An agent that drafts a response is a smaller project than one that changes customer records and sends that response. List the actions it may take, the information it may use, and the decisions a person must approve. That list makes cost comparisons clearer.
Autonomy is a major scope driver. A read-only research assistant and an agent that updates records, sends messages, or triggers transactions need different permissions, safeguards, evaluation depth, incident response, and recovery. Estimate the authority boundary before comparing technologies or provider quotes.
Related service: AI & Automation services- 01Define one agent objective, user, task boundary, authority level, and completion test.
- 02Inventory data, knowledge, tools, permissions, workflow states, and exceptions.
- 03Create the architecture, threat model, evaluation plan, and technical baseline.
- 04Break delivery into work packages with dependencies, assumptions, and exclusions.
- 05Estimate low, expected, and high build and recurring scenarios.
- 06Validate the riskiest assumptions in a controlled thin slice.
- 07Replace estimates with actual quality, review, usage, failure, and support data after the pilot.
SECTION 02
Define the agent level before estimating
The word agent can describe a chat interface, a retrieval assistant, a tool-using workflow, or a long-running system coordinating several actions. Write the proposed objective, allowed information, allowed actions, user, review point, stop condition, and prohibited outcomes in plain language. Without that boundary, two estimates may price entirely different systems.
| Level | Typical capability | Additional engineering and control work |
|---|---|---|
| Answer | Respond from provided or retrieved context | Corpus governance, access filtering, groundedness and no-answer evaluation |
| Prepare | Classify, extract, summarize, compare, or draft a record | Structured output, validation, reviewer UX, correction capture |
| Recommend | Choose a proposed next step from permitted options | Policy representation, decision explanation, scenario and boundary tests |
| Act with approval | Call tools after a person approves the exact action | Identity, tool schemas, approval binding, idempotency, audit, recovery |
| Act within policy | Choose and execute bounded low-risk actions | Stronger policy enforcement, limits, monitoring, adversarial tests, kill switch |
| Coordinate | Plan across several tools, tasks, or agents | State, delegation boundaries, loop limits, conflict handling, trace analysis |
SECTION 03
Use eight work packages for a production estimate
Each package should name deliverables, dependencies, agreed test results, assumptions, and an owner. The work can overlap, but omitting a package does not make its responsibility disappear. The U.S. GAO's cost-estimating guidance supports using a technical baseline, work breakdown, assumptions, risk analysis, and actual-cost updates to produce a more reliable estimate.
| Package | Representative deliverables | Main uncertainty |
|---|---|---|
| 1. Discovery | Process map, user and objective, baseline, scope, exceptions | Tacit work, conflicting policy, unowned exceptions |
| 2. Product and workflow | Interaction, states, approvals, notifications, human handoff | User adoption, incomplete inputs, workflow variants |
| 3. Model and knowledge | Model baseline, prompts, retrieval, structured outputs | Task quality, source condition, context and latency |
| 4. Tools and integrations | Schemas, authentication, mappings, retries, reconciliation | API quality, legacy systems, test access, rate limits |
| 5. Identity and security | Least privilege, secrets, tenant isolation, threat controls, audit | Sensitive data and consequence of action |
| 6. Evaluation and QA | Datasets, graders, end-to-end, adversarial, performance, acceptance | Ground truth, rare cases, reviewer agreement |
| 7. Production operations | Environments, deployment, monitoring, limits, recovery, runbooks | Service level, volume, dependency behavior |
| 8. Adoption and improvement | Training, support, feedback, regression and change process | Review effort, policy change, model and source drift |
SECTION 04
Price data and integrations from evidence
For data, estimate source inventory, access, parsing, cleaning, metadata, deduplication, versioning, permissions, retention, deletion, indexing, and update frequency. A small collection of inconsistent or scanned documents can require more work than a large, structured, well-owned repository. Request a representative sample before estimating ingestion quality.
For every tool, define the operation, user authority, inputs, outputs, error states, test environment, limits, and system owner. Read operations are generally easier to contain than writes; writes require validation, idempotency, reconciliation, audit, and recovery. Browser-driven automation is often more fragile than a supported API and should carry a maintenance assumption.
SECTION 05
Budget evaluation and security as build work
An agent can produce plausible text while selecting the wrong tool, using disallowed data, failing to stop, or completing only part of the task. Evaluation therefore needs representative cases, expected outcomes or rubrics, held-out tests, tool and permission checks, failure simulation, adversarial inputs, human-review design, and regression runs across changes.
