Venture Assessment: AI for Regulated-Document Compliance — FDD vs. Defense Wedges

I built the FDD wedge. See the FDD Update Engine project and ▶ try the live demo — a real public Westin FDD updated to a tracked-changes DOCX in the browser, no API key.

TL;DR

The franchise (FDD) franchisor-side drafting/update wedge is genuinely OPEN — no AI-native startup is automating the $4,000–$15,000/year attorney-performed annual FDD update; existing AI tools are all franchisee-side “review/risk” analyzers (FranchiseIQ, FranchiseStack) or compliance-tracking dashboards (FranConnect, Spadea’s CAP, Internicola’s FranIQ). But the total market is small (~$100–250M TAM) and gated by unauthorized-practice-of-law (UPL) risk.
The defense/CUI document wedge is CONTESTED-to-CROWDED on the high-frequency layers (CMMC SSP/POA&M automation has FutureFeed, Paramify, Workstreet, PreVeil; proposal/CDRL work has GovDash, Sweetspot, Procurement Sciences) but has a far larger revenue ceiling and is defensible via FedRAMP/IL5 authorization moats — exactly the kind of compliance barrier the founder’s Air National Guard affiliation helps cross.
Recommendation: Lead with FDD as a fast, cheap, founder-friendly beachhead to prove the human-in-the-loop engine, but architect for defense as the revenue-ceiling expansion — mirroring the Harvey “narrow wedge → adjacent expansion” playbook. The single biggest risk is UPL/liability forcing you into a low-margin “tool for lawyers” rather than a replacement; validate with 25–40 franchisor/franchise-attorney interviews and 3–5 paid pilots before committing.

Key Findings

No one is automating franchisor-side FDD drafting/updates with AI. A dedicated scan found zero startups doing end-to-end AI drafting or annual updating of the 23-item FDD. The closest is CaseMark (generic legal-AI, $1.7M seed from Gradient Ventures, 2024) which only auto-generates the FDD receipt form, and Zors AI (franchise-attorney-founded by Derek Colvin, bootstrapped ~$10K/mo) which does territory maps + registration tracking, not text drafting. This is a real greenfield — but a narrow one.
The FDD market is large in units but small in serviceable spend. FRANdata’s 2026 Franchising Economic Outlook (released Feb 19, 2026) is built on a database of approximately 9,000 active U.S. franchise brands; every one must update its FDD annually within 120 days of fiscal year-end under the FTC Franchise Rule (16 CFR Part 436). Annual attorney spend is $4,000–$15,000 per brand for the update, plus $0–$7,500 for amendments and per-state registration fees in the 14 registration states. That math yields a TAM on the order of ~$100–250M and a realistic SAM of ~$15–30M ARR (ESTIMATE).
Defense compliance documents are higher-dollar, higher-frequency, and recession-proof. CMMC Level 2 documentation (SSP/POA&M) alone runs $12,000–$60,000 per contractor via consultants, with ~$15K–$40K for professional SSP development, recurring annually; the Phase 1 CMMC requirement (effective Nov 10, 2025) will likely apply to ~65% of the Defense Industrial Base per DoD’s 32 CFR estimates. Add ITAR/EAR classification, DCAA incurred-cost submissions, and proposal/CDRL compliance and the per-account spend dwarfs FDD.
The defense data barrier is real but solved at the platform layer. Commercial LLMs can now touch CUI/ITAR data: Claude (via AWS Bedrock GovCloud) is authorized to FedRAMP High and DoD IL4/IL5, with IL6 via the AWS Secret region; Azure OpenAI is FedRAMP High; building your own FedRAMP authorization costs $500K–$1.5M (Moderate) to $1M–$3M+ (High) over 12–24 months. You inherit ~80% of controls by building on GovCloud/Azure Gov.
Harvey is the template the founder should study. Harvey went from a GPT wrapper (founded 2022) to crossing $100M ARR in August 2025 — roughly three years after founding (Sacra) — and a $11B valuation (March 25, 2026, $200M round co-led by GIC and Sequoia bringing total funding past $1B, per CNBC and Harvey). Its moat is not the model but embedded “legal engineers,” workflow orchestration, document-management integrations, and seat-expansion economics. Norm Ai (regulatory compliance agents, $87M raised over 18 months per its March 2025 release; ~$130M per PitchBook) is the closest analog to this founder’s exact “regulations-as-code + human certification” thesis.

