# Launch Gate Audit: the gates AI can't pass

> We take AI-built products through the gates AI can't pass: App Store review, security audit, and Australian regulation.

- URL: https://envisageapps.com.au/launch-gate-audit/
- Type: page

## The things your prototype can't tell you

Your app can work perfectly in a demo and still fail the tests that matter before real users arrive. We identify the technical, store, security and Australian regulatory gates that apply to your product — and tell you what needs to happen next.

### App Store review

Guideline 4.2.6, age-rating questionnaires, account deletion, privacy labels. A human reviewer decides, and the rejection reason is rarely the real one.

### Security audit

Penetration tests and CPS 234 control testing find the classes of bug that generated code reproduces at scale — auth, session handling, and access control.

### Australian regulation

TGA software-as-a-medical-device classification turns on intended use, not features. Get the wording wrong and you are selling an unapproved device.

### Customer & investor diligence

An enterprise security questionnaire or an investor's technical review reads your codebase before the contract is signed. The questions are standard. The wrong answers are expensive.

## What Launch Gate does

Five business days. You leave knowing which gates apply, what is blocking launch, and what the next step costs.

### Name the gates that apply

Not every app is a medical device, and not every app stores bank data. The audit identifies the technical, store, security and Australian regulatory gates your product actually has to clear — in writing.

### Test them where they fail

App Store review, auth and access control, real devices including three-year-old Android on a poor connection. The classes of bug generated code reproduces at scale, on hardware that is not your laptop.

### Split launch blockers from after-launch

The two-bucket report has no third bucket and no severity score to argue about. A senior engineer validates every finding, and the walkthrough call is where you check us on it.

### Quote what happens next

The audit ends in a fixed-price quote for the remediation it scoped. The fee is credited against that work within 60 days. You are not buying a rebuild until the numbers say you should.

AI makes software faster to produce. It doesn't make it ready to ship.

- **45%** — of AI-generated code introduced a known security weakness (source: Veracode, GenAI Code Security Report (2025))

- **84%** — of developers use or plan to use AI tools; 33% trust their output (source: Stack Overflow Developer Survey (2025))

- **1.93M** — apps rejected by Apple in 2024 (source: Apple App Store Transparency Report (2024))

## What happens if you don't use Launch Gate?

Most teams at this point are choosing between another round of prompting, a report-only security audit, or having someone actually take responsibility for getting the product through the gate.

| | Launch Gate | Another round of prompting | A report-only security audit |
|---|---|---|---|
| **Finds the bug classes generated code repeats** | Yes — Auth, session handling and access control — plus the mobile-specific classes a web test does not cover. | Partly — It will find some. The ones it reproduces most are the ones it is least likely to flag. | Yes — This is the core of the engagement, and they are good at it. |
| **Tests on real devices, old handsets, bad networks** | Yes — Real hardware, including three-year-old Android on a poor connection. | No — A simulator does not reproduce this class of failure. | No — Usually scoped to web and infrastructure. |
| **Answers an App Store rejection** | Yes — We have read these letters before, and we handle the resubmission. | Partly — It can suggest fixes from the guideline text. It cannot tell you which of three plausible causes was the real one. | No — Out of scope. |
| **Gives you a written classification position for the TGA** | Yes — Decided on intended use, in writing, before the build — something you can show an investor or a regulator. | No — It will answer confidently, and carry none of the liability for being wrong. | Partly — Regulatory practices exist, but usually as a separate engagement from the code work. |
| **Fixes what it finds** | Yes — The audit ends in a fixed-price quote for the remediation it scoped. | Partly — It will rewrite anything you ask. That is how several of the findings arrived. | No — Report only. Remediation is handed back to you. |
| **Submits through review inside your own developer account** | Yes — Guideline 4.2.6 requires it, and the listing is your asset, not ours. | No — Not something a coding tool can do for you. | No — Not a build or release service. |
| **Still here when your compliance comes up for renewal** | Yes — 25 years, founder-led, Brisbane. The team that quotes the work does the work. | No — The tool will have changed under you twice by then. | Yes — The firm will be, though rarely the same people. |

_● yes · ◐ partly · ○ no. “Partly” means the capability exists but is normally scoped out or passed to a third party — ask any provider, including us, to confirm their answer in writing. Comparison based on the defined Launch Gate scope and published App Store requirements._

## Which Australian rules could affect your app?

The TGA is the one people ask about. It is rarely the only one that applies, and the rest move faster — four of the dates below landed in 2026. The audit works out which of these your app is actually caught by, and what that means for the build.

### TGA — intended use, not features

Software-as-a-medical-device classification turns on intended use, not on the feature list. A symptom diary is not a medical device; the same app that suggests a treatment change usually is. Get the wording wrong and you are selling an unapproved device, which is why the wording review comes before the build.

### Privacy Act — and the December 2026 automated-decision rule

The Privacy and Other Legislation Amendment Act 2024 passed on 10 December 2024. The part most AI products miss commences in December 2026: if a computer program makes a decision using personal information, and that decision could reasonably be expected to significantly affect someone's rights or interests, your privacy policy has to say so. A second tranche of reforms is a stated government commitment with no bill and no timetable, so we scope against the law as it stands and tell you where it is moving.