OWASP's agentic guidance and LLM risk work emphasize prompt injection, excessive agency, unsafe output use, data exposure, and unbounded resource consumption. Budget architecture and tests for minimum permissions, tool allowlists, structured validation, spending and loop limits, approval, monitoring, and rapid disablement. These are production requirements, not optional polish.
Dataset cost
Collect, de-identify, label, review, version, and maintain representative and difficult cases.
Grading cost
Build deterministic checks, expert rubrics, model graders where suitable, and disagreement resolution.
System test cost
Test retrieval, tools, state, failures, permissions, latency, and duplicate behavior end to end.
Continuous cost
Rerun regressions and investigate production failures when any component changes.
SECTION 06
Model recurring unit cost and support
Recurring technical cost can include model and embedding usage, tool calls, cloud compute, storage, databases, queues, monitoring, security, data processing, and third-party subscriptions. Agent loops may make a variable number of calls, so measure the distribution of steps per completed task rather than assuming one request equals one unit.
Add human review, exception handling, support, incident response, content updates, integration maintenance, model changes, evaluation, and product improvement. Calculate cost per correctly completed task and cost per useful business outcome. Track expensive failures and abandoned runs separately so an average does not hide waste.
| Input | Formula | Measurement source |
|---|---|---|
| Model usage | Average model usage per run × runs | Traces and provider billing |
| Tool and platform usage | Per-call or allocated infrastructure cost | Tool logs and cloud billing |
| Review | Review minutes × loaded labor rate | Approval and correction log |
| Exceptions | Exception handling minutes × loaded labor rate | Exception queue outcomes |
| Support and maintenance | Allocated monthly operating work | Time records and change log |
| Correctly completed units | Accepted outcomes excluding duplicate or abandoned work | System-of-record reconciliation |
SECTION 07
Request an estimate that exposes uncertainty and ownership
A useful proposal maps cost to the work packages, identifies assumptions and exclusions, separates build and recurring cost, and offers a validation plan for uncertain dependencies. It defines the models, providers, environments, accounts, source repositories, data, prompts, evaluation assets, and documentation that the business will own or be able to export.
Ask for low, expected, and high scenarios and the variables behind them. Confirm who pays model and cloud costs, how changes are estimated, what support includes, and which agreed test results releases a milestone. If a broad agent cannot be estimated responsibly, scope a discovery and thin-slice pilot rather than buying certainty that does not exist.
SECTION 08
Frequently asked questions
How much does it cost to develop an AI agent?
Our illustrative agent budgets range from $4,800–$9,504 for a read-only assistant to $21,000–$41,580 for a three-tool workflow, using stated hours, the U.S. AI-company rate band and a 20% reserve. These are not surveyed averages or Catapult offers. Data cleanup, usage, review and support need separate allowances.
What makes an AI agent expensive to build?
Major drivers include broad or ambiguous scope, sensitive or poor-quality data, many or fragile integrations, high action authority, difficult-to-verify outcomes, strict latency or availability, complex permissions, and extensive exception or compliance needs.
Is model API usage the main AI agent cost?
Usually it is only one recurring input. Development and operation also include application engineering, retrieval or data work, integrations, security, evaluation, monitoring, human review, exceptions, support, and continuous changes.
How can an AI agent project control cost?
Choose one bounded objective, the lowest useful authority, few stable tools, representative data, and explicit acceptance tests. Validate the riskiest vertical slice first and expand one data, tool, workflow, or authority boundary at a time.
PRIMARY REFERENCES
Sources and further reading
These references cover the standards, platforms, or published prices discussed in the guide. Worked examples and checklists are our editorial guidance.
- AI development market rates — checked September 20, 2026Clutch
- Cost Estimating and Assessment GuideU.S. Government Accountability Office
- Agentic AI – Threats and MitigationsOWASP GenAI Security Project
- OWASP Top 10 for LLM and GenAIOWASP GenAI Security Project
- AI Risk Management FrameworkNational Institute of Standards and Technology
- Working with evalsOpenAI
- Agents SDKOpenAI
EDITORIAL METHOD
About this guide
We use AI to assist with drafting and editing. Catapult AI Work is responsible for the published content. Examples illustrate possible approaches; they are not client case studies unless identified as such.
Budget examples are not Catapult package prices. Check linked provider pages for current fees and plan limits before making a purchase.
Read the editorial policy