What changed
HYPOTHESIS-LEVEL: EU AI Act deployer obligations are asserted (from model knowledge, not attached signals) to be cascading into enterprise procurement as AI-specific vendor questionnaires, hitting a long tail of tiny AI/agent vendors who cannot produce Fortune-500-grade documentation. The convergence description references signals 1426/1419/1424 but NO signal text or URLs were provided in this input, so every load-bearing claim here is currently unverified inference.
Why now
INFERENCE (dates from knowledge base, flagged for verification in the convergence itself): GPAI obligations applicable since August 2025, high-risk obligations landing August 2026. If real, enterprises are drafting AI addenda into vendor contracts now, and incumbent compliance platforms target the enterprise deployers, not the supplier long tail. Agent products are the fastest-growing and least-documentable vendor category. None of this is evidenced in the input.
Converging signals
Claimed but not shown: (1) a 15-person AI startup failing enterprise documentation demands (signal 1426), (2) agent-governance gaps — no audit trail, no oversight story (signals 1419/1424), (3) a dated regulatory mandate on deployers. The signals array in this input is EMPTY; I cannot verify or cite any of them.
Customer pain
HYPOTHESIS: a small AI vendor gets a 100+ question AI-specific security/AI-governance questionnaire from an enterprise prospect, has no model cards, no data-flow diagram, no oversight/logging attestation, and the deal stalls for weeks or dies. This is deal-blocking pain when it occurs — but zero PAIN, HIRING/SPEND, or FORCED BUYER evidence was supplied, so occurrence rate is unproven.
Who pays
The small AI/agent vendor (10-50 people, has revenue or funding, mid-deal with an enterprise). Deal-blocked buyers pay fast and don't comparison-shop. Secondary payers: accelerators and VC platform teams buying portfolio-wide. NOTE: this is NOT a forced government filer — the 'mandate' reaches the buyer second-hand through a customer's questionnaire, which weakens urgency versus the founder's proven ELDT shape.
Solved today
HYPOTHESIS: founders hand-write answers, copy-paste from SOC2 docs, ask ChatGPT, or pay a fractional compliance consultant $2-10k. Incumbents (Vanta, Drata, Credo AI, Trustible) sell continuous compliance platforms at $10k+/yr aimed at the deployer/enterprise side or at companies formally pursuing ISO 42001 — heavy for a vendor who just needs one credible evidence pack this week.
Why current solutions are bad
Manual answers don't match the vendor's real stack (agents, tool-calls, model routing) and fall apart in follow-up; consultants are slow and expensive; incumbent platforms are subscriptions to a certification journey, not a fast artifact. The wedge is 'read the actual repo/configs and emit truthful, mapped evidence in a day' — generation from ground truth, not template-filling.
Proposed product
CLI/GitHub-app scanner + generator: ingests repo, agent framework configs (LangChain/LlamaIndex/OpenAI Assistants/etc.), model/provider inventory, logging/observability setup; emits an AI system inventory, data-flow diagram, model-card-style technical docs, human-oversight and logging attestations, mapped to AI Act Annex IV / ISO 42001 control language; plus a questionnaire-answering mode grounded in the generated pack.
MVP version
No product yet — the MVP of this idea is evidence collection (see next_action). Product MVP if validated: a scripted scan of 3 design-partner startups' stacks producing a polished PDF/Notion evidence pack, done 50% manually behind the curtain, sold at $1-2k per pack.
30-day build
Run the convergence's own testable prediction: collect 10 recent enterprise vendor-onboarding packets from founder communities/HN/small-AI-startup sales teams; count AI-specific sections absent from 2024-era versions. Simultaneously post in 3 founder communities asking 'has an AI questionnaire stalled a deal for you?' Target: 4/10 packets with AI sections and 3 founders reporting stalled deals — else kill.
60-day build
If validated: build the scanner for the 2-3 most common stacks among respondents; deliver 3 paid pilot packs ($1-2k each, half-manual); capture the exact questionnaire questions to build the mapping library.
90-day revenue plan
Productize pack generation; pitch 2 accelerators/VC platform teams on portfolio bundles (10 packs at $800/each); list an ISO-42001/AI-Act readiness artifact on compliance-platform-adjacent marketplaces. Realistic first-revenue window 90-150 days, consistent with the founder's runway per the capital lesson (confidence 0.9).
Distribution path
Founder communities and HN (where the pain is complained about), accelerator/VC platform teams (portfolio-wide resale), and security-questionnaire platform marketplaces. UNPROVEN: all three are hypotheses; the marketplace route creates dependency on Vanta-class incumbents who are also the most likely competitors.
Pricing hypothesis
$1,000-2,500 per evidence pack one-time, $200-400/mo to keep it current (stack drift re-scans). Deal-blocked buyers anchor against the consultant alternative ($5k+) and the stalled deal's value, not against SaaS price norms.
Technical difficulty
Moderate and squarely in the founder's strengths: static analysis of repos/configs + LLM-assisted document generation + a control-mapping library. The hard part is truthfulness — the pack must survive enterprise follow-up questions, so generation must stay grounded in scanned facts. No government portal integration exists here to leverage his ELDT submission asset.
Legal / regulatory risk
Real but manageable: the product generates compliance representations; if a pack overstates controls, the vendor bears the misrepresentation risk and may blame the tool. Mitigate with explicit 'evidence generated from scan on DATE' framing and attestation checkboxes the founder never signs himself. Not legal advice positioning required.
Platform dependency
Low for the core product (runs on the vendor's own repo). Medium for the marketplace distribution route (Vanta-adjacent platforms can clone the feature). Model-provider churn forces continuous mapping-library maintenance.
Founder fit
MIXED. Matches: AI workflows, fast prototyping, compliance/document products, systems thinking, demonstrated-value selling. Does NOT match the proven ELDT edge — per the government-portal lesson (confidence 0.8), his best shape is a regulation compelling filers into a government portal with per-filing monetisation; here the obligation reaches the buyer indirectly via private questionnaires, there is no portal to automate, and demand is deal-triggered rather than deadline-forced. The demand-blind-engine lesson (confidence 0.85) applies: this input has zero demand evidence, and I am scoring accordingly rather than assuming the gap is real.
Breakout potential
If enterprise AI questionnaires standardize the way SIG/CAIQ did for security, the mapping library plus scanner becomes the 'Vanta for the AI vendor long tail' — genuine expansion into continuous monitoring, EU-rep services, and per-questionnaire answering. But that standardization is exactly the unproven step.
Final recommendation
DO NOT BUILD YET — VALIDATE. This is a coherent, solo-feasible, plausibly-sellable idea sitting entirely on unverified inference. The convergence hands you a cheap, decisive 2-3 week test (collect 10 real onboarding packets). Run it. If ≥4 contain AI-specific sections and ≥3 founders report stalled deals, upgrade to build with paid pilots; if not, kill and keep the mapping-library research as raw material for a future government-portal-shaped AI Act play (e.g., EU database registration filings for high-risk systems, which IS his proven shape and worth a separate convergence).
Next action
Post in 2-3 founder communities (and ask 5 small AI startup sales teams directly) for recent enterprise vendor-onboarding questionnaires; score 10 packets for AI-specific sections vs their 2024 equivalents; simultaneously check whether EU AI Act Article 49 high-risk registration creates a direct government-portal filing obligation that better fits the founder's ELDT pattern.