Skip to main content
Buyer guide for UK businesses

How to Choose a Software Development Company: A UK Buyer's Guide

By Obaid Tariq, Founder & Lead Engineer · Published

Disclosure: AI Dev Planner is a software development company, so we are one of the companies you might evaluate. Use the scorecard below on us exactly as you would on anyone else. See our disclosure policy. This guide is general information, not legal advice.

The short answer

Write a one-page brief, send it to three companies, and judge them on evidence you can check rather than on the pitch: live products, past clients you speak to yourself, a discovery phase with written outputs, and an estimate that lists its assumptions. Before you sign, make sure the contract assigns the IP to you in writing, the code lives in your repository from day one, and there is a clear way out.

This guide assumes you have already decided to hire a company. If you are still choosing between a freelancer, an agency and an in-house hire, start with our agency vs freelancer vs in-house comparison. If you are considering a team outside the UK, our guide to offshore software development for UK businesses covers time zones and international data transfers.

1. Before you shortlist: write the brief

The quality of the answers you get depends on the quality of the brief you send. Companies cannot be compared if each one is quoting for a different product it has imagined. One page is enough if it covers:

  • The problem and the users. Who uses the software and what they do today instead.
  • The one core workflow the first version must handle end to end.
  • Integrations. Payment providers, CRMs, accounting systems, existing databases.
  • Data. Whether the product will hold personal data, and whether any of it is sensitive, because that changes the contract you need.
  • Constraints. A real deadline, if you have one, and why.
  • A budget range. Companies scope differently for £30,000 and £150,000. If you do not know what is realistic, the UK MVP cost calculator gives an indicative range before you talk to anyone.

If you already have a prototype built with an AI coding tool such as Lovable, Bolt or Cursor, run it through the production readiness checker first, so you can tell companies what needs fixing rather than asking them to guess.

2. Shortlisting signals

Aim for three companies. These signals are cheap to check from the outside and filter out most poor fits before you spend time on calls.

  1. They have built something shaped like your product

    Not the same industry, necessarily, but the same kind of problem: a multi-tenant SaaS, a customer portal with a CRM sync, an internal tool replacing spreadsheets, an AI feature over private documents. Ask which past project is closest and why.

  2. They name who will do the work

    You should know who leads the engineering, who you talk to day to day, and whether any part of the work goes to a subcontractor. A company that cannot say this before you sign usually cannot guarantee it after.

  3. They publish how they work

    A described process, indicative price ranges or a sample contract on their website are not proof of quality, but they show a company willing to be held to something specific.

  4. The company is real and current

    For a UK company, search the Companies House register to check the company exists, is active and is filing accounts. Companies House itself says it does not check the accuracy of what companies file, so treat the register as a starting point. For a supplier outside the UK, ask for the equivalent registration in their country.

  5. Their first reply asks questions

    A good partner responds to a brief with questions about users, data, integrations and deadlines. A detailed fixed quote that arrives within hours of a one-paragraph brief was not built from your brief.

Source: Companies House company search (accessed 16 October 2026).

3. Evidence to request, and how to check it

Anyone can write a good proposal. Ask each shortlisted company for evidence, and check it rather than reading it.

Case studies

Ask which case study is closest to your project, then ask to see the live product. Ask what the company built and what the client’s own team built, because “we worked on” can mean anything from the whole product to one screen. Many client projects are under non-disclosure agreements, which is legitimate; in that case ask for an architecture walk-through on a call, where the engineers explain the decisions they made and why. People who did the work can answer follow-up questions; people repeating a case study cannot.

References

Speak to two past clients yourself, ideally one whose project finished at least a year ago, so you hear how the software held up. Useful questions: what went wrong, and how did the company tell you? Did the final cost match the estimate, and if not, why? Could you, or another team, take over the code?

Reviews on directories

Directory reviews are a useful signal but not proof. Clutch, for example, says its verification confirms a reviewer’s identity and work history, and that it publishes reviews it cannot fully verify, labelled as not verified (Clutch Help Center, accessed 16 October 2026). Read what each review says about the project, not just the star rating.

Working documents

Ask for a sample of what you would actually receive: an anonymised discovery document, an estimate with its assumptions, a sprint demo recording or a release note. Ask for their standard contract early, so your adviser can read it while you are still comparing, not after you have chosen.

Security certificates

If a company says it holds a certification, check it. The NCSC describes Cyber Essentials as the minimum standard of cyber security the Government recommends for organisations of all sizes, and points to its delivery partner’s website for a search of current certificates (NCSC Cyber Essentials overview, accessed 16 October 2026). A certificate is a baseline for the company’s own systems; it does not tell you how securely it writes your software, so still ask the security questions below.

