From Prototype to Production: What AI-Built Software Needs to Ship

The prototype ceiling

AI coding tools are genuinely impressive. A non-technical founder can describe an idea and have a working interface in an afternoon. A developer can scaffold a full-stack application in a single session. The output looks real, works in demos, and proves the concept.

Then reality sets in.

The first user hits an edge case and gets a blank screen. A security scan reveals hard-coded API keys. The database has no indexes and slows to a crawl at 100 users. There are no tests, so every change risks breaking something else. Deployment is manual. Monitoring does not exist.

This is not a failure of the tools. It is a natural consequence of optimising for speed over durability. The prototype did its job: it proved the idea. Now it needs engineering to become a product.

What production-grade software requires

The gap between prototype and production is not about code quality alone. It is a set of capabilities that prototyping tools do not prioritise.

Security

• Authentication and authorisation (not hard-coded users or open endpoints)
• Input validation on every endpoint
• Secrets management (Azure Key Vault, environment variables, not hard-coded strings)
• HTTPS everywhere, with proper certificate management
• Dependency scanning for known vulnerabilities
• OWASP Top 10 coverage as a minimum baseline

Testing

• Unit tests for business logic
• Integration tests for API endpoints and data access
• End-to-end tests for critical user journeys
• Tests that run automatically on every code change (CI)
• Test coverage that gives you confidence to change code without breaking things

Deployment and operations

• Automated deployment pipeline (CI/CD)
• Infrastructure defined as code (not click-to-configure in a portal)
• Environment separation (development, staging, production)
• Rollback capability
• Health checks and readiness probes

Monitoring and observability

• Application performance monitoring (response times, error rates, throughput)
• Structured logging with correlation IDs
• Alerting on failures and performance degradation
• Distributed tracing for multi-service architectures

Data integrity

• Database migrations (versioned, repeatable, reversible)
• Backup and recovery procedures
• Data validation at the persistence layer
• Appropriate indexes for query performance

Code structure

• Separation of concerns (not everything in one file)
• Configuration externalised from code
• Error handling that fails gracefully, not silently
• Code that another developer can read and modify six months later

The three paths

Every prototype-to-production journey follows one of three paths. The right choice depends on the prototype’s quality and your production requirements.

Path 1: stabilise

When it fits: The prototype has reasonable structure. The core architecture works. The gaps are in security, testing, deployment, and operational readiness.

What happens: An AI-augmented team assesses the codebase, adds the missing production layers (auth, tests, CI/CD, monitoring), and hardens the existing code. The prototype’s structure is preserved.

Timeline: 4-8 weeks with AI-augmented delivery.

Cost: See our pricing for current ranges.

Best for: Well-built prototypes from experienced developers using AI tools. The code works and is maintainable; it just was not built with production operations in mind.

Path 2: refactor

When it fits: The prototype demonstrates the right idea but has structural problems. Some components need rebuilding. Others can be preserved and improved.

What happens: The team identifies which parts of the codebase are worth keeping and which need rebuilding. Production components are extracted, refactored, or rewritten. The prototype serves as a living specification for the target system.

Timeline: 8-16 weeks with AI-augmented delivery.

Cost: See our pricing for current ranges.

Best for: Prototypes built with AI tools by non-specialists. The idea is validated, but the implementation needs professional engineering to scale and operate reliably.

Path 3: rebuild

When it fits: The prototype proves the concept but the codebase is not a viable starting point. Fundamental architectural choices (data model, auth approach, deployment model) need to change.

What happens: The prototype becomes the specification. The team rebuilds with production architecture from the start, using the prototype to validate requirements and demonstrate expected behaviour. AI-augmented delivery means the rebuild is faster than a traditional greenfield project.

Timeline: 12-24 weeks with AI-augmented delivery.

Cost: See our pricing for current ranges.

Best for: Complex applications where the prototype was always intended as a proof of concept, or where the prototype’s technical foundation (framework, database, hosting model) does not match the production requirements.

How AI-augmented engineering compresses the journey

The same AI tools that built the prototype also accelerate the production-readiness work. But the approach is different: structured, governed, and reviewed.

Codebase analysis. AI tools (Claude Code, Cursor) read and reason over the entire prototype codebase, identifying security gaps, missing error handling, architectural issues, and test coverage gaps. This assessment takes days rather than the weeks a manual review would require.

Test generation. AI generates comprehensive test suites from the existing code, covering the happy paths and edge cases that prototyping tools skip. Engineers review and refine these tests, not write them from scratch.

Security hardening. AI identifies common vulnerability patterns (injection points, insecure defaults, exposed secrets) across the codebase and generates fixes. Human review validates every change.

Infrastructure as code. AI generates deployment configurations (Azure Bicep, GitHub Actions workflows) from the existing application structure, creating the CI/CD pipeline and environment setup that the prototype lacks.

Documentation. AI generates technical documentation, API specifications, and architecture decision records from the codebase. This is critical for handover and ongoing maintenance.

Every AI-generated change goes through human review. The speed comes from AI handling the volume; the quality comes from engineers handling the judgement. This is the structured AI approach that compounds over time.

How to decide which path

An honest assessment of your prototype determines the path. Here is how to evaluate it.

Can another developer understand the code in a day? If yes, stabilise. If they need a week, refactor. If they cannot, rebuild.

Is the data model right? If the database structure reflects the actual domain and can handle the expected load, the prototype’s foundation is sound. If the data model is a byproduct of the prototyping tool’s defaults, refactoring or rebuilding the data layer is likely necessary.

Are the technology choices production-appropriate? If the prototype uses technologies that scale, are maintainable, and have strong ecosystem support, stabilise or refactor. If the technology choices were driven by prototyping speed rather than production fitness, rebuild.

What is the time pressure? Stabilisation is the fastest path. If you need to go live in weeks rather than months, stabilise what you have and plan a phased improvement programme.

The fastest way to answer these questions is a focused assessment. An AI-augmented team can evaluate a prototype codebase in 3-5 days and recommend the right path with a cost and timeline estimate.

Where to start

If you have a prototype that needs to become a product:

1. Do not apologise for the code. The prototype proved the idea. That was its job. The production work is a different phase, not a correction of a mistake.
2. Get an honest assessment. A short, focused evaluation (3-5 days) tells you which path is right and what it will cost. This is cheaper than guessing.
3. Plan for ongoing evolution. Production-readiness is a milestone, not a finish line. Budget for ongoing support or continued development after launch.

See our prototype to production service for how we handle this, or book a consultation to discuss your specific situation.