What Breaks First in AI-Built Apps
AI-built apps break first at authorisation, database access rules, leaked secrets and unverified payment webhooks, not at the feature they were built to demo. They fail at the thing nobody demonstrate

Across the agency market in 2026, quoted budgets for an AI MVP mostly land between $15,000 and $150,000+, and where you fall in that range comes down to five drivers: scope, model strategy, data plumbing, compliance, and who builds it. This guide walks through each driver, what it does to the number, and how to keep the budget honest before you commit to anyone — including us.
Two founders can describe "an AI MVP" and mean completely different products. One wants a single workflow — say, a document summarizer behind a login — shipped to 50 pilot users. The other wants retrieval over proprietary data, role-based access, human review queues, and an integration into systems their customers already run. Both are real MVPs. They are not the same project, and no honest vendor prices them the same.
The most reliable way to estimate an AI product is to count complete workflows — a user action that runs end-to-end through the model and back to something useful. One polished workflow with real error states is a lean MVP. Every additional workflow adds design, prompts or fine-tuning, evaluation cases, and failure handling. Cutting workflows cuts cost; thinning quality inside a workflow just moves cost to post-launch firefighting.
Unlike traditional software, an AI product keeps costing you money every time someone uses it. Inference spend scales with usage: roughly, tokens per interaction × interactions per user × users × price per token. A support copilot exchanging long contexts with a thousand daily users is a very different bill from a weekly report generator. Model choice moves this number by an order of magnitude, which is why the build should include routing cheap models to cheap problems. Check current per-token prices directly on the provider pages — Anthropic pricing and OpenAI pricing — because they change often enough that any blog number would mislead you.
If the product answers from your data, budget for the unglamorous layer: ingestion, chunking, embeddings, a vector store, and — the part most estimates skip — evaluation, so you can tell whether answers actually improved after a change. This is where "demo works great" projects go to die in production. Retrieval-augmented systems are a build discipline of their own; we wrote up how we approach them on our RAG systems page.
In regulated verticals the expensive mistake is retrofitting. Audit trails, PHI-aware data flows, and KYC/AML evidence are architecture decisions — cheap on a whiteboard in week one, expensive as a rebuild in month six. If you are in healthtech or fintech, the compliance posture belongs in the MVP scope, not the roadmap. See how we frame this for HIPAA-aware builds and KYC/AML systems.
The build route changes both the price and the risk profile — and the honest comparison is about failure modes, not just rates.
| Route | Typical time to MVP | What you pay for | Where it breaks |
|---|---|---|---|
| Freelancer | 4–16 weeks, high variance | One generalist’s hours | Single point of failure; evals, security, and DevOps are usually out of scope |
| AI-focused agency | 6–14 weeks, fixed scope | A senior team with a delivery process | Quality varies wildly between agencies; vet the process, not the portfolio |
| In-house hires | 3–6 months including hiring | Salaries plus hiring time and management | Slowest to first version; right answer long-term, expensive way to test an idea |

We publish exactly one price: a fixed $4,999 Tech Audit — a 5-day diagnostic of an existing stack with a 47-item report, a 1-page action plan, and a 30-minute walkthrough. Our fixed-scope Project Builds run 6–14 weeks, deploy to your infrastructure, include 30 days of post-launch support, and you keep 100% of the IP. For a ballpark on your specific idea before talking to anyone, our cost estimator is free and takes a few minutes.
First, audit before you build: if you already have code, a $4,999 diagnostic is the cheapest way to find out what is salvageable. Second, insist on a scoped discovery — ours is a 1–2 week Discovery Sprint that ends in a fixed build price, so the quote is a commitment rather than an opening bid. Third, cut workflows rather than quality. Fourth, buy the commodity parts — auth, payments, hosting — and spend the budget on the thing that makes your product yours.
A scoped, fixed-price build typically takes 6–14 weeks, plus 1–2 weeks of discovery to define the scope. Anyone quoting a timeline before discovery is guessing.
Yes, if you are disciplined: one workflow, an off-the-shelf model, no custom integrations, and a no-code or template front end. That version is for validating demand, not for scaling — but validating demand is exactly what an MVP is for.
Three additions: evaluation (you have to measure model behaviour, not just test code), data plumbing (retrieval, embeddings, monitoring), and inference costs that continue after launch. The interface is often the cheapest part.
If you handle PHI, payments, or KYC data — yes, at the architecture level. You do not need certifications on day one; you need data flows that will not have to be rebuilt when the first enterprise customer or regulator asks questions.
Our $4,999 Tech Audit exists for exactly this: five days, a 47-item report, and a walkthrough call — priced so the answer to "should we work together" costs less than a day of agency time. Book it here or start with a free call.
Written by
Founder & CEO
Founder & CEO of Robust Devs. Leads delivery and works directly with every client, across AI marketing, healthtech, and fintech builds, and has done since 2019.
AI-built apps break first at authorisation, database access rules, leaked secrets and unverified payment webhooks, not at the feature they were built to demo. They fail at the thing nobody demonstrate
A code audit report earns its fee when it contains four things: an executive summary the person paying can act on, findings ranked by severity that cite specific files and lines, an architecture asses
Technical due diligence rarely kills a round. It re-prices one, and it does so at the worst possible moment: after the term sheet exists, when the fund has already decided it wants in and you have alr

Tactical writing for founders building AI products. Browse the archive for more field notes like this one.
Browse all articlesIf you are building in this space, book a call or get in touch.