4. Questions to ask a software development company

Ask every shortlisted company the same questions, ideally in writing, so you can compare answers side by side. Vague answers are themselves an answer.

Team and continuity

  • Who exactly will work on our project, and what will each person do?
  • Will any part of the work be subcontracted, and to whom?
  • What happens if a key person leaves or falls ill during the project?

Scope and estimates

  • What does your discovery phase produce, and do we own those documents if we stop there?
  • What assumptions sit behind this estimate, and which of them carry the most risk?
  • What is excluded from the price: hosting, licences, app store fees, maintenance?
  • How do you handle a change in scope mid-project, in writing and in money?

Delivery and quality

  • How often will we see working software, not status reports?
  • Will we have access to the code repository from the first day of the build?
  • What do you test automatically, and does every change go through code review?
  • How is the software deployed, and can we deploy it without you?

Security and data

  • Will your team need access to personal data, and if so, will you sign a controller-processor contract?
  • How do you store secrets and credentials, and who on your team can access production?
  • Do you hold any security certification, such as Cyber Essentials, and can we check it?

Ownership, exit and support

  • Does the contract assign copyright and other IP in the bespoke work to us, in writing?
  • Which pre-existing components or open-source libraries will the product depend on, and under what licences?
  • If we end the contract early, what do we receive, and how long does handover take?
  • What does the warranty cover after launch, for how long, and what does support cost after that?

5. Software development contract checklist

Most disputes with development companies are really disputes about what the contract did not say. Two points of UK law matter more than buyers expect.

Paying for code does not, by itself, make you its owner. GOV.UK guidance says the author or creator of a work is usually the first owner of the copyright in it, and that for commissioned work the first legal owner is the person or organisation that created it, not the commissioner, unless you agree otherwise in writing (GOV.UK, ownership of copyright works). Section 90(3) of the Copyright, Designs and Patents Act 1988 adds that an assignment of copyright is not effective unless it is in writing and signed by or on behalf of the assignor (legislation.gov.uk). So the contract needs a written assignment, not just a sentence in a proposal.

A supplier that processes personal data for you needs a written contract. The ICO explains that whenever a controller uses a processor there must be a written contract binding the processor, under Article 28 of the UK GDPR (ICO, when a contract is needed), and lists the minimum terms it must include, such as acting only on your documented instructions, security measures, rules on sub-processors, and deleting or returning data at the end (ICO, what the contract must include). The NCSC also advises building security considerations into contracting decisions and making sure contracts set out requirements for the return and deletion of your information (NCSC, supply chain security). All accessed 16 October 2026.

Software development contract checklist: what good looks like and the red flag for each clause
ClauseWhat good looks likeRed flag
IP assignmentA written assignment to you of copyright and other IP in the bespoke work, with the conditions and timing stated plainly.No assignment at all, a licence instead of ownership, or ownership tied to vague conditions you cannot check.
Pre-existing and third-party componentsA list of any reusable components the supplier keeps, with a perpetual licence for you to use them, and a list of open-source licences used.A core part of your product is the supplier's proprietary framework, licensed only while you remain a client.
Source code and accountsCode in a repository your business owns from day one; hosting, domains and third-party services in your name.You receive the code only at the end, or only as a zip file, or production runs in the supplier's cloud account.
EscrowOnly needed if the supplier keeps the code and licenses it to you; then, a named escrow arrangement with clear release triggers.Escrow offered as a substitute for owning the code you paid to have written.
Payment milestonesPayments tied to delivered, demonstrable increments or fixed sprints, with what each payment buys written down.A large upfront payment with no defined deliverable, or payments tied to calendar dates rather than delivered work.
Change controlA written process: the change, its effect on cost and timeline, and your approval before work starts.No change process, so every disagreement about scope turns into a dispute about the invoice.
AcceptanceAcceptance criteria for each deliverable and a fixed window for you to test and accept or reject it.Deliverables are deemed accepted on delivery, or acceptance is not defined.
Warranty and defectsA stated period after launch during which defects in delivered work are fixed at no charge, and a definition of a defect.No warranty, or every fix after launch billed as new work.
Termination and handoverEither side can end the contract on stated notice; you receive all code, documentation and credentials, and a handover period is defined.No right to terminate for convenience, or handover only after payments for work not yet done.
Data protectionIf the supplier processes personal data for you, a written controller-processor contract covering the ICO's minimum terms.The supplier will access production data but says a data processing agreement is unnecessary.
Security and subcontractingSecurity requirements written into the contract, including the return and deletion of your information, and subcontracting only with your consent.No security terms, and freedom to pass work or data to unnamed third parties.
Liability and insuranceLiability caps and insurance cover stated clearly enough for your adviser to judge whether they are proportionate.Liability excluded almost entirely, or the supplier will not say what insurance it holds.

