SpecDrift

1. One-liner

Catches the day a supplier quietly changes an ingredient, before your label becomes an undeclared-allergen recall.

2. Trend signal — why now?

Undeclared allergens are the number one cause of FDA food recalls, and the trend is getting worse, not better. In Q1 2026 undeclared allergens drove 57 FDA recall events, up from 49 the prior quarter — even as total FDA recalls fell 10.3% to 140 events. Allergens are taking a bigger share of a shrinking pie. Units impacted nearly doubled quarter-over-quarter, from 28.76 million to 57.40 million (Packaging Digest, Q1 2026). Milk was cited in 17 of those recalls, soy in 14.

Here’s the part that makes this a product and not a lecture. The root cause is almost never a manufacturing failure. It’s a paperwork failure that happens after the food is made correctly: “label artwork not updated after a supplier reformulation, rework incorporated without verifying allergen profiles” (Alleratech allergen control guide). A June 2026 recall traced to a supplier that swapped a fish-based ingredient for a mollusk-based one without telling the customer (Ken Lehat & Associates, June 2026 recall analysis).

And the structural fact that creates the entire opportunity: “There is no legal obligation for a manufacturer to notify their wholesale customers of reformulations” (Chiwai, ingredient-change guidance). Your supplier can change what’s in the drum, ship it to you, and owe you nothing. The recommended defense is a manual one — check every delivery against your stored spec, watch for “New recipe” or “Improved formula” flashes on the label, then go chase a fresh spec sheet. Chiwai calls this “the most labor-intensive part” of ingredient management and “error-prone on larger menus or with frequent supplier switches.” It is also, in practice, the step nobody does.

Regulatory pressure is compounding at the same moment. New York Public Health Law §1357 takes effect 12 November 2026, requiring allergen labels on food prepacked on-site — and unlike California’s SB 68, “New York’s law applies to every business regardless of size” (Kafoodle, Dill). Every deli, bakery, and grab-and-go counter in the state is about to own a legal allergen declaration it has to keep true. A label you print once and never revisit is a liability with a printed date on it.

Provenance:

• Signal 1 (demand): Undeclared allergens are the leading cause of FDA recalls — 57 events in Q1 2026, up from 49; units impacted up 99.5% to 57.4M — https://www.packagingdigest.com/food-beverage/q1-2026-fda-usda-recalls-surge-on-allergen-labeling-failures — 2026-08-09
• Signal 2 (feasibility): No legal duty for suppliers to notify customers of reformulation; the prescribed defense is manual goods-receipt comparison, called “the most labor-intensive part” of the workflow — https://chiwai.eu/en/knowledge/allergen-labeling-implementation/ingredient-changes/ — 2026-08-09
• Signal 3 (economic): Enterprise supplier-document platforms start ~$500/mo and run to ~$32K/yr, with pricing “steep for small to mid-sized operations” — https://www.itqlick.com/foodlogiq/pricing — 2026-08-09
• Signal 4 (regulatory): NY PHL §1357 effective 12 Nov 2026, applies to every food business regardless of size — https://www.kafoodle.com/blog/new-york-allergen-labeling-law-2026-complete-guide — 2026-08-09 Category: Workflow automation

3. The opportunity

Every small food brand has a shelf of PDFs — supplier spec sheets, certificates of analysis, allergen statements — that were true on the day they were filed and have been decaying ever since. The label on the finished product is a derivative of those PDFs. When an upstream document changes and nobody notices, the label silently becomes false, and stays false until someone gets sick or an inspector pulls a spec.

The incumbent answer is enterprise supplier-management software: TraceGains, Trustwell/FoodLogiQ, and the QMS platforms. They are genuinely good and genuinely built for the wrong customer. Entry pricing sits around $500/month rising to ~$32,000/year, and the documented complaint is that “pricing lacks transparency and can be high for smaller operations” (ITQlick on FoodLogiQ). Worse, they’re built on the assumption that suppliers will log into your portal and maintain their documents. That assumption holds when you’re Kraft. It collapses completely when you’re a 6-person hot-sauce brand and your supplier is a regional distributor who communicates exclusively by emailing PDF attachments.

The 10× move is inverting the model. Don’t ask the supplier to do anything. Take the documents as they actually arrive — email attachments, scanned PDFs, a photo of a drum label taken on a phone at goods-receipt — extract the ingredient and allergen statement, and diff it against the version you had on file. Then say the only sentence that matters: “Ingredient 4 in your Chili Crisp changed on Tuesday. The new spec declares soy. Your label does not. Here are the 3 SKUs affected.”

