MVP Development: Scope, Cost, Timeline, and Process
MVP development is building the smallest working version of a product that real users can use, built to test whether it solves their problem before you invest in the full build. A minimum viable product differs from a prototype because people do real work with it, and from a full release because it covers one workflow and leaves out everything that does not test the core assumption. In BD Emerson's 2026 planning ranges, an MVP for a regulated company costs $100,000 to $500,000 and takes 10 to 20 weeks from the start of discovery to launch, followed by a pilot of 6 to 12 weeks that decides whether to scale, iterate, pivot, or stop.
Eric Ries, who popularized the term, defines the MVP as "that version of a new product which allows a team to collect the maximum amount of validated learning about customers with the least effort." This guide turns that into a scope, a gated process, cost ranges consistent with our custom software development cost guide, the extra work regulated and AI MVPs need, and thresholds for the decision that follows.
MVP vs proof of concept vs prototype vs pilot
The four terms answer different questions, and confusing them is how teams spend MVP money on a demo. A proof of concept asks whether something can be built, a prototype asks whether users understand the design, an MVP asks whether real users get value from working software, and a pilot asks whether it holds up in operations at a defined scale.
| Stage | Question it answers | Audience | Fidelity | Typical duration | What you keep afterward |
|---|---|---|---|---|---|
| Proof of concept | Can this work with our data and systems? | Engineers and architects | A narrow technical spike, often throwaway code | 2 to 6 weeks | The answer, the risks it surfaced, and sometimes an integration pattern |
| Prototype | Do users understand the design and want the flow? | Target users in moderated tests | Clickable screens or a mock front end | 2 to 4 weeks | Validated designs and usability findings; the code is thrown away |
| MVP | Do real users get value from working software doing one job? | A small group of real users doing real work | Production-quality code for one workflow | 6 to 12 weeks of build | The code base, usage data, and evidence for the scale decision |
| Pilot | Does it hold up in operations at a defined scale? | A business unit, region, or customer segment | The MVP hardened, with support and monitoring | 6 to 12 weeks | Operating evidence, unit costs, and a go or no-go decision |
The durations are BD Emerson planning ranges. The UK government's Service Manual runs the same sequence at a larger scale: it calls 4 to 8 weeks typical for discovery, says alphas usually last 6 to 8 weeks and that teams should expect to throw away alpha code, and starts the beta phase by inviting a limited number of people to use the service. Our ranges run shorter because an MVP tests one workflow.
How to scope an MVP
Scope an MVP backward from the assumption most likely to sink the product. Five decisions, made in this order during discovery, keep the first release small enough to finish and sharp enough to teach you something.
| Decision | The question | A good answer | A warning sign |
|---|---|---|---|
| The problem | Whose problem, how often, and what does it cost today? | A measured baseline, such as 18 minutes of manual entry per claim | Users want a modern experience |
| The riskiest assumption | Which belief, if wrong, kills the product? | One testable statement with a threshold | Five assumptions tested at once |
| The one workflow | Which single path from trigger to outcome tests that belief? | One user type, one trigger, one result | A feature list |
| Success metrics | What number, by when, says it worked? | A primary metric with a target, plus guardrail metrics | Metrics chosen after launch |
| What to leave out | What can wait without weakening the test? | A written out-of-scope list the sponsor signs | A first phase that includes everything |
Rank assumptions by how likely they are to be wrong and how much damage being wrong would do, then test the top one first. We sort them into four kinds: desirability (will users choose it), feasibility (can we build it with our data and systems), viability (do the unit economics work), and, for regulated companies, permissibility (will compliance, legal, and risk let us run it on real data). Permissibility is the one first releases forget, and it is cheap to test early: a two-page data flow reviewed by the privacy officer or model risk team in week two costs far less than a redesign in week ten. Leave out anything that does not touch the riskiest assumption, including secondary user types, reporting, administration screens a spreadsheet can stand in for, and integrations a person can bridge by hand during the pilot.
