SB StartupBasket
All ideas
75 /100 GO Low complexity

LiveProof — disclosure proof for EU chatbot deployers

Watches your live chatbot every day and captures the screenshot that proves the AI disclosure was actually showing.

Compliance SaaS EU Compliance-drivenSMBAI-agentMultilingualSolo-builderAgency-channel
— views
Evaluation Scores
75/100

GO

Overall Score

15
Problem
12
Demand
13
Build
12
Distrib.
11
Revenue
8
Time
4
Defense

LiveProof

1. One-liner

Watches your live chatbot every day and captures the screenshot that proves the AI disclosure was actually showing.

2. Trend signal — why now?

Article 50 of the EU AI Act became enforceable on 2 August 2026 — three days ago. It is not a future deadline; it is live law right now.

What it demands is narrow and unusually concrete. Anyone putting an AI system in front of a natural person in the EU must tell that person they’re talking to an AI, and it has to be perceivable in the interaction itself. The official guidance is blunt about the workarounds: a statement buried in terms and conditions, a metadata watermark on its own, or a vague reference to an “assistant” does not satisfy the duty. The “obvious from the circumstances” exemption exists but the guidance warns it “should not be over-relied on.”

Penalties run to €15 million or 3% of worldwide annual turnover, whichever is higher, enforced through national market surveillance authorities and the AI Office.

Three things make this a product rather than a blog post:

  1. The obligation is non-delegable. OpenAI, Zendesk, and Intercom can comply for themselves; they cannot comply for you. If a widget sits on your site, the disclosure duty is yours as the deployer. Vendors change their widgets — Zendesk shipped a visual redesign of its own “Generated by AI” disclosure — and your compliance moves without you touching anything.
  2. Nobody is ready. More than 60% of European SMEs have not started their compliance process. Meanwhile 20.0% of EU enterprises with 10+ employees used AI in 2025, up 6.5 percentage points from 13.5% in 2024 — the exposed population is growing fast while readiness lags.
  3. The gap is evidentiary, not advisory. The IAPP’s own write-up on SME deployer gaps lands exactly here: teams have no written classification rationale, and “‘It is just a chatbot’ is not a legal analysis.” What’s missing is artifacts — a register, a rationale, a retention setting, a record.

And here is the part the incumbents miss. Every tool in this category asks you questions and generates a PDF. Themio’s own SME buyer’s guide concedes the point about the whole category: none of these tools verify live website disclosures or deployed AI systems. They certify what you said was true on the day you filled in the form. Article 50 is about what a visitor actually sees, in a session, in their language, today.

Provenance:

3. The opportunity

The AI Act compliance market split itself into two useless halves for a small company.

At the top: Credo AI, Holistic AI, OneTrust, IBM watsonx.governance, Vanta. Enterprise governance platforms at €15,000–€80,000+ annually. They build risk registers and model inventories for companies with a compliance function. A 30-person Dutch e-commerce shop with a Shopify store and an Intercom bot is not buying this.

At the bottom: a swarm of €29–49/mo questionnaire tools — AI Act Ready, Themio, ActReady, aiacto — promising “AI Act compliant in 15 minutes.” They classify your risk tier, generate a PDF, and hand you an embeddable trust badge. AI Act Ready’s Smart Scan reads your URL to pre-fill the questionnaire, and the €49 tier adds a monthly re-scan.

Both halves sell the same thing: a snapshot of an assertion. Neither produces the thing a market surveillance authority or an enterprise procurement team will actually ask for — a dated record showing the disclosure was rendered, to a real visitor, on the pages that matter, in the languages you serve.

That’s the gap. Article 50 compliance is not a state you enter, it’s a state you drift out of. Your chatbot vendor pushes an update and the badge moves below the fold. Someone A/B-tests the widget and the greeting message loses its first line. You launch a French storefront and the disclosure stays in English — and the guidance is explicit that English-only disclosure for multi-language EU users is a failure mode. A marketing hire swaps the bot’s avatar for a human name and photo with no AI label. Every one of these is a silent, invisible violation created by someone who never heard of Article 50, and a PDF you generated in March says nothing about it.

The 10× is this: instead of asking the customer what their chatbot does, go look at it. Every day. In every language. And keep the receipts.

