FROM AI IDEA TO BUSINESS SOFTWARE
How do I test whether my AI-built app does the right thing?
Test the task, not just the screen.
Start with a real task and write the expected result before running the test. Check normal cases as well as errors, interruptions and different permissions. The AI tool reporting passing tests is not enough on its own to establish business value or security.
Choose a small workflow and expected result
Use test data and an environment where failures cannot harm the business. Choose a task such as creating and approving an order. Specify what should be saved, who may see it and what should be sent onwards. Have a user confirm the result is correct.
Try five kinds of situation
| Test | Example | What to establish |
|---|---|---|
| Normal workflow | Create and approve a test order. | Are correct details saved and can the task be completed? |
| Invalid input | Leave a required field empty or enter an unreasonable quantity. | Are errors prevented clearly, including in the underlying logic? |
| Different roles | Try as a clerk, administrator and signed-out visitor. | Can each role see and do only what it should? |
| Interruption and double submission | Interrupt a transfer or send the same order twice. | Are failures detected and unintended duplicates avoided? |
| A change | Change a small feature and rerun the main workflow. | Does earlier behaviour still work? |
Get help with what you cannot verify yourself
You can check whether the task is easier, results are understandable and a known example is calculated correctly. A technical reviewer should add checks for server-side permissions, secrets, data protection, dependencies and integrations. A screen denying access does not establish protection of the data behind it. Only test systems and accounts you are authorised to review.
A working interface does not itself establish that permissions and data are protected.
Keep evidence and agree on the next action
Record the version, test data, expected result, actual result and any defects. A failed test needs an action and a retest after a fix. Automate recurring checks where useful, while letting the business assess whether the workflow produces the right result. Completing a test list is not a full security review.
Built with AI, or using AI at runtime?
An app can be built with AI without using AI while running. If it also generates answers, interprets documents or supports AI-based decisions, test incorrect outputs, unsuitable inputs and how a person reviews the result. That assessment is additional to ordinary software testing.
PRACTICAL TEMPLATE
Copy: a test case
Use the headings as a starting point for your conversation. Leave secrets and customer records out of the document.
Version and test environment: Task, test data and user role: Steps: Expected result: Actual result and defects: Fix owner and retest date:Download template (.txt) ↓
Common questions
Can AI write the tests for me?
Yes, AI can propose and write tests. Check that expected results come from real requirements. Tests confirming the same incorrect assumption as the code provide weak assurance.
How many tests are needed?
There is no number that makes an app ready. Start with important workflows and consequences of failure. Adapt the scope to data, use and risks.
Sources and method
The review structure, examples and templates are Miller Development’s practical recommendations, informed by Sven Miller’s description of our approach. The references explain related principles; they do not validate these templates or certify a solution. Platform features and terms can change. This guide does not replace a review of your specific system.
OWASP ASVS provides a framework for technical security requirements and verification. Anthropic describes automated security reviews as a complement to existing security practices and manual review.
MILLER DEVELOPMENT
Want help taking the next step?
We help prioritise business value, review AI-built solutions and develop secure, stable systems integrated into your business. The next step may be a small test, a technical review or a bounded first delivery.
Talk to us ↗