### Age assurance — 9 September 2026 for app stores

The social media minimum age took effect on 10 December 2025 under Part 4A of the Online Safety Act 2021. The Phase 2 industry codes commenced 9 March 2026, and app distribution services must have age assurance in place before 18+ downloads by 9 September 2026. Apple has been enforcing its own version in Australia since 24 February 2026 and publishes a Declared Age Range API — but Apple confirming an adult at the storefront does not discharge an obligation your app carries itself. Self-declaration alone is not sufficient, and government ID cannot be the only route you offer.

### Consumer Data Right, if you touch bank data

Reading a consumer's banking or energy data under the CDR means being an accredited data recipient, accredited by the ACCC, or riding on someone else's accreditation through a sanctioned intermediary model. Which one you have chosen is a question an investor's technical review will ask. Non-bank lending data comes into the regime on 9 November 2026.

### Accessibility — WCAG 2.2 AA, and why it has no commencement date

There is no Australian statute that says "comply with WCAG". There is the Disability Discrimination Act 1992, under which an inaccessible digital service can be unlawful discrimination, and the Australian Human Rights Commission's 2025 guidance naming WCAG 2.2 Level AA as the benchmark. So it is not a deadline you can miss — it is the standard a complaint would be measured against, on any public-facing product, from the day it ships.

## What lands in the report

Every finding traces to a file, a test, or something we observed on a real device — never a generality about AI code. A senior engineer validates every finding, and the walkthrough call is where you check us on it.

The report uses the same words this page does, and they mean one thing each: a [launch gate](/lexicon/#launch-gate) is any check standing between working code and real users, and the [two-bucket report](/lexicon/#two-bucket-report) splits what comes back into launch blockers and after-launch, with no third bucket and no severity score to argue about.

## Two ways in, both priced before you call

What it costs

The number is on the page because it does the qualifying for you. Nobody has to ask what your budget is, and you do not have to guess whether this conversation is worth having.

### Launch Gate Audit

The fixed-scope diagnostic. You get a decision, not a document.

**$3,500–$5,500** AUD fixed · 5 business days

_Fee credited against remediation within 60 days_

- App Store review — 4.2, 2.5.2, 5.1.1, and Play's 12-tester wall
- Security review — auth, session handling, access control, secrets
- Australian regulation — which of TGA, Privacy Act, CDR, age assurance and WCAG 2.2 AA your app is bound by
- Real devices, not simulators
- Two-bucket report: launch blockers and after-launch
- A senior engineer validates every finding
- Walkthrough call, and a fixed-price quote for the remediation

[Book a Launch Gate Audit](https://cal.com/nchallen/book)

### Production Hardening

The remediation the audit scoped. Quoted from the findings, never from a guess.

**from $30,000** AUD fixed

_Scoped by the audit before it is quoted_

- Native work where the wrapper fails — push, offline, Keychain and Keystore
- StoreKit with server-side receipt validation
- Submission managed inside your developer account
- 30-day post-launch fix warranty

[Book a call](/contact-app-developer/)

_If the store rejects work we performed, we keep working at no additional cost — or we tell you in writing why it can't pass. We do not guarantee approval, and an approval guarantee is a representation nobody can control._

## Common questions

### Can you guarantee my app passes App Store review?

No, and be careful of anyone who does — an approval guarantee is a representation you cannot control, which is a problem under Australian Consumer Law. What we offer instead is scoped: if the store rejects work we performed, we keep working at no cost, or we tell you in writing why it can't pass.

### We built it with AI. Will you work on it?

Yes. That is most of what we do now. We treat the codebase as inherited rather than suspect, run a fixed-scope audit first, and split findings into launch blockers and after-launch work so you know what actually stands between you and shipping.

### It's a web app, not an App Store app. Does the audit still apply?

Yes. The store-review items drop out; the security review, access control, infrastructure and — where it applies — TGA classification remain. Scope is set on the walkthrough call before you pay, and the price band is the same.

### My app isn't social media. Do the age assurance rules still reach it?

Age assurance reaches past social media, so it may well apply. The social media minimum age itself is narrow, but the Phase 2 industry codes go further — app distribution services have to age-assure 18+ downloads from 9 September 2026, and Apple has been enforcing its own version in Australia since 24 February 2026. If your app is rated 18+, or handles material that would be, the storefront's check is not the same as the one you may owe your own users. Working out which obligation is the platform's and which is yours is part of the audit.

### Does my app need TGA approval?

It depends on intended use, not on features. A symptom diary is not a medical device; the same app that suggests a treatment change usually is. The distinction is in how you describe what the software is for, which is why the wording review comes before the build.

### Who owns the developer account?

You do, always. Apple guideline 4.2.6 rejects apps published from an agency's account on the client's behalf, and it is your asset regardless. We work inside your account.

## Not ready to put it in a calendar

Or write instead

Some things are easier to type than to say out loud on a first call — a rejection letter you have read four times, or a codebase you did not write. Five questions, and a person answers.

- Your name
- Business email
- Where it lives now — an App Store or Play listing, a TestFlight link, or a URL (optional)
- What is blocking it
- Where you are up to — self-funded, raised a round, trading business, or not sure yet

_Marisol reads these. One business day._