4. Target market

  • Primary customer: Marketing or ops lead at an EU-serving company with 10–250 employees running at least one customer-facing AI surface — an e-commerce store with a support bot, a SaaS with an in-app assistant, a clinic or law firm with a booking agent. Also non-EU companies (US, UK, India) whose output reaches EU users, since the Act applies extraterritorially. Secondary and arguably better: digital agencies and AI-automation consultancies who build these bots for 10–80 clients each and are, per the legal analysis, typically both provider of the configured system and deployer toward the end client.
  • Why they buy: They don’t fear the €15M fine — they know it lands on Meta, not on them. They fear three cheaper things: an enterprise customer’s procurement questionnaire asking for AI Act evidence they can’t produce; a competitor or disgruntled ex-employee filing a complaint with the national authority; and, for agencies, a client turning around and saying “you built it, you’re liable.” Their current answer is a PDF from a €29 tool and a prayer.
  • Rough TAM reasoning: 20.0% of the roughly 1.5 million EU enterprises with 10+ employees used AI in 2025 — call it ~300,000 firms, with customer-service chatbots among the leading adoption drivers. If even 15% run a customer-facing AI surface in Article 50 scope, that’s ~45,000 businesses in the EU alone, before counting extraterritorial deployers and the agency channel. Capturing 1,500 of them at €70/mo average is ~€1.26M ARR. This is a niche too small to interest OneTrust and too evidence-heavy for the €29 questionnaire crowd.
  • Why now for them: The law went live 72 hours ago. There is a window — call it 12 to 18 months — where everyone knows they should do something, nobody knows what “done” looks like, and the first enforcement actions haven’t yet defined the norm. Urgency is highest before the first fine, not after.

5. Product sketch (MVP)

  • Daily live check. We load your actual pages in a real browser — the chat widget, the AI-assisted content pages you nominate — and look at what a visitor sees. Not your sitemap. Not your answers to a form.
  • Disclosure detection. Did the AI disclosure appear before or at first interaction? Is it visible in the widget itself, not the footer or the ToS? Is it perceivable without dismissing something? We check the rendered interaction, including opening the bot and reading its first message.
  • Language coverage. Run the same check per market locale. If your German storefront shows an English-only disclosure, that’s flagged as a finding, not a pass.
  • Evidence capture. Every check stores a timestamped screenshot, the rendered text, the page URL, and the locale. This is the artifact — the thing you hand to procurement or an authority.
  • Drift alerts. Email and Slack the moment a disclosure that was passing starts failing. This is the retention hook: the product earns its fee on the day your vendor’s update breaks something.
  • Classification rationale, written down. A short guided flow that produces the documented reasoning for why each system is limited-risk or otherwise — the exact artifact the IAPP flags as missing. Not a checkbox; a paragraph you can defend.
  • Evidence pack export. One PDF/ZIP per quarter: system register, classification rationale, and the dated screenshot trail. Built to be forwarded, not read.
  • Agency workspace. One login, all client sites, per-client evidence packs, white-label reports.

6. AI angle — what’s load-bearing

Remove the AI and this collapses into a broken regex.

The hard problem is that “is there an adequate AI disclosure?” is a semantic judgment, not a string match. “You’re chatting with an AI assistant” passes. “Hi, I’m Flora, an AI product advisor” passes. “Hi, I’m Flora! How can I help?” fails. “Powered by advanced technology” fails. “Chat with our smart helper” fails, and the guidance specifically warns that a vague reference to an “assistant” isn’t enough. Across 24 EU languages, with arbitrary phrasing chosen by whoever wrote the bot’s greeting, no keyword list survives contact with reality.

So a vision-and-language model does the actual work: read the rendered widget as a user sees it, decide whether a reasonably observant person would understand they’re talking to a machine, and judge whether the placement is perceivable in the interaction. It also writes the classification rationale — turning “we use Intercom’s bot for support” into defensible prose against the Act’s text.

The tech-unlock is the economics. Doing this daily, across every page and locale for thousands of customers, means a lot of vision calls. At 2023 prices this product costs more to run than it can charge. At 2026 prices — inference down ~95% in two years, with cheap tiers for classification and extraction and a frontier tier reserved for ambiguous calls — a €49/mo subscription carries the cost comfortably. Gate the expensive vision call behind a cheap text-only pre-check and the margin gets better still.

