Platform delivery models compared

Which model offers the most control?

A custom build can offer substantial design control, but only when the buyer can sustain technical and operational ownership. A licence assigns some implementation work to a provider while introducing product and contract constraints. A modular model divides control across interfaces and therefore depends on strong integration governance. These are comparison prompts, not measured performance ratings.

Criterion	Custom build	Licensed platform	Modular integration
Product control	Potentially high	Bounded by vendor product	High at owned layers, shared at interfaces
Initial definition burden	High	Medium	High at boundaries
Operational ownership	Buyer or contracted team	Shared with vendor	Distributed across suppliers
Switching work	Depends on architecture and data portability	Depends heavily on contract and export support	Depends on interface isolation
Best evidence	Architecture, delivery controls, operating plan	Product fit, SLA, roadmap, export and exit terms	Interface contracts, observability, failure and replacement plan

The model label does not transfer regulatory responsibility. In Great Britain, for example, the UK Gambling Commission says relevant remote operating and gambling-software licence holders must comply with its technical standards and testing requirements. A buyer must still map the planned product, legal entities, licences, jurisdictions, system boundaries, testing duties, and evidence owners for its specific launch.

NIST’s current cybersecurity supply-chain guidance treats acquired, developed, integrated, and deployed technology as a lifecycle risk-management problem. GEN uses that general guidance here to test requirements, dependencies, monitoring, change, and exit—not as an iGaming licence, certification, or legal conclusion.

When is a custom build not a fit?

A custom build is not a fit when the organization wants control but cannot assign people to product ownership, technical governance, operations, and maintenance. Ownership without operating capacity becomes dependence on the development supplier under a different label.

When is a licensed platform not a fit?

A licensed platform is not a fit when a required differentiator conflicts with the product’s roadmap or extension model. Before selecting it, test the exact workflows, data access, configuration, integration limits, and exit provisions that matter to the planned business.

When is a modular approach not a fit?

A modular approach is not a fit when the organization cannot manage multiple suppliers, contracts, incidents, and data flows. Modularity does not automatically remove lock-in: proprietary interfaces, data formats, commercial bundles, and cross-supplier dependencies can still make replacement difficult. It can also increase coordination work and make accountability unclear unless boundaries are explicit.

What should the final decision record contain?

The decision record should name the selected model, rejected alternatives, decisive evidence, uncertain assumptions, operating owner, review trigger, and exit path. Use the build-versus-buy guide to prepare the evidence, or send GEN a project brief for a consent-based routing review.

Frequently asked questions

Which platform delivery model is best?

None is universally best. Compare the models against the same product scope, jurisdictions, internal operating capacity, data and release controls, dependency risk, change needs, and exit conditions. A hybrid may be the most accurate description when different capabilities need different ownership models.

Does licensing a platform transfer compliance responsibility to the vendor?

Not by itself. Responsibility depends on the applicable law, licences, legal entities, contracts, and system roles. Record an owner for every regulated duty and obtain jurisdiction-specific advice where the allocation is uncertain.

Does a modular platform always reduce vendor lock-in?

No. Modularity can make a component replaceable only when interfaces, data formats, observability, test coverage, commercial terms, and exit assistance support replacement in practice.

What evidence makes delivery models comparable?

Give every option the same scope and ask for the same architecture, responsibility matrix, interfaces, service levels, data controls, security and testing evidence, dependency list, change process, operating plan, commercial assumptions, migration method, and exit terms. Treat provider claims as inputs to verify, not as proof of fit or outcome.