This checklist helps you ask the right questions; it is not a substitute for a solicitor reading the actual contract, particularly the IP, liability and data protection clauses.

6. Delivery and communication signals

How a company proposes to run the project tells you more than its portfolio. Ask each one to show you, not describe, how these work on a current or recent project.

  • A discovery phase with written outputs

    Workflows, a data model, integration risks and a prioritised feature list, written down before the build is priced. You should be able to take these documents to another team.

  • Estimates that show their working

    A range or a fixed price with its assumptions listed, so you can see which unknowns would move the number. Precision without assumptions is a guess presented as a fact.

  • Working software on a fixed cadence

    A demo of running software every one or two weeks, on a staging environment you can use yourself. Slides and percentage-complete reports are not progress you can check.

  • Repository access from day one

    You can see every commit as it happens. It costs the supplier nothing, and it removes the most common cause of lock-in.

  • Automated tests and code review

    Ask to see the test suite running and a recent pull request with review comments. You do not need to judge the code yourself; you need evidence that someone other than its author does.

  • Automated deployment (CI/CD)

    Changes reach staging and production through a pipeline, not by someone copying files to a server. Ask whether your own team could deploy without the supplier.

  • Risks raised early, in writing

    A good partner tells you what is at risk before it becomes late. Ask what the last project's biggest problem was and when the client found out.

7. A weighted scorecard for comparing companies

Score each company from 1 to 5 on every criterion, multiply by the weight, and divide by 5 to get a score out of 100. The weights are our editorial starting point, not research findings: adjust them to your situation, but do it before you score anyone, not after.

One rule overrides the total: a score of 1 on ownership and contract terms, or on security and data protection, rules a company out however well it scores elsewhere. Those are the problems that are hardest to fix later.

Weighted evaluation scorecard for software development companies, with what a high and a low score look like
CriterionWeightScores 5 whenScores 1 when
Relevant, checkable evidence20Live products of a similar shape, and past clients who will talk to youScreenshots and logos only; no references
Scoping and estimate quality15Discovery with written outputs; estimate lists assumptions and exclusionsFixed price from a one-paragraph brief
Delivery practice15Regular demos of working software, tests, code review, CI/CDStatus reports only; manual deployment; no tests
Ownership and contract terms15Written IP assignment, your repository and accounts, clear exitLicence only, supplier-held code or accounts, no termination right
Team and continuity10Named people, stated subcontracting, a plan if someone leavesAn unnamed team; subcontracting unclear
Security and data protection10Controller-processor contract offered, secrets and access explained, security terms in the contractVague answers; no data processing terms
Communication and fit10Asked good questions, clear written answers, workable meeting timesSlow, vague or sales-led replies
Commercial value5Price in line with the same scope elsewhere; exclusions statedFar above or below others with no explanation
Total100Score (1–5) × weight ÷ 5, summed across criteria

Worked example: a company scoring 4 on relevant evidence earns 4 × 20 ÷ 5 = 16 of the 20 points available for that criterion.

8. Red flags

Any one of these is worth a direct question. Two or more usually means walking away.

  • A fixed price before anyone has asked about your users, data or integrations.
  • Reluctance to put the code in your repository, or to give you access until the end.
  • No written IP assignment, or ownership described only in a sales call.
  • Case studies you cannot check in any way: no live product, no reference, no architecture walk-through.
  • The people in the sales meeting are not the people who will build the product, and nobody will say who is.
  • Pressure to sign quickly, or a large upfront payment with no defined deliverable.
  • "We don't need a data processing agreement" from a supplier who will access your production data.
  • Every question about testing or deployment is answered with a tool name rather than a demonstration.

9. How AI Dev Planner answers these questions

Since we are on many shortlists, here are our answers to the points above, limited to what we already publish. Check them the same way you would check anyone else’s.