The MVP development process, step by step
An MVP moves through five stages with a gate at the end of each, and each gate asks the one question the next stage depends on. The durations are BD Emerson planning ranges for a regulated company.
| Stage | Duration | What happens | Gate question |
|---|---|---|---|
| 1. Discovery | 2 to 6 weeks; an MVP usually needs 2 to 4 | Baseline the problem, rank assumptions, map the data flow, write the out-of-scope list | Is the problem real, measured, and worth solving? |
| 2. Prototype and assumption tests | 2 to 4 weeks | Test the riskiest assumption with clickable screens, a data spike, or a manual run of the service | Is the riskiest assumption still standing? |
| 3. Build | 6 to 12 weeks in two-week sprints | Build one workflow to production standards, with tests, logging, and access controls | Does it meet the acceptance criteria? |
| 4. Launch readiness | 1 to 3 weeks, overlapping the build | Penetration test, privacy review, vendor risk evidence, runbook, rollback plan | Is it safe for real users and real data? |
| 5. Pilot | 6 to 12 weeks | Real users do real work while the team tracks the metrics weekly | Did the metric move enough to scale? |
Discovery sits at the short end of the 2-to-6-week range we use for custom builds because an MVP covers one workflow. A manual run, where people perform the service behind a simple front end, often tests demand faster than code. If an outside firm will build the MVP, our guide to software development outsourcing covers the engagement models and the contract terms to set before the first sprint.
How much does MVP development cost?
MVP development costs $100,000 to $500,000 in BD Emerson's planning ranges for regulated companies as of September 2026, and the type of MVP sets the band. The formula is the one our cost guide uses: team size times blended hourly rate times duration, plus security testing and contingency.
| Type | Typical scope | Team and duration | Cost (BD Emerson planning range) | What moves it |
|---|---|---|---|---|
| Clickable prototype, for reference | Screens for one workflow, tested with target users | 2 people, 2 to 4 weeks | $20,000 to $60,000 | Number of flows and test rounds |
| Technical proof of concept, for reference | One integration or data question answered in code | 1 to 2 engineers, 2 to 6 weeks | $15,000 to $90,000 | Access to real systems and data |
| Internal workflow MVP | One department, one workflow, single sign-on, one or two integrations | 2 to 4 people, 10 to 16 weeks | $100,000 to $300,000 | Integration count, approval rules, audit logging |
| Customer-facing web MVP | Customer accounts, one core transaction, web only, accessibility | 3 to 4 people, 14 to 20 weeks | $200,000 to $500,000 | Identity, payments, core system APIs |
| AI MVP | A prompted model or retrieval over governed content for one workflow, with an evaluation set | 2 to 4 people, 10 to 18 weeks | $100,000 to $350,000 | Evaluation depth, data preparation, approval design |
The MVP ranges cover discovery through launch at blended rates of $120 to $175 an hour, assume AI-assisted delivery, and include a penetration test. The bands assume typical combinations of team size, schedule, and rate; a quote that multiplies out near the top of every input at once, such as four people for 16 weeks at $175 an hour, usually means the scope has grown past one workflow. They overlap the lower half of the full-build ranges in our cost guide, where an internal workflow tool runs $150,000 to $600,000 and a customer-facing app $250,000 to $1.5 million, because an MVP covers one workflow instead of a department's worth of them. The AI band sits between the ranges our custom AI development guide gives for a prompted feature, $50,000 to $200,000, and a retrieval assistant, $150,000 to $500,000.
What changes for an MVP in a regulated industry
A regulated MVP needs the controls that let real users touch real data, even when the feature set is small. Plan them into the schedule, because each has a lead time that can outlast the sprint that needs it.
| Area | What the MVP needs before real users | Rule or standard |
|---|---|---|
| Security | Secure development practices, code review, and a penetration test before external users | NIST SP 800-218 practices PW.7 and PW.8 |
| Test data | Synthetic or de-identified data for build and test, with real data only in the pilot environment | HHS de-identification guidance: Safe Harbor or Expert Determination under 45 CFR 164.514(b) |
| Audit trails | A log of who viewed, changed, approved, or overrode each record and decision | HIPAA audit controls, 45 CFR 164.312(b) |
| Vendor risk review | Due diligence on the build vendor and every service in the stack before pilot data flows | Interagency third-party guidance for banks; 16 CFR 314.4(f) for non-bank financial institutions |
| Business associate terms | A business associate agreement with any vendor that handles protected health information | 45 CFR 160.103 |
| Data handling | Retention, deletion, and access rules for pilot data, written before launch | Your records and privacy policies |
Vendor risk review is the item that most often moves an MVP launch date. The Interagency Guidance on Third-Party Relationships expects banks to conduct due diligence before entering a third-party relationship, scaled to the risk, and a pilot that sends customer data to a new vendor or cloud service starts such a relationship. Start the review in discovery, hand the reviewers the data flow and the vendor list, and treat their questions as requirements. For health data, Safe Harbor's 18 identifier categories make a practical checklist for test data.
What changes for an AI MVP
An AI MVP adds three things to the build: an evaluation set that defines good output, guardrails that enforce it, and a cost per call that shows whether the unit economics survive scale.
Build the evaluation set before the model work starts. Our custom AI development guide puts a useful set at 200 to 500 real cases with expected outcomes written by domain experts, and 100 to 300 labeled cases can carry a prompted feature. Score accuracy, groundedness, policy adherence, and cost against thresholds the business owner signs before the first run, and rerun the set on every prompt, model, or retrieval change.
Map the guardrails to the OWASP Top 10 for LLM Applications 2025: treat retrieved and user content as untrusted against prompt injection (LLM01), enforce each user's entitlements against sensitive information disclosure (LLM02), keep tools least-privileged with human approval for consequential actions against excessive agency (LLM06), and cap spend and loops against unbounded consumption (LLM10).
Cost per call is input tokens times the input price plus output tokens times the output price. At an assumed $2 per million input tokens and $10 per million output tokens, a call that sends 8,000 tokens and returns 800 costs (8,000 × $2 + 800 × $10) ÷ 1,000,000 = $0.024. At 2,000 calls a month that is $48, so at MVP volume the evaluation and review labor costs far more than the model. Run the same arithmetic at your scale volume before the decision gate: at a million calls a month the same feature costs $24,000.
How to decide after the MVP: scale, iterate, pivot, or stop
Decide with thresholds written down before the pilot starts, because a team that sets the bar after seeing the data will clear it. BD Emerson's decision rule uses the primary metric's target, the guardrail metrics, and at most two pilot cycles.
| Decision | Threshold | What happens next |
|---|---|---|
| Scale | The primary metric meets its target for four consecutive weeks, guardrail metrics hold, no high-severity security finding is open, and unit cost sits below the value per transaction | Fund the full build, starting with what you left out |
| Iterate | The primary metric reaches 60 to 99 percent of target and improves week over week | One more cycle of 4 to 6 weeks on the weakest step, two cycles at most |
| Pivot | Users engage, but the metric misses because the workflow, user group, or framing was wrong | Return to discovery with the evidence and a new riskiest assumption |
| Stop | Below 60 percent of target after two cycles, a blocking compliance finding, or unit cost above value with no path down | Close it, and keep the learning and any reusable components |
Stopping counts as a result. The UK Service Manual treats stopping at the end of discovery as the right outcome when research shows a service is not viable or worth the cost, and the same logic holds after a pilot. If the answer is scale, revisit build versus buy for the full product, because a working MVP sometimes shows the job is common enough for a product to cover; our analysis of custom software vs off-the-shelf covers that test, and our build vs buy framework prices both paths.
Worked example: an illustrative MVP scope and budget
This example is fictional and illustrative. A regional auto insurer wants to cut the time adjusters spend keying first notice of loss reports, the initial claim reports that arrive by email with photos and police reports attached.
| Element | Decision |
|---|---|
| Problem | Adjusters spend a measured 18 minutes keying each emailed auto claim, about 2,000 claims a month |
| Riskiest assumption | An AI extraction step can draft the 14 required claim fields at 95 percent field accuracy or better, and adjusters will accept the drafts |
| One workflow | An email arrives, the MVP drafts the claim record, an adjuster reviews and approves it, and the record goes to the claims system through one existing API |
| Success metrics | Median handling time under 8 minutes; 80 percent of drafted fields accepted without edits; no cross-claim data exposure in security testing; cost per claim under $0.10 |
| Controls | The insurer's vendor risk team reviews the model provider in discovery; pilot data covers one region; every edit and approval is logged |
| Left out | Other lines of business, mobile capture, fraud scoring, claim creation without review, and reporting dashboards |
The budget applies the cost formula to a team of three full-time equivalents: a tech lead who also handles the AI engineering, a full-stack engineer, a half-time QA and evaluation engineer, and a designer and a security engineer at a quarter each.
| Cost line | Inputs | Cost |
|---|---|---|
| Discovery and assumption tests | 2 people × 4 weeks × 40 hours × $175 | $56,000 |
| Build and launch readiness | 3 full-time equivalents × 10 weeks × 40 hours × $150 | $180,000 |
| Penetration test | Web application and API, inside our cost guide's $8,000 to $30,000 range | $15,000 |
| Pilot hosting and monitoring | 3 months × $2,000 | $6,000 |
| Model usage | 2,000 claims × 3 months × $0.024, plus 30 evaluation runs of 300 cases | $360 |
| Contingency | 15% of the build line | $27,000 |
| Total | Sum of the lines | $284,360 |
The MVP launches in week 14 and reaches its decision in week 22, after an 8-week pilot. The insurer's own time sits outside the budget: about 75 hours of adjuster time to label 300 evaluation cases at 15 minutes each, and a product owner at half time. The model bill is 0.13 percent of the total. If the pilot clears its thresholds, the scale case saves about 333 adjuster hours a month (2,000 claims × 10 minutes), which is the number the full build has to beat.
Frequently asked questions
What is MVP development? MVP development is building the smallest working version of a product that real users can use, built to test whether it solves their problem before you invest in the full build. An MVP covers one workflow, runs on production-quality code, and is measured against a success metric set before launch, so the pilot that follows can decide whether to scale, iterate, pivot, or stop.
What is the difference between a proof of concept and an MVP? A proof of concept answers whether something can be built with your data and systems, usually in 2 to 6 weeks of throwaway code for engineers. An MVP answers whether real users get value from working software, so it runs on production-quality code for one workflow, takes 6 to 12 weeks to build, and gives you a code base to keep.
How much does MVP development cost? In BD Emerson's 2026 planning ranges for regulated companies, an internal workflow MVP costs $100,000 to $300,000, a customer-facing web MVP $200,000 to $500,000, and an AI MVP $100,000 to $350,000, from discovery through launch. Team size, blended rate, duration, integrations, and evaluation depth set the position in each range.
How long does it take to build an MVP? An MVP takes 10 to 20 weeks from the start of discovery to launch in BD Emerson's planning: 2 to 4 weeks of discovery, 2 to 4 weeks of prototype and assumption tests, and 6 to 12 weeks of build. A pilot of 6 to 12 weeks follows before the decision to scale, iterate, pivot, or stop.
What should an MVP include? An MVP should include one workflow that tests your riskiest assumption from trigger to outcome, the security and audit controls real users and data require, and the instrumentation to measure a primary metric and guardrail metrics. Leave out secondary user types, reporting, administration screens a spreadsheet can replace, and integrations a person can bridge by hand during the pilot.
Can a regulated company run an MVP with real customer data? Yes, once the controls are in place: secure development practices and a penetration test, audit logging, retention and deletion rules, a vendor risk review of every service in the stack, and a business associate agreement where protected health information is involved. Build and test on synthetic or de-identified data, and admit real data only in the pilot environment.
What happens after an MVP? The pilot results decide one of four paths against thresholds set before launch. Scale when the primary metric meets its target for four consecutive weeks and guardrails hold, iterate when it reaches 60 to 99 percent of target and is improving, pivot when users engage but the framing was wrong, and stop below 60 percent after two cycles.
If you're scoping a first release, our custom software development team can run the discovery, rank the assumptions with you, and hand back an MVP scope and budget in roles, hours, and rates before any build starts.
About the author
