location and how long the vendor will maintain the product. Once these points are settled, off-the-shelf software is your choice.
5. Is only one part missing? Then consider an add-on that works with the product through its API before you replace the whole product.
6. Is the core missing? Then custom software is an option. Decide who will steer the development on your side, and start with a small first module.
7. What does each option cost? Calculate the cost items from the section What does each option cost over five years? for every option over the same period, and only then compare.

If you’d rather not do this alone: in our process check, we first look at whether off-the-shelf software covers your processes. If one fits, we’ll recommend it.