That’s a document-diffing problem wearing a compliance hat. It became genuinely tractable in the last eighteen months, and nobody has pointed it at the small end of the market because the small end doesn’t look like an enterprise ACV.

4. Target market

• Primary customer: US specialty food and beverage brands doing roughly $500K–$20M in revenue — the ones with a real retail footprint and a real label, but no full-time QA hire. The buyer is the founder/ops lead, or the one “Quality Manager” who is also doing production scheduling. Secondary: co-packers running 10–40 client SKUs, who inherit every client’s allergen risk and currently manage it in a shared drive.
• Why they buy: Because a single recall is existential for them and routine for their insurer. A recall “averages $10 million in direct costs” per GMA figures cited by The Coyle Group — a number scaled to large manufacturers, but the directional point stands: standard general liability and product liability policies exclude the recall itself (Coverwatch). A small brand eats the withdrawal cost, the destroyed inventory, and the lost retail relationship out of working capital. Retailers deslot brands that recall.
• Rough TAM reasoning: The US has thousands of small and mid-sized food manufacturers across snacks, sauces, bakery, dairy, and beverage, with “hundreds of smaller and mid-sized manufacturers” operating in individual categories alone (IndustrySelect). I’ll be honest that I could not source a clean count of the addressable segment — treat the TAM as directionally large and specifically unverified. At a $299/mo ACV I need roughly 280 customers for $1M ARR, which is a small fraction of any plausible denominator. That’s the number that matters.
• Why now for them: Payer- and regulator-side scrutiny is rising into a specific dated deadline (NY, 12 Nov 2026), retail buyers increasingly demand documented allergen programs, and supplier reformulation is accelerating under cost and availability pressure — the exact conditions that produce silent drift.

5. Product sketch (MVP)

• Forwarding inbox. Every brand gets a dedicated address. Spec sheets, COAs, and allergen statements get forwarded or auto-BCC’d there as they arrive from suppliers. No portal for the supplier to log into, because they won’t.
• Spec extraction. Pulls ingredient statements, allergen declarations, “may contain” language, and facility statements out of PDFs, scans, and phone photos into a structured record per supplier-ingredient.
• Drift diff. When a new document arrives for an ingredient already on file, produces a plain-English changelog: what was added, what was removed, what allergen status flipped. Highlights allergen-relevant changes above everything else.
• Blast-radius map. Each ingredient links to the finished SKUs that use it. A drift alert names the affected SKUs, their current label text, and whether that label is now wrong.
• Label-truth check. Upload your current label artwork or ingredient statement once per SKU. SpecDrift continuously re-checks it against the live supplier specs beneath it and flags contradictions.
• Stale-spec watchlist. Flags any ingredient whose spec is older than your policy window (12/18/24 months) and drafts the request email to the supplier.
• Audit trail export. One PDF per SKU showing every spec version, every change, and every review — the artifact you hand an inspector, a retail buyer, or an insurer.

6. AI angle — what’s load-bearing

Load-bearing, and easy to argue. The entire input is unstructured, hostile documents: no two suppliers use the same spec sheet layout, half are scans, some are photographs of a drum label taken in bad warehouse light. Extracting “contains soy lecithin, may contain milk, produced in a facility that also processes tree nuts” reliably out of that soup is the product. Then the semantic diff — recognizing that “whey protein concentrate” replacing “pea protein isolate” is an allergen event while “natural flavor (0.2%)” moving position in the list is not — is judgment, not string comparison. A regex diff would generate so many false positives that users would mute it in a week, which is exactly how these alerts die.

Remove the AI and you have a document storage folder. Those already exist and nobody pays for them. The AI is what turns a pile of PDFs into the sentence “your label is now wrong.”

7. Localization angle (if any)

N/A for v1 — this is a US-first play, deliberately. The wedge is US FDA labeling rules (Big 9 allergens including sesame) plus the November 2026 New York deadline. The UK/EU is a genuinely strong second market — Natasha’s Law created the same PPDS obligation and the same supplier-drift exposure, with fines from £1,000 to £30,000 in magistrates’ court and unlimited fines in Crown Court (SafetyCulture) — but the allergen list differs (14 vs 9) and the document conventions differ enough that it’s a v2, not a launch-day toggle.