7. Localization angle (if any)

The localization is the product, which is unusual and good.

Article 50 compliance is per-language. A disclosure that satisfies a Dutch visitor does nothing for a Portuguese one, and English-only disclosure for multi-language EU users is a named failure mode. Any competitor building this US-first will check the English page, pass it, and miss the violation entirely.

Practical consequences: checks run per locale, not per domain. Findings and evidence packs render in the customer’s language. The classification rationale needs to read as competent legal prose in German and French, since that’s what a national authority reads. Pricing in euros, EU data hosting — which the SME tooling guides already flag as a buying criterion — and an EU-based entity, because selling AI-Act compliance from a US-hosted stack invites the obvious question. Sell into Germany and the Netherlands first: strongest regulatory culture, highest willingness to pay for documented compliance, and a dense agency ecosystem.

8. Business model — path to $1M–$5M ARR

  • Pricing:
    • Starter — €39/mo: 1 site, 3 locales, daily checks, evidence capture, quarterly export.
    • Business — €99/mo: 5 sites, unlimited locales, drift alerts to Slack, classification rationale flow, procurement-ready packs.
    • Agency — €299/mo: 25 client workspaces, white-label reports, client-facing dashboards. €9/mo per additional client site.
  • ACV: Blended ~€85/mo → ~€1,020/year. Agency accounts land nearer €3,600–5,000/year and pull the blend up as the channel matures.
  • Rough math to $1M ARR: 1,000 customers at €85/mo ≈ €1.02M ($1.1M). Realistically: 700 direct SMB accounts plus 60 agency accounts covering ~900 client sites.
  • Rough math to $5M ARR: Needs the agency channel to carry it — roughly 250 agencies at €4,000/year (€1M) plus 3,300 direct accounts at €1,020 (€3.4M), plus expansion into adjacent evidence obligations. Achievable only if Article 50 evidence becomes a standard procurement line item, which is the central bet.
  • Expansion path: Sites and locales are the natural usage meter. Then adjacent scope with the same machinery: the Product Liability Directive applying from December 2026, EUDR-style disclosure checks, GDPR cookie and consent drift on the same crawl. The daily-browser-plus-evidence-store is one asset that can serve several obligations — but resist that until Article 50 is nailed.

9. Go-to-market wedge — first 100 customers

  • Free public scanner, weaponized. A single-input tool: paste a URL, get an Article 50 verdict in 60 seconds with screenshots of what’s wrong and the exact article text. This is the whole top of funnel. It converts because the output is specific and slightly alarming, and it costs cents to run.
  • Cold outreach with the finding attached. Build a list of EU e-commerce and SaaS sites running detectable chat widgets — Intercom, Zendesk, Tidio, Crisp, and Shopify apps all leave identifiable fingerprints in page source, and BuiltWith-class data makes this list buildable in a weekend. Run the free scanner across 3,000 of them, email only the ~40% that fail, with the screenshot in the message: “Your German storefront’s chat widget doesn’t disclose AI. Here’s what a visitor sees. Article 50 has been enforceable since 2 August.” Expect 8–12% reply on a finding-attached cold email versus 1–2% on a generic pitch; 100 replies, 25–30 closes.
  • Agencies as the multiplier. Target Dutch, German, and Nordic digital and AI-automation agencies — the ones publishing “we build AI chatbots for clients” pages. Their exposure is worse than their clients’ because they’re typically both provider and deployer, and Article 25 lets parties allocate liability contractually but never eliminates it toward regulators. Pitch: monitor all your client sites, white-label the report, bill it on as a compliance retainer. One agency signup delivers 10–40 sites. 30 agencies gets you past 100 accounts on its own.
  • Ride the practitioner conversation. IAPP, r/gdpr, the European privacy-professional LinkedIn circuit, and the AI Act newsletter ecosystem are actively arguing about what Article 50 evidence looks like. Publishing real scanner data — “we checked 3,000 EU e-commerce sites, 41% show no compliant AI disclosure” — is the kind of primary research this audience shares hard, and it doubles as the sales list.
  • The Zendesk/Intercom update moment. Every time a major widget vendor changes its disclosure UI, a cohort of sites silently drifts out of compliance. Watch for those releases, re-scan the affected fingerprint population, and email the newly-failing ones the same week. This is a recurring, free demand event.