Details

PART 1 — FRANCHISE LAW (FDD) WEDGE

1.1 How many franchisors, and what does the FDD update cost?

Universe of franchisors. FRANdata, which prepares the IFA’s economic outlook, tracks approximately 9,000 active franchise brands across all 50 states plus D.C. (2026 Franchising Economic Outlook, Feb 19, 2026). The IFA itself has ~1,400 member brands. The U.S. had 832,521 franchise units at year-end 2025 (≈845,000 forecast end-2026, +1.5%, with over 12,000 new franchised businesses projected in 2026), but the relevant buyer count is brands/franchisors (~9,000), not units. The IFA’s 2025 Franchisor Survey notes 64% of franchisors believe expedited state registration would aid growth — a signal of registration pain.
Federal requirement. The FTC Franchise Rule requires an FDD with 23 disclosure items; it must be updated annually within 120 days of fiscal year-end, plus quarterly updates for material changes. There is no federal filing — the FTC does not “stamp” FDDs — but the document must be maintained and disclosed at least 14 days pre-sale.
Cost breakdown (well-corroborated):
- Initial FDD drafting: $15,000–$45,000 (Accurate Franchising: $15K–$45K; ReqoData: $15K–$35K).
- Annual update: $4,000–$15,000 to the lawyer (Drumm Law; The Franchisor Blueprint corroborates the $4K–$15K range and notes fees rose ~8–12% since 2024).
- Amendments: $0–$7,500 (12 of 14 registration states require amended filings; Drumm Law).
- Quarterly material-change updates: $2,000–$10,000 (Drumm Law).
- Audited financials (required): ~$1,500–$8,500+ for a new franchisor (CPA, separate from legal).
- State registration/filing fees: registration states vary; filing states are concrete — e.g., Connecticut $400, Florida $100, North Carolina $250, Maine $25, Nebraska/South Carolina $100, Kentucky $0.
- Franchisee-side FDD review (different buyer): fixed fees $2,500 (single unit) per Internicola; $1,500–$5,000 generally; hourly $350–$800.

1.2 Who does FDD work today, and is anyone using AI?

Law firms / specialists: Internicola (Franchise Law Solutions), Spadea Lignana, Drumm Law, Fisher Zucker, Lathrop GPM, DLA Piper, Cheng Cohen, Taft. The update is manual: attorneys “review our clients’ FDDs for the last three years and compare them, section by section” (Taft’s Joshua Brown, via Franchise Times).
Compliance/management software (tracking, not drafting): FranConnect (with “Frannie AI” agents for ops/finance, not FDD drafting), FranchiseSoft (automates FDD delivery + Item 23 receipt), Naranga. Law-firm proprietary platforms: Internicola’s FranIQ® (“AI-enabled dashboards to track franchise registrations, renewals”) and Spadea’s CAP System (“know at a glance the status of all state registrations and how their FDD Update is progressing”). Both track; neither drafts.
AI tools that exist (all franchisee/buyer-side): FranchiseIQ/fddiq.com (“attorney charges $2,000–$5,000… we do it in 8 minutes for $49”), FranchiseStack ($149), Franchise Caliber ($197). These score/flag risk in an existing FDD; they do not draft or update.
Closest franchisor-side AI: CaseMark (FDD receipt form generation only; $1.7M seed, Gradient Ventures, 2024) and Zors AI (territory maps + registration tracking; founded by franchise attorney Derek Colvin; bootstrapped). Verdict: franchisor-side AI drafting/updating is unbuilt. No vendor has even claimed the “first to automate FDD drafting” flag.