8. Business model — path to $1M–$5M ARR

• Pricing: $149/mo (Starter — up to 15 ingredients, 5 SKUs), $299/mo (Standard — up to 75 ingredients, 30 SKUs), $699/mo (Co-packer — multi-client, unlimited SKUs, client-facing audit exports). Priced deliberately beneath the ~$500/mo enterprise floor so the comparison is “cheaper than TraceGains” and not “another $500 line item.”
• ACV: ~$3,600 blended, assuming the mix skews to Standard.
• Rough math to $1M ARR: 280 customers × $299/mo × 12 = $1.0M. Not a landgrab — a two-year outbound grind at a few new logos a week.
• Rough math to $5M ARR: ~1,000 brands at Standard plus ~150 co-packers at $699. Requires the co-packer channel to work as a wedge (one co-packer brings visibility into 10–40 client brands, several of which become direct customers). If co-packers don’t convert, $5M is hard and $2M is the honest ceiling.
• Expansion path: Priced on ingredient and SKU count, so it grows as the brand grows — a natural, non-punitive expansion axis. Real upsells: multi-facility, supplier-approval workflow, retailer-specific compliance packet generation (the document set Whole Foods or UNFI asks for), and eventually an insurer-facing risk attestation.

9. Go-to-market wedge — first 100 customers

• Recall-list outbound, weekly. FDA and FSIS publish recalls continuously, with reason codes. Every week, pull the undeclared-allergen recalls, identify the recalling firm and — critically — their category peers. Email the peers: “Company X in your category recalled 40,000 units last Tuesday for undeclared milk. Here’s the 4-line summary of how supplier drift causes that. Want us to audit your current spec files free?” This is timely, specific, and the recipient just read about it in their trade press. Target 400 emails/week, expect 3–5% reply.
• Free spec audit as the demo. The offer is: forward us your last 20 supplier spec sheets, we’ll return a one-page report of which are stale, which contradict your labels, and which allergen declarations have drifted. That report is the sales call, and it’s produced by the product. Anything found is an immediate close; anything clean is a cheap trial.
• Co-packer beachhead. Co-packers are the highest-leverage node: they hold spec files for every client brand and carry the liability. Target 200 US co-packers directly. One signed co-packer produces both revenue and warm intros to a portfolio of brands who now see the tool in their own supply chain.
• The November 12 deadline as a content and outreach hook. For NY specifically: every deli, bakery, and grab-and-go operator in the state has a hard date. That’s a list you can build from state food-service registrations and a message that writes itself. This is a top-of-funnel hook more than an ICP — most delis won’t buy $299/mo — but it’s cheap attention that surfaces the ones with real manufacturing operations.
• Food-safety consultants as referrers. Independent HACCP/food-safety consultants advise dozens of small brands each and are asked “what tool should I use?” constantly. Revenue-share and give them a free multi-client seat.

10. Build complexity — justification

Medium. The hard part is extraction quality across genuinely awful documents, and the semantic diff that separates allergen-relevant change from formatting noise — that’s the difference between a product and a spam generator, and it needs real iteration against a real corpus. Everything else is standard: an inbound email pipeline, document storage, a records model, alerting, and a PDF export. A technical pair ships a credible v1 in 12–16 weeks, with the first 6 weeks going almost entirely into extraction accuracy on a hand-collected set of a few hundred real spec sheets.

11. Gating checklist

Gate	Pass?	Note
Legal in target market	✅	Processing documents the customer already possesses. Product is advisory — it flags discrepancies, it doesn’t certify compliance.
Ethical — no harm / dark patterns	✅	Reduces undeclared-allergen exposure. The upside is people not going to the ER.
Market exists (evidence above)	✅	Enterprise incumbents charging $500/mo–$32K/yr prove willingness to pay; the complaint is price, not need.
1–5 person team can build this	✅	Technical pair, 12–16 weeks.
Launchable with <$50K / ₹40L	✅	Inference, storage, and outbound tooling. Well under $25K to first revenue.

12. Feasibility score

Axis	Weight	Score	Notes
Problem intensity	20	17/20	Undeclared allergens are the #1 FDA recall cause and rising. A recall is existential for a small brand, and standard liability policies exclude the recall cost itself. Not 18+ because the pain is episodic — felt sharply after an incident, easy to defer before one.
Demand evidence	15	12/15	Strong: incumbents charging real money, rising recall counts with hard Q1 2026 numbers, a dated regulatory deadline. Held back because I could not source verbatim customer complaints from small brands — the Reddit/forum voice for this niche is thin, and that’s a real gap in the evidence.
Build feasibility	15	11/15	Standard stack, but extraction accuracy on scanned and photographed spec sheets is where projects like this die. 12–16 weeks, not 6.
Distribution clarity	15	11/15	The recall-list outbound play is specific, timely, and repeatable weekly, and the free spec audit is a strong demo. Uncertain conversion rate on cold email to an unfashionable buyer keeps it out of the 13+ band.
Revenue mechanics	15	11/15	Pricing anchored beneath a known enterprise floor; 280 customers to $1M is achievable. The $5M path leans on co-packer conversion that is currently an assumption.
Time to first revenue	10	7/10	The free-audit motion can pre-sell during the build, but the first paying customer realistically lands 6–10 weeks post-launch.
Defensibility	10	5/10	Honest score. The workflow lock-in is real — once your spec history and SKU map live here, leaving means losing your audit trail. But a competent team could clone the core in a quarter. The compounding asset is the corpus of supplier document formats, which makes extraction better over time. That’s a moat that takes 12 months to matter and doesn’t exist at month 3.
Total	100	74/100