  • Where we are: our engineering team is based in Islamabad, Pakistan, and we work with UK clients remotely. We do not have a UK office.
  • Scoping: a discovery phase comes before the build, mapping workflows, data model and integrations, followed by fixed 2-week sprint costs against the agreed scope.
  • Visibility: a dedicated Slack channel with the engineers, and a video walkthrough of working software every two weeks.
  • Code and accounts: we recommend the repository lives in your own GitHub or GitLab organisation from day one, with hosting in cloud accounts you control.
  • Ownership: clients receive full IP ownership of the bespoke code, database design and documentation. The ownership terms are set out in the contract for each project and in our terms of service; ask us for the exact wording before you sign.
  • After launch: a 60–90 day warranty covers defects in what we delivered.
  • Price: we publish GBP planning ranges on our software development company page.
  • Evidence: most of our case studies are anonymised because of client confidentiality, so ask us for an architecture walk-through. The AI Dev Planner platform is our own product, and its case study describes a system you can use yourself. Our trust page sets out how we handle security, ownership and delivery.

We are probably not the right choice if you need a supplier on site in the UK, if your contracts require UK-only access to your systems, or if you have not yet tested whether anyone wants the product. In that last case, validate the idea first, for example with the AI Dev Planner validation platform.

FAQs about choosing a software development company

How many software development companies should I shortlist?

Three is usually enough to compare, and more than five makes it hard to give each one a fair, like-for-like evaluation. Send every company the same written brief, ask them the same questions, and score their answers with the same scorecard, so you are comparing companies rather than sales pitches.

Who owns the code a development company writes for me?

Do not assume you do. GOV.UK guidance says the creator of a work is usually the first owner of the copyright, and for commissioned work the commissioner is not the owner unless you agree otherwise in writing. Under section 90(3) of the Copyright, Designs and Patents Act 1988, an assignment of copyright is not effective unless it is in writing and signed by or on behalf of the assignor. Make sure the contract contains a written assignment, and take legal advice on the wording.

Do I need a data processing agreement with a software development company?

If the company will process personal data on your behalf, for example by accessing a production database, handling user uploads or running support, the ICO says there must be a written contract that binds the processor to the controller, as required by Article 28 of the UK GDPR. If they only ever work with test data and never touch personal data, that requirement may not arise, so agree the access arrangements in writing during scoping.

Is source code escrow necessary for custom software?

Escrow matters most when the supplier keeps the source code and licenses the software to you. If the code is bespoke, lives in a repository your business owns from day one, and the contract assigns the IP to you, you already hold the code, and escrow adds little. Check who controls the repository, the hosting and the deployment credentials before paying for escrow.

Should I choose the cheapest quote?

Only if it covers the same scope as the others. Quotes differ most in what they leave out: discovery, design, automated testing, deployment, documentation, warranty and project management. Ask every company to list its assumptions and exclusions, then compare the quotes against the same scope. A quote with no stated assumptions is not cheaper; it is unknown.

What should a discovery phase produce?

Written outputs you could hand to another team: the core user workflows, a data model, the integrations and their risks, a prioritised feature list with what has been left out, and an estimate with its assumptions stated. If a discovery phase ends with only a slide deck and a price, you have paid for a sales process rather than a plan.

How do I check a development company's reviews and case studies?

Treat directory reviews as one signal. Clutch, for example, says it verifies a reviewer's identity and work history, and it publishes reviews it cannot fully verify as not verified. Ask to speak to two past clients directly, ask to see a live product the company built, and ask what the company did on that project and what the client's own team did.

Sources

All sources accessed 16 October 2026.

  1. GOV.UK: Ownership of copyright works — Default first ownership of copyright, employees' works and commissioned works.
  2. Copyright, Designs and Patents Act 1988, section 90 (legislation.gov.uk) — An assignment of copyright must be in writing and signed by or on behalf of the assignor.
  3. ICO: When is a contract needed and why is it important? — A written contract is required whenever a controller uses a processor (UK GDPR Article 28).
  4. ICO: What needs to be included in the contract? — The minimum terms of a controller-processor contract.
  5. NCSC: 10 Steps to Cyber Security, supply chain security — Building security into contracting decisions, and contract terms for the return and deletion of information.
  6. NCSC: Cyber Essentials overview — What Cyber Essentials is and where current certificates can be checked.
  7. Companies House: Find and update company information — Searching the UK company register; Companies House does not check the accuracy of filed information.
  8. Clutch Help Center: How Clutch verifies reviews — What Clutch checks about reviewers, and that it publishes some reviews as not verified.

Put us through the same checks

Send us your brief and your questions. We will answer them in writing, and tell you if we are not the right fit.

Send us your brief Estimate your MVP cost