1.3 TAM/SAM math (show the work).

TAM (annual FDD-update legal spend): 9,000 brands × $4,000–$15,000 = $36M–$135M/year for the update work specifically. Add amendments/quarterly updates (~$2K–$17K more per active brand) and the addressable annual legal-spend pool is ~$100M–$250M (ESTIMATE). A smaller one-time layer exists for initial drafting by genuinely new brands.
SAM (realistically serviceable): Assume you target the ~3,000–5,000 brands that are multi-state and actively selling (the ones with real annual update pain and registration-state filings). At a software/service price of $3,000–$6,000/brand/year (undercutting the $4K–$15K attorney bill while leaving room for an SME certifier), SAM ≈ $15M–$30M ARR (ESTIMATE) — assumptions: 4,000 serviceable brands × $4,500 blended ACV. This is a lifestyle-to-small-VC-scale ceiling, not a Harvey-scale one, unless you expand to adjacent franchise legal work (agreements, multi-state registration filing, M&A/PE diligence packages).

1.4 Regulatory/liability barriers.

UPL (unauthorized practice of law) is the central defensibility/risk paradox. Preparing and registering an FDD is legal work; franchise firms state plainly that “only a franchise lawyer can legally prepare and register the Franchise Disclosure Document” and “consultants cannot draft or register your FDD” (Internicola). This protects incumbents and means an AI product likely must be sold to franchise attorneys (a tool that compresses their 20+ hours of update labor) or operate with an attorney-of-record in the loop — your human-in-the-loop model fits, but caps pricing power and TAM.
14 registration states (CA, HI, IL, IN, MD, MI, MN, NY, ND, RI, SD, VA, WA, WI) require filing/registration before sale; 11 require state examiner review and comment letters; registration takes 30–120 days (CA 8–12 weeks). This is a structural complexity moat: a tool that reliably produces examiner-ready, state-specific addenda has defensible value.
No private right of action under the FTC Rule, but state AGs can fine ($10,000+/violation) and franchisees can seek rescission — raising the stakes on accuracy and making the “SME certifies” layer essential for trust.

PART 2 — DEFENSE / MILITARY DOCUMENT WEDGE

2.1 Highest-dollar, highest-frequency regulated documents.

Document / workflow	Typical cost paid to consultants	Frequency
CMMC Level 2 SSP development	$15,000–$40,000 (consultant); $12K–$60K all-in	Initial + ongoing maintenance; triennial reassessment
CMMC gap assessment / readiness (RPO)	$5,000–$25,000 (up to $40K)	Initial + pre-reassessment
Full Level 2 readiness engagement (gap→C3PAO prep)	$50,000–$150,000 consulting	Per certification cycle
C3PAO assessment fee	$30,000–$118,000 (DoD est. $105K–$118K for L2)	Every 3 years
POA&M management	bundled above; platform-assisted reduces cost	Continuous
DCAA incurred-cost submission (ICS)	varies; annual, due 6 months after FYE under FAR 52.216-7	Annual
ITAR registration (DDTC)	$2,250/year + $150–$5,000 per license	Annual + per-transaction
ITAR/EAR classification (CJ requests, ECCN)	legal/consultant fees per determination	Recurring
Proposal compliance matrices / CDRLs	proposal-team labor (the GovDash/Sweetspot target)	Per solicitation

CMMC is now law and can appear in DoD solicitations as of Nov 10, 2025 (Federal Register Vol. 90, Sept 10, 2025: “This rule is effective November 10, 2025”); documentation costs are allowable/recoverable through contract pricing, a tailwind for selling paid tooling. A poorly written SSP “is the number-one reason assessments fail” — a clear pain point for an accuracy-focused AI+SME product.