10. Build complexity — justification

Low. Headless browser rendering, a vision-language model call, screenshot storage, a scheduler, and a Stripe-billed dashboard — all off-the-shelf. There is no custom model, no data pipeline, no integration surface to speak of; the product deliberately touches nothing inside the customer’s stack, which is also why it sells fast.

The real work is judgment quality, not engineering: building an evaluation set of a few hundred real chat widgets across languages, and tuning until the pass/fail verdict is trustworthy enough to put in front of a regulator. A false “compliant” is a serious product failure. Budget 6–8 weeks to a paid v1 for one or two people, with most of that spent on the eval set rather than the app.

The known-annoying parts: chat widgets load in iframes and shadow DOM and often only render after user interaction, so the checker has to actually open the bot rather than read the page. Bot-detection and rate limiting on customer sites need handling. Neither is novel.

11. Gating checklist

GatePass?Note
Legal in target market✅Checks publicly-rendered pages the way any visitor or uptime monitor does. No authentication bypass, no scraping of private data.
Ethical — no harm / dark patterns✅The failure mode to avoid is fear-selling. Report findings factually, never claim to certify compliance, and state plainly that this is evidence, not legal advice.
Market exists (evidence above)✅Live law with €15M/3% fines, a €29–49/mo tool category already selling, €5K–30K counsel engagements, >60% of EU SMEs unstarted.
1–5 person team can build this✅One or two people, 6–8 weeks.
Launchable with <$50K / ₹40L✅Under €10K to first revenue. Inference and browser compute are the only real variable costs.

All five pass.

12. Feasibility score

AxisWeightScoreNotes
Problem intensity2015/20Real, dated, and legally backed — but honestly, most SMEs feel this as anxiety rather than daily bleeding. Nobody has been fined yet. Pain is procurement-driven and event-driven, not hair-on-fire. That ceiling is real and I won’t score around it.
Demand evidence1512/15Multiple independent signals: a live regulation with hard penalties, an existing paid tool category at this exact price point, €5K–30K counsel spend, >60% of SMEs unstarted. Deducted because willingness to pay for evidence specifically (vs. a cheap PDF) is inferred, not yet observed.
Build feasibility1513/15Off-the-shelf everything. Only genuine engineering risk is reliably rendering chat widgets across iframes and shadow DOM, and getting verdict accuracy high enough to trust.
Distribution clarity1512/15The free scanner plus finding-attached cold email is a named channel with a buildable list and believable math. The agency multiplier is proven to monetize — AI Act Ready already sells a €199/mo white-label tier. Not a 14 because reply-rate assumptions are estimates.
Revenue mechanics1511/15Pricing is benchmarked directly against a live category. €1M needs ~1,000 accounts, which is a lot of small logos to acquire and keep. €5M genuinely requires the agency channel to carry it.
Time to first revenue108/106–8 weeks to v1, and the scanner can pre-sell before the product is finished. Not a 9–10 because the buyer needs a moment of prompting rather than arriving with a credit card.
Defensibility104/10This is the weak axis and I won’t dress it up. A competent team clones the scanner in a month. The only durable assets are the accumulated evidence history — which creates switching cost, since your compliance trail lives here and starting over resets it to zero — the eval set behind verdict accuracy, and the agency relationships. Execution and speed moat, nothing more.
Total10075/100

13. Qualitative modifiers

Founder-fit tags

technical-heavy · content-heavy

Technical because verdict accuracy across languages and widget architectures is the product. Content-heavy because the free scanner and published scan research are the distribution — this idea rewards someone who’ll write the definitive practitioner post on what Article 50 evidence looks like. Notably it does not require a lawyer on the founding team, as long as the product ships findings and evidence rather than legal conclusions. Get counsel to review the rationale templates and stay on the right side of that line.

