AI App Production Readiness: From MVP to Launch

**Part 2 of 3 · The business responsibility behind AI-built apps** Your prototype works. The next decision is whether it is ready to handle real information and support real work. AI app production readiness needs more evidence than a successful demonstration. This article was inspired by the discussion in Ctrl Alt Dev Episode 38, hosted by [Sean Sale](https://www.linkedin.com/in/seansale/) and [Paul Rhodes](https://www.linkedin.com/in/ukwebdevelopment/). Credit to both hosts for exploring the responsibilities behind AI-built software. The business recommendations here are Smart AI Studio’s perspective. [Listen to Episode 38 — AI Wrote the App: Now Who’s Responsible For It?](https://directory.libsyn.com/episode/index/show/8e658e4a-8560-4204-9ebd-6f1db1b6ade2/id/43072413) ## Recognise the change in responsibility In [the first article](/insights/ai-app-business-decision/), we looked at using AI to test a business idea. Moving into production means making that app available for everyday use. People may now depend on it to deliver a service, store information or make a decision. The consequences change with the use. An error in a demonstration using sample records is inconvenient. The same error in a customer portal could expose private information or prevent someone receiving the service they paid for. Internal apps deserve attention too. A tool used by five staff may hold commercially sensitive information or become essential to daily operations. Assess its importance by what it does and what could go wrong, as well as by how many people use it. ## Know where your expertise ends I can build an MVP and do everything I know to make it secure and complete. I also know the limits of my expertise. My approach is to involve an experienced development agency to assess what is needed and take it into production responsibly. For a business owner, the useful question is what expertise this particular app needs. A simple, tightly controlled tool may require a different level of review from a customer-facing service handling sensitive records. The scope should reflect the consequences of failure. Bring that expertise in early enough to influence the design. Waiting until launch day can mean discovering that access, data handling or the underlying structure needs substantial work. A prototype remains valuable even when parts of it need rebuilding. ## Ask for evidence of AI app production readiness You do not need to understand every technical detail to ask sensible questions. You do need answers that explain what has been checked, what remains uncertain and who will resolve outstanding issues. - What information will the app hold, and who can see or change it? - How have we tested that users cannot access someone else’s records? - What happens if someone enters incorrect information or an external service stops responding? - Can we recover our information after a failure, and has that recovery been tested? - What problems remain, and which must be resolved before release? - Who can stop the app or restore the previous version if a change goes wrong? Ask the reviewer to explain their scope and findings. An automated check can contribute useful evidence, but an AI-generated assurance that an app is secure should not be treated as approval to launch. NIST’s Secure Software Development Framework treats security as practices integrated into the development lifecycle. For an owner, the practical implication is to plan for review and response throughout the app’s life. A launch check is one part of that work. [Source: NIST Secure Software Development Framework](https://csrc.nist.gov/pubs/sp/800/218/final) ## Be careful about the authority you give an app An app that organises information has a different risk profile from one allowed to change payment details, delete records or send messages to customers. If it includes an AI agent that can take actions, define its authority deliberately. For example, an assistant could prepare a proposed supplier update for an authorised person to review. Allowing it to change bank details directly would require much stronger controls. The business should decide which actions need approval and make sure those limits are enforced in the connected systems. OWASP identifies excessive permissions and autonomy as causes of risk in AI agents. Its guidance includes limiting access, requiring approval for high-impact actions and enforcing permissions outside the language model itself. A written instruction to be careful is not sufficient control. [Source: OWASP Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/) ## Release in a way you can manage Agree who owns the release decision. Begin with a controlled group where appropriate, give users a clear way to report problems and keep a workable alternative for essential tasks during the transition. Set limits around the first release. Avoid adding features while unresolved problems accumulate. Record what the app is intended to do, the boundaries of its use and the support arrangements people can expect. Checking AI app production readiness helps preserve the benefit of a fast prototype. It gives the business a basis for deciding when wider use is justified, and a way to respond if experience reveals something the trial missed. This is not an argument against building an app or tool with AI. A useful prototype can become a valuable part of the business. Taking it into everyday use simply means being realistic about the commitment: testing it properly, agreeing who is responsible when something goes wrong, and planning for the support and maintenance it will need after launch. If your app went live tomorrow, what evidence would give you confidence that people could safely rely on it? Next in the series: [AI App Maintenance: Who Looks After It?](/insights/ai-app-ownership-maintenance/) examines maintenance, support and the cost of continued ownership. ## The business responsibility behind AI-built apps 1. [Before You Build an AI App, Define the Business Problem](/insights/ai-app-business-decision/) 2. [AI App Production Readiness: From MVP to Launch](/insights/ai-app-mvp-to-production/) 3. [AI App Maintenance: Who Looks After It?](/insights/ai-app-ownership-maintenance/) If you are weighing up a custom app, [talk to us about the business problem](/contact/) before committing to the build. ## FAQs ### When is an AI-built app ready for production? AI app production readiness depends on the consequences of failure. Get evidence that access, data handling, error recovery and support are suitable for the people who will rely on it. ### Is an automated security scan enough before launch? No. Automated checks can help find issues, but a suitably experienced reviewer should assess the app’s risks, explain the scope of their review and identify what must be fixed. ### Do small internal apps need a review too? Yes, proportionate to the risk. A tool used by a few people can still hold sensitive information or become essential to daily work. ### Should an AI agent be allowed to make changes on its own? Limit its permissions and require human approval for high-impact actions. Enforce those limits in the systems it connects to, not just in written instructions.

This article was written by Peter Lowe. The ideas and opinions are his own; AI was used to assist with drafting and editing.