2.2 Who serves it; who’s using AI.

CMMC documentation automation (the closest comps): Paramify (FedRAMP-High-Ready, auto-generates SSP/POA&M, “Iron Man suit for GRC experts” — explicitly human-in-the-loop), Workstreet (AI-powered RPO, automates L2 + FedRAMP), FutureFeed (1,400+ clients, 300+ partners; gap assessment → instant SSP), PreVeil ($450/month, CUI enclave + pre-filled SSP/CRM docs, 85+ perfect 110-score assessments, FedRAMP High cloud), Cuick Trac, Secureframe/Scrut (multi-framework incl. CMMC).
GovCon proposal/capture AI: GovDash ($30M Series B; customers won $5B+ in 2025 awards; FedRAMP Moderate Equivalent; RFP shredding, compliance mapping, CDRL-style drafting), Sweetspot ($2.2M seed, YC; “TurboTax for government contracts,” $720–$3,600/yr; customers include Vannevar Labs, Groq), Procurement Sciences (“Awarded AI”), pWin.ai ($10M seed, Shipley-embedded; acquired Vultron’s customer base April 2026 — a consolidation signal), Unanet/Deltek (incumbent GovCon ERP).
Horizontal compliance automation that could move down-market into CMMC: Vanta (last public valuation $4.15B at its July 2025 Wellington-led $150M Series D; hit $300M ARR and 16,000+ customers by April 2026 per Fortune), Drata (~$98M ARR, SafeBase acquisition), Secureframe.
Verdict: The high-frequency SSP/POA&M and proposal layers are contested-to-crowded. White space exists in the lower-frequency, higher-judgment, document-heavy niches — ITAR/EAR classification packages, DCAA incurred-cost submissions, technical data package (TDP) compliance, CDRL authoring against MIL-STD — where no AI-native leader has emerged and where the SME-certification model is most defensible.

2.3 Technical/compliance barriers.

Can commercial LLMs touch the data? Yes, within authorized boundaries. Claude via AWS Bedrock GovCloud = FedRAMP High + DoD IL4/IL5; available in AWS Secret region (IL6). ITAR data can only be processed via AWS Bedrock (IL5-accredited) per Anthropic’s public-sector guidance; Claude for Government (C4G) is FedRAMP High ($60/seat/mo). Azure OpenAI = FedRAMP High (GPT models in Azure Government, though frontier models lag the commercial catalog by months). Google Vertex offers Claude/Gemini under Assured Workloads (FedRAMP High), but Vertex generative models are not available under the ITAR control package as of early 2026. Multi-cloud routing (Sweetspot’s approach) lets you match model to compliance tier.
What it costs to build the moat: FedRAMP Moderate $500K–$1.5M initial / $200K–$500K per year, 12–24 months; FedRAMP High $1M–$3M+ / $500K–$1M per year; 3PAO assessment alone $300K–$1.5M. Building on GovCloud/Azure Gov inherits ~80% of controls (reduces your direct control burden ~30–40%, not 80%). IL5 retrofits from a commercial baseline can mean “18–24 months in retrofit purgatory” — architect for the target impact level from day one. FedRAMP 20x (launched March 2025) may cut Low/Moderate to ~$100K–$300K and months, but is still in pilot for Moderate.
Clearances: 9–18 months to process — the founder’s Air National Guard affiliation is a genuine asset for credibility, facility/personnel access, and customer trust.

2.4 Sales cycle and revenue ceiling.

Procurement paths: SBIR Phase I ($50K–$225K, feasibility, ~6 months) → Phase II ($750K–$1.5M, prototype) → Phase III (sole-source, uncapped, no recompete required) — the “license to hunt” that opens doors to program managers. Bridge funding: AFWERX STRATFI ($3M–$15M) / TACFI ($375K–$1.7M) for Air Force; APFIT for fielding. OTAs (10 U.S.C. 4021) for rapid prototyping; subcontracting to primes for fastest (if lower-margin) entry.
Cycle length: Realistically long — SBIR cycles run months each, and the “Valley of Death” between Phase II and a Program of Record kills many startups. Selling to primes can be faster if you align to an existing program. Plan for 6–18+ month enterprise cycles for direct DoD; faster for defense contractors buying CMMC tooling commercially (those resemble normal B2B SaaS, weeks-to-months).
Ceiling if it works: Large. DoD awarded