13. Qualitative modifiers

Founder-fit tags

technical-heavy · domain-expertise-required

You need someone who can get extraction working on ugly documents, and someone who has sat in a food-safety audit. The second is harder to fake than the first — without a QA advisor, you will build alerts that no quality manager trusts, and untrusted alerts get muted.

Key assumptions to validate (3–5)

1. Assumption: Supplier spec drift happens often enough to justify a monthly subscription — a typical small brand sees several allergen-relevant changes a year, not one every three years. How to test: Run the free audit on 20 brands’ historical spec files. Count actual drift events found per brand per year. Below ~2/year and this is a nice-to-have.
2. Assumption: Small brands will forward supplier emails to a third-party inbox. How to test: Ask 30 target brands directly in discovery. Watch specifically for procurement or confidentiality objections around pricing data appearing on spec sheets.
3. Assumption: Extraction is accurate enough on real-world scanned specs that alerts are trusted. How to test: Hand-collect 200 real spec sheets across formats, measure allergen-statement extraction precision and recall. Below 95% precision, false positives will kill retention.
4. Assumption: Co-packers will buy and refer. How to test: 20 co-packer discovery calls before committing to the $699 tier and the $5M path.

Risk flags

1. Incumbent price-drop risk: TraceGains has already begun offering free access to its supplier-management set with usage-based pricing (PR Newswire). If enterprise vendors seriously chase the small end with a free tier, the price wedge erodes. The counter is that their model still assumes supplier portal participation — which is the thing that actually doesn’t work downmarket.
2. Liability positioning: A tool that says “your label is fine” when it isn’t invites a claim. Position strictly as detection assistance, never certification. This needs a lawyer before launch, not after.
3. Episodic urgency: This is insurance-shaped. Brands buy hardest right after a scare and churn when a quiet year passes. Retention depends on producing visible value between incidents — the audit-trail export and retail-buyer packet are what earn the renewal in a quiet year.
4. Evidence gap: The customer-voice research for this segment is thinner than I’d like. Everything here is sourced, but the small-brand pain is inferred from industry guidance and recall data rather than heard verbatim. That is precisely why confidence is Medium and why the validation sprint is discovery-led.

14. Structured verdict

Score:                  74/100
Verdict:                GO
Confidence:             Medium
Best-fit builder:       Technical pair with a food-safety/QA advisor on the cap table
Time to revenue:        4–6 months (12–16 week build + 6–10 week sales cycle)
Capital to launch:      $20–25K
Top 3 assumptions to validate first:
  1. Drift frequency ≥2 allergen-relevant changes/brand/year — measure via free audits on 20 brands' historical spec files
  2. Brands will route supplier email to a third-party inbox — 30 discovery calls, listen for confidentiality objections
  3. Extraction precision ≥95% on real scanned specs — benchmark against 200 hand-collected documents
Kill criteria:
  - Abandon if free audits across 20 brands surface fewer than 1 allergen-relevant drift event per brand per year
  - Abandon if extraction precision on real-world scans stays below 90% after 6 weeks of focused work
  - Abandon if <5% of 400 recall-triggered cold emails produce a reply after 3 consecutive weeks

15. Next step — 1-week validation sprint

• Day 1–2: Collect 60 real supplier spec sheets and COAs from public sources and any friendly brand contacts. Run extraction on all of them. Measure allergen-statement precision honestly, per document format. This tells you whether the product is buildable before you talk to anyone.
• Day 3–4: Twenty discovery calls with small food brands and co-packers, sourced from recent trade-show exhibitor lists. Two questions above all: “When did a supplier last change something without telling you, and how did you find out?” and “Would you forward supplier emails to a tool that watched them?” Log the drift-event count per brand.
• Day 5: Run the free-audit offer live. Email 100 brands offering a no-charge spec audit. Count how many actually send documents — that’s the real measure of whether the wedge works, because it requires effort, not just a reply.
• Go/no-go: Proceed only if (a) extraction precision ≥90% on the 60-document set, (b) ≥12 of 20 discovery calls recall a specific unannounced supplier change, and (c) ≥8 of 100 audit offers result in documents actually being sent. Miss two of three and this is a VALIDATE, not a GO.