Key assumptions to validate (3–5)

  1. Assumption: A meaningful share of EU sites running chat widgets are actually non-compliant today. How to test: Build the scanner first, run it across 500 EU e-commerce sites, and measure the failure rate. Below 20% and the cold-email wedge loses its punch and the market is smaller than it looks.
  2. Assumption: Buyers will pay for ongoing evidence rather than a one-time €29 PDF. How to test: Sell both to the first 40 prospects — a €49 one-time audit versus €39/mo monitoring — and see which they pick. If they overwhelmingly take the one-time, this is a services business, not SaaS.
  3. Assumption: Agencies will resell this as a client retainer line item. How to test: 20 calls with Dutch and German digital agencies. Ask directly whether they’d bill clients €25–50/mo for monitored compliance, and whether their contracts have already raised the AI Act liability question.
  4. Assumption: Verdict accuracy can hit a level people trust. How to test: Hand-label 300 widgets across 6 languages, measure precision and recall, and specifically drive false-”compliant” toward zero even at the cost of extra false flags.
  5. Assumption: Drift is real and frequent enough to justify daily checks. How to test: Monitor 200 sites for 60 days and count how many transition from pass to fail without the owner acting. If drift is rare, the product is an annual audit and the pricing has to change.

Risk flags

  1. Enforcement risk (the big one): If national authorities spend 2027 ignoring SME chatbots entirely, urgency evaporates and this becomes vitamin, not painkiller. The whole thesis rests on the perception of enforcement, which is more fragile than the law itself.
  2. Regulatory drift: The EU has already delayed and simplified large parts of the AI Act under pressure — the high-risk deadlines slipped to 2027 and 2028, and EUDR keeps moving. Article 50 held its date this time, but a future simplification package carving out small deployers would gut the market overnight.
  3. Platform absorption: Intercom, Zendesk, Shopify, or HubSpot could ship “Article 50 compliant by default” plus a compliance report, removing the need for third-party proof on the most common configurations. This is the most likely way the idea dies. Partial defense: multi-vendor, multi-locale coverage and independent third-party evidence, which is worth more to a regulator than a vendor’s self-certification.
  4. Commodity risk: Low defensibility, a cheap-to-clone scanner, and a category already crowded with €29 tools that will bolt on live checking the moment it starts winning deals.
  5. Trust liability: Telling a customer they’re compliant when they aren’t is an existential product failure. This has to be positioned as evidence collection, never as certification — and the marketing copy will constantly want to drift the other way.

14. Structured verdict

Score:                  75/100
Verdict:                GO
Confidence:             Medium
Best-fit builder:       Technical solo founder or pair, EU-based, comfortable writing
                        practitioner content. No legal background required, but needs
                        counsel on retainer for template review.
Time to revenue:        6–10 weeks
Capital to launch:      €8–10K (~$9–11K)
Top 3 assumptions to validate first:
  1. Non-compliance is widespread — scan 500 EU sites, need >20% failure rate
  2. Buyers pay for ongoing evidence, not a one-time PDF — A/B the offer on 40 prospects
  3. Agencies will resell as a retainer line — 20 agency calls in NL/DE
Kill criteria:
  - Abandon if <20% of 500 scanned EU sites show a non-compliant disclosure
  - Abandon if <5 of the first 40 prospects choose monthly monitoring over a one-time audit
  - Abandon if fewer than 10% of 200 monitored sites drift from pass to fail in 60 days
    (no drift = no recurring value = wrong business model)
  - Abandon if Intercom or Zendesk ships native Article 50 evidence reporting before v1 lands

15. Next step — 1-week validation sprint

  • Day 1–2: Build the scanner only — no dashboard, no billing, no auth. Point it at 500 EU e-commerce and SaaS sites with detectable chat widgets. Record the pass/fail rate and, critically, the failure modes: missing disclosure, footer-only, English-only on a localized store, human-named avatar with no AI label.
  • Day 3–4: Take the 100 worst failures and send the finding-attached cold email with the screenshot. Simultaneously call 20 Dutch and German agencies with the same evidence for their client sites. Measure reply rate, not sentiment.
  • Day 5: Put up two payment links — €49 one-time audit and €39/mo monitoring — and push every reply toward one of them.

Falsifiable outcome: ≥20% of scanned sites fail, ≥8% of cold emails reply, and ≥5 people put a card down, with at least 2 choosing the monthly plan over the one-time audit. Fewer than 5 payments, or all 5 choosing the one-time option, and this is a consulting gig wearing a SaaS costume — kill it.

Interested in a detailed proposal?

Get a deep-dive with market research, competitive analysis, and implementation roadmap.

Contact us

info@startupbasket.ai