Drafted with the help of an AI assistant — which is also what this piece is about. Every fact below was checked against the linked primary sources.
On 11 September the EU's new duty to report exploited vulnerabilities came into force. That same morning, the agency that enforces it switched on a platform that does the filing for you, free, with a login you already have.
We had a product priced to do that filing.
That was one of three bets we killed this month. We had researched all three with an AI assistant and written them down properly — named buyer, competitor prices, a date the buyer could not argue with. Then we checked each one against its sources before building, which is the boring step everybody skips, and none of the three survived it. Almost everything that killed them had already happened before we wrote them down.
That order is deliberate. An idea gets an hour with an assistant, because ideas are cheap and there are always more of them than there are days. Only the few that survive into a written bet get the expensive day against primary sources. Wide and cheap first, narrow and slow second.
The board that month held 171 options, 12 of them marked ready to start — marks made by the same research this note is about. Three bets got the expensive day, one of those twelve and two from the tier below. None survived it in the shape we had written down; the ideas went back on the board, the bets did not.
The regulator shipped the tool
The Cyber Resilience Act is a good deadline. Fines reach €15M. Two thirds of the manufacturers and developers OpenSSF polled had barely heard of it three months before it bit. Our note said there was nothing under €99 a month that bundled reporting readiness with a disclosure page.
When we checked, CVD Portal's disclosure tier was free forever, CRAToolkit was selling the paperwork at €29, and ConformOps was reading your repository for €99 once. We had priced against a gap that three products were already standing in.
The fear was smaller than the headline, too. A carve-out means small vendors cannot be fined for missing the 24-hour alarm — the deadline everyone quotes. They still have to file, and the reports that follow still carry a fine. But the part that sounded most frightening is the part they cannot be punished for.
What is left is the real date, fifteen months out, when the full technical file arrives — and which nobody is selling against yet, because it is not in the news.
The rules we were selling against were deleted
We had priced a tool that writes safety sheets and chemical labels for small makers — candles, diffusers, cleaning products — ahead of the EU labelling overhaul. Two obligations were coming. One was a set of new hazard classes. The other was new label formatting rules, down to minimum font size and line spacing, plus a hard six-month clock to reissue a label whenever a classification changed.
That clock was the product. A recurring obligation is what a subscription is for.
The formatting rules were not delayed. They were deleted — font size, spacing, typeface, colour, all struck out in favour of "labels must be readable," which is what the law said before. The six-month clock became "without undue delay." Whatever was left moved to 2030.
You cannot sell a subscription against without undue delay.
The hazard classes survived — but not on the date we had written down. The 1 November 2026 deadline everyone quotes is for substances. Candles, diffusers and cleaning products are mixtures: new ones have had to comply since May, and anything already on a shelf has until May 2028. Either way it is one afternoon of work per product, once. And the incumbent we were undercutting turned out not to charge $199 a sheet, as its headline says, but $199 a year for a small maker's first four.
| What the AI told us | What was true |
|---|---|
| Fines up to €15M | No fine for the 24-hour alarm, if you are small |
| Minimum font size and line spacing | "Labels must be readable" |
| 1 November 2026 | May 2028 for mixtures already on shelves |
Three lines from the research the assistant gave us, and what the sources actually said.
Nothing to do with the product
We had priced an e-paper dashboard for one narrow audience — aviation weather, ham radio, servers in a basement — sold as a device plus a licence. The category earns: the leader sold out its first batch in weeks, and single-person campaigns on Crowd Supply cleared $464,390 and $591,237 this year.
Then, in three months, three moves. In May, an open display protocol joined the Home Assistant foundation and shipped inside Home Assistant — so any panel now speaks to the installed base without us. In July, a finished device with a case and a battery landed at $39.90, against the $150 we had penciled in. And the leader quietly published a wholesale price list with purchase orders and Net 30, which was the last thing on our list of what it did not do.
None of that is the reason we stopped.
We stopped because putting your own name on a WiFi device sold into Europe makes you its manufacturer, with the security file, the registrations in every country you ship to, and — since the EU scrapped its €150 duty relief in July — a €3 charge on every product category in a box shipped in from outside the EU, counted per tariff line rather than per parcel. Meanwhile the panels themselves are on six-to-twelve-month lead times, because supermarket shelf labels are eating the supply and a two-person buyer is last in that queue.
Nobody beat us to the product. The product stopped being the hard part.
The half that still works is the software: the leader makes more from $50 licences for screens people already own than it ever made from the subscription it cancelled.
What the three have in common
Competitors played a part in only one of the three. In the cybersecurity bet rivals did fill the sub-€99 gap, inside a month — though the regulator went first, and what it handed out for free was the part we meant to charge for. In the other two the rivals were there all along and are not what stopped us: one obligation was deleted by the people who wrote it, and one product ran into conformity paperwork and a supply queue long before anybody could outsell us.
What they share is timing. The rules that make you the manufacturer of a WiFi device have been mandatory since August 2025; the panel shortage was reported in March; the labelling rules were struck in June; the EU's €150 parcel relief ended in July. All of it was public before we wrote the bets down. None of it was in the answers we got.
The cheap hour was never built to catch this. It answers one question: is there a buyer, and what do they pay today — and it reads the headline price, not the footnote. What moved in July is not its job. Catching movement is what the expensive day is for — and this month it earned its keep three times. The failure would have been skipping it, not running it.
The assistant we researched with searched the web every time. It found what ranks: explainers, vendor blogs, launch posts, written when each story was news and not touched since. It stitched them into one answer, in the present tense, with no date on any of it. It searched for the story it already knew, and found it. A lag on top of a lag, delivered as if it were this morning.
That part is on us. We asked what was true and never asked as of when.
So the hour changed shape. It still opens with as of when. But we no longer trust the answer — searching was never the problem; ranking was. Now the hour ends with a second, separate search: what has changed on this in the last twelve months. Not the topic. The changes. And a source that comes back without a date is struck on the spot, in the cheap hour, not discovered on the expensive day.
| When | What happened |
|---|---|
| Aug 2025 | Security rules make you the manufacturer of a WiFi device |
| Mar 2026 | Panel shortage reported: shelf labels eat the supply |
| Jun 2026 | Label formatting rules struck out, rest moved to 2030 |
| Jul 2026 | EU scraps its €150 parcel duty relief |
| Early Sep | We write the three bets down |
| 11 Sep | The regulator switches on its free platform |
Everything above the bold row was already public when we asked. Only the row below it was news.
So the check that matters is not "is this real." It is "what has moved since this was written." When an AI hands you the answer, find the date on every source behind it — the newest document wins, not the most-linked one.
That day costs. This month it cancelled three products we had scoped at ten days to three weeks each — six weeks of building, bought for three days. That is the whole case for the expensive day, and three is not a sample, so ask us in a year. A fourth product shipped on 7 September.
Even this note. The AI we asked to review it fetched the published page live, twice, and both times read the first draft — the one that still said no competitor had beaten us.
The board still holds eleven marks made by the same research. We trust them less than we did on the first of September.
Checked 23 September 2026. The chemicals package is a provisional agreement — the 2030 date is not final and can move again.
Originally published at peculiar.systems/notes.
Top comments (1)
The common thread is a useful warning. A market assumption can expire even when the product itself is sound. Treating research freshness as a launch dependency could save teams from defending yesterday's premise.