From AI prototype to production: what needs to be settled before go-live

With modern language models and AI coding tools, a working prototype often takes just a few days. That is a real achievement. The hard part starts afterwards: as soon as real users, real data and real costs come into play, questions emerge that nobody asked during the demo.

From our projects we know the typical gaps. The points below are not a complete checklist, but they cover the topics where projects most often fail.

Security: the model is a new attack surface

A language model processes instructions and data in the same channel. Anything that reaches the context, such as user input, uploaded documents, web pages or emails, can influence its behaviour.

Prompt injection: Can content from documents or external sources make the model ignore instructions or reveal data?
Permissions: Can the system only access data the current user is allowed to see? In RAG systems this is one of the most common weaknesses.
Tools and actions: If the model can call functions, such as sending emails or changing records: are there confirmations, limits and audit logs?
Secrets: Are API keys exposed in the frontend, the repository or logs?

Rule of thumb: Treat every model output like user input: untrusted until verified.

Data protection: where does the data go?

Which personal data ends up in prompts, and is that necessary for the purpose?
Which model provider do you use, in which region, and is a data processing agreement in place?
Does the provider use inputs for training? Settings differ by plan.
What ends up in your own logs and monitoring tools, and for how long?

Regulation: which EU AI Act obligations apply?

The EU AI Act classifies AI systems by risk. Many applications, such as internal assistants, fall into low categories with manageable obligations. But anyone using AI in HR processes, credit decisions or critical infrastructure can quickly end up in the high-risk category.

Regardless of the risk class, transparency obligations apply, for example when people interact with a chatbot. The AI Act also requires sufficient AI literacy among staff.

Quality: how do you know it works?

Classic tests check whether code does what is expected. With AI features, output is not deterministic. You therefore also need:

A set of representative test cases with expected results
Automated evaluation that runs on every change to prompt, model or data
Monitoring in production that surfaces quality issues and outliers

Without this foundation, every model switch and every prompt tweak is flying blind.

Cost and scaling

What does a request cost, and how does that develop at ten times the usage?
Are there per-user limits, so that a bug or abuse does not turn into a surprise invoice?
How does the system behave when the model provider is slow or down?

Maintainability, especially with AI-generated code

AI coding tools speed up development considerably. But they also produce code that nobody on the team knows in detail. Before a prototype becomes the foundation of a product, take an honest look at structure, tests, dependencies and documentation.

Conclusion

Most of these points can be solved with reasonable effort once you know about them. It gets expensive when they only surface after go-live. That is exactly where our AI support comes in: we take care of security, compliance and scaling, so you can stay focused on your idea.