Most portfolio companies with a credible AI use case have no team to build it, and hiring one first is a big bet. MVP provides the engineers and a method for building the system, with security and compliance work included. The company owns the code, data, and accounts from day one. A buyer’s diligence team will check that ownership at exit.
The starting point is much the same across regulated industries: a workflow with large document volumes or slow manual steps that runs on patient, client, or financial records. There is no engineering team, and leadership wants the company to own whatever gets built.
The two obvious answers both fall short. Hiring an AI engineering team before the first system exists is more risk than most lower middle market companies can take on. Handing the build to a software vendor leaves the company dependent on code and know-how it does not own.
Regulations, contracts, and workflows change every quarter. When a vendor builds the system and leaves, nobody inside the company can change it.
At exit, the buyer’s diligence team will ask who owns the code, the data, and the operating knowledge, and who can keep the system running.
Under HIPAA and rules like it, the company keeps its duties for regulated data, and the risk that comes with them, even when someone else writes the code.
Regulated companies already outsource production while keeping ownership. This works the same way: the company owns the system and sets the requirements, while remaining accountable for its regulated data. MVP supplies the people and a disciplined method for building and running the system. That includes a security baseline, a reference architecture, written decisions on vendors and data agreements, and go-live checks that hold up in a security review, an audit, or diligence.
In healthcare, Anthropic, OpenAI, AWS, and Microsoft all offer BAA-covered routes, but coverage varies by product, platform, and feature. Vendor documentation does not always agree, so MVP confirms coverage for the exact route in writing before any patient data moves. Development uses synthetic or properly de-identified data, so contractors never touch production PHI.
A short, paid discovery to agree on the first use case, the data flows, the vendor agreements (in healthcare, the BAA map), and the delivery budget. The company names one decision-maker. Discovery ends with a go or no-go decision.
The security and compliance plan covers the reference architecture, platform, data flows, integrations, and decisions on vendors and data agreements. Staff get an approved AI tool and a use policy in place of the free tools they already use. When on-premises is the right call, Christian sizes the hardware to the measured workload before any of it is ordered, then installs it at the company’s site as a rented appliance.
Christian leads the build with one or two contract engineers, working to milestones and a spending cap reviewed with leadership. A person confirms the system’s output before anything reaches a patient record, a claim, or a filing. Where the company already has an engineer or IT partner who can build, Christian coaches and reviews instead.
The company controls the accounts, data, code, and documentation throughout. The transfer to a team the company keeps is planned when the work begins, whether that team consists of new hires or contractors who become employees. If the company wants the system run for longer, Christian manages a build-and-operate partner while the company keeps ownership of the system.
For operating partners: the second portfolio company starts from the first one’s playbook and reference architecture.
At Elevance Health, Christian Busch led product for the AI/ML platform built on FHIR R4 lifetime patient records for 70 million members, on a zero-trust architecture across AWS and GCP. The prior authorization engine he built there combined OCR document intake, FHIR data, and guideline-derived decision trees, and cut decisions from days to seconds.
At a U.S. medical-device manufacturer, he built the cybersecurity and IT compliance program, with the roadmap and budget for ISO 27001, HITRUST, and NIST 800-53, that carried the company through health-system security reviews. He holds the CISSP.
Christian also runs Inoculis, a fractional CIO and CISO practice for medical device, SaMD, IVD, and digital health companies.
If you are an operating partner or a portfolio CEO with an AI use case and no one to build it, send a short line on the company, the workflow, and the data involved.
contact@mvp.svBy scheduling a call, you agree that the information you submit will be used by Mulligan Valley Partners to manage your inquiry, schedule the meeting, and communicate with you about our services. Scheduling may be provided through a third-party scheduling provider, which may process your booking information under its own privacy practices.