Getting from prompt to production takes five stages: prototype, prove, harden, commercialise and operate. The prompt phase gets you working software in days. The remaining four stages take four to twelve weeks and cover validation, security and reliability, pricing and billing, and the support and monitoring needed to run the thing. Most AI-built products stall between stage one and stage three.
This is the path I take founders through, with the decisions that matter at each gate.
Stage 1 — Prototype (days)
The goal is a working artefact, not a business. Build one journey end to end: the single thing a customer does that creates value. Not settings, not admin, not onboarding — the core action.
AI builders are excellent here and you should use them aggressively. The mistake at this stage is scope: teams build eight screens when two would answer the question. If your prototype cannot be demonstrated in ninety seconds, it is too big.
Exit gate: someone outside your team can complete the core journey without you narrating it.
Stage 2 — Prove (1–2 weeks)
Now put it in front of people who could pay. Not friends, not other founders — the actual buyer. You are looking for three signals: they complete the journey unaided, they come back within a week, and they express willingness to pay a specific number.
Run it with ten to twenty users. Record what breaks and where they hesitate. Do not fix the code yet; fix the understanding. Half of what you build in stage three will be shaped by what you learn here, and building it earlier is waste.
Exit gate: a repeatable reason people use it, and at least a handful of credible paid intents. If you cannot get that, you do not have a hardening problem, you have a demand problem — go back to product validation.
Stage 3 — Harden (2–4 weeks)
This is the stage almost everyone skips. Hardening means the app behaves correctly when it is not being driven by its creator.
Concretely: row-level security on every table; server-side authorisation on every mutation; server-side input validation; secrets out of client code; rate limiting on public endpoints; error and empty states in the UI; structured logging; error tracking; uptime monitoring; automated backups with a tested restore; and a data deletion path.
Budget one to three days for security, one day for observability, and the rest for error handling and data model consolidation. If your app touches payments or personal data, this stage is not optional and it is not something to defer until "after we have traction".
Exit gate: you can name what would break under a hundred concurrent strangers, and you would find out within five minutes.
Stage 4 — Commercialise (1–3 weeks)
A product that cannot take money reliably is not a product. Commercialising means the full billing lifecycle works: signup, trial, conversion, failed payment retry, dunning email, plan change with proration, cancellation, refund, and invoice access.
It also means the commercial surface exists: pricing that maps to the value metric, terms, privacy policy, a real support address, and an onboarding path that gets a new customer to first value without a call. Most AI-built products get their first revenue not from a new feature but from removing the three steps between signup and value.
Exit gate: a stranger can find you, understand the price, pay, get value and get help — with no human intervention from you.
Stage 5 — Operate (ongoing)
Operating is the part with no end date: incident response, a weekly metric review, a change log, a support queue with an owner and a response target, and a release process that does not require the founder to be awake.
The operating cadence I run with clients is simple. Weekly: activation rate, week-one retention, revenue, top three support themes, open incidents. Monthly: churn reasons, unit economics, roadmap re-cut against evidence. That cadence is what turns a launched product into a growing one.
What it costs and how long it takes
For a typical single-journey B2B SaaS built with AI tooling: prototype 3–5 days, prove 1–2 weeks, harden 2–4 weeks, commercialise 1–3 weeks. Call it eight to twelve weeks from first prompt to first reliable revenue, assuming demand is real.
Cost depends on who does it. Founder-led with AI tooling and a specialist for the hardening pass is the cheapest credible route. A full agency rebuild is the most expensive and usually the slowest, because it discards the validated behaviour you already have.
What this looked like in practice
At Just Eat and Sage the same five stages existed, just with more people and more governance attached to each gate. At Wocal I ran all five myself. The structure does not change with company size — what changes is how explicitly you name the gates. Naming them is most of the value, because it stops teams shipping stage-one software to stage-four customers.
This is the same spine as the Crossley Method, applied specifically to AI-built products.
Frequently asked questions
- How long does it take to go from AI prototype to production?
- Typically eight to twelve weeks for a single-journey product: days to prototype, one to two weeks to prove demand, two to four weeks to harden, and one to three weeks to commercialise billing and support.
- What does hardening an AI-built app involve?
- Row-level security, server-side authorisation and validation, secrets management, rate limiting, error and empty states, structured logging, error tracking, uptime monitoring, tested backups, and a data deletion path.
- Should I validate before or after hardening?
- Before. Hardening a product nobody wants is the most expensive mistake in the sequence. Prove that people complete the journey, return, and will pay, then invest in making it safe and reliable.
- Can I skip stages if I am pre-revenue?
- You can compress stage four, but not stage three. The moment real users hold real data in your app, missing authorisation and monitoring are live risks regardless of whether you are charging yet.