Most AI proofs-of-concept fail to reach production not because the model is wrong, but because the delivery infrastructure around it was never built.
The model works. The demo convinces the stakeholders. Then it hits legal, or compliance, or the integration team — and stays there for months. The POC becomes a zombie: too far along to kill, too incomplete to ship.
The pattern is consistent enough to be worth documenting. Here is what the delivery infrastructure needs to look like, and how long it actually takes to build it.
Why POCs stall
A POC is designed to answer one question: can the model do this? It is a good question. But it answers the wrong one for production.
Production requires answers to a different set of questions:
- Can we explain what the model decided, and why, to a regulator?
- Can we demonstrate consistent behaviour across protected-characteristic inputs?
- Can we define and enforce an escalation path when the model is not confident?
- Can we prove, at any point, that the system is behaving as it did when it was approved?
None of these are model questions. They are system questions. And they require infrastructure that a POC, by design, does not have.
The four missing layers
In almost every stalled POC, the same four things are absent.
Audit trail. Every inference needs to be logged: input hash, output, confidence score, model version, timestamp. Without this, you cannot answer any retrospective question about what the system decided. Legal will not sign off without it. You cannot operate in a regulated environment without it.
Escalation architecture. Low-confidence outputs need to go somewhere. Not silently dropped. Not passed through with a quiet flag. A defined queue, a defined threshold, a defined owner for edge cases. This is not complex to build, but it must be designed deliberately.
Input validation. The model was trained on a distribution. Production data will include documents outside that distribution. What happens when they arrive? Silent failure is the default in most POCs. You need an explicit validation layer that catches anomalies before they reach the model, and routes them appropriately.
Regression testing. If you cannot demonstrate that the system's behaviour has not changed between deployments, you cannot safely deploy. This means a fixed test set, defined pass/fail criteria, and a process that runs the regression pack before every release. Not once, before launch — every release, forever.
The delivery framework
This is not a precise formula — every situation is different. But this is the structure that fits regulated AI contexts, and it is broadly consistent across them. A well-scoped engagement covering all four layers typically runs eight to sixteen weeks, depending on the complexity of the existing pipeline and governance requirements.
Weeks 1–2: Discovery and governance audit.
Structured review of the existing POC, the outstanding compliance requirements, and the data pipeline. The goal is not to produce a document — it is to identify the root-cause blockers and sequence the work correctly. Most stalled POCs have fewer than five specific blockers. Name them before you start.
Weeks 3–5: Governance layer.
Build the audit trail and the escalation architecture. These are not technically complex, but they require decisions that involve compliance and legal. Bring them into the design sessions now, not at the end. Their requirements should shape the architecture — the architecture should not be built first and then submitted for approval.
Weeks 6–9: Data pipeline hardening.
Input validation layer, PII handling aligned to the data processing agreement, edge-case routing for out-of-distribution documents. The goal is zero silent failures. This phase takes longer than people expect because the edge cases are often more varied than the initial data review suggests.
Weeks 10–12: Test strategy and execution.
Build the regression pack. Define the input distribution — not just random examples, but a representative sample that includes rare and edge-case inputs. Define pass/fail criteria per output type. Run the pack against the model. Benchmark against the manual baseline. This produces the evidence that legal sign-off requires.
Final phase: Staged production deployment.
Phased rollout: 10% of traffic, then 50%, then full volume. Run a parallel human review queue during the initial period. This is not because you expect failure — it is because it gives the client a clean rollback path, and it generates real-world performance data that strengthens the compliance submission.
What this does not include
This pattern does not include retraining the model. In stalled POCs that fit this pattern, the model is almost always adequate. The problem is never model accuracy — it is the absence of the governance layer.
If you are planning to spend your delivery budget improving model performance while the POC is blocked at legal review, you are solving the wrong problem.
The handover
Shipping to production is not the end of the engagement. The handover needs to include a runbook, a monitoring dashboard showing the metrics that matter (confidence distribution, escalation rate, drift indicators), and a defined protocol for retraining — including the conditions that trigger it, who owns it, and how the regression pack is extended to cover the new training data.
Without this, you have not delivered an AI system. You have delivered a dependency.
Applying this
If your POC is stuck, the first question to answer is: which of the four layers is missing? In most cases, it is all four — but one of them is the blocker that is most visible to the compliance team right now. Starting there, and making fast progress on it, often unblocks the whole review.
The pattern above is a starting point, not a prescription. The timeline compresses or extends depending on the complexity of the escalation architecture and the state of the existing data pipeline. But the sequence — governance first, then data hardening, then testing, then staged deployment — holds across the regulated AI contexts where this approach applies.
If you are looking at a POC that has been sitting in legal review for more than three months, it is not going to pass without the four layers. The good news is that building them, in a well-scoped engagement, takes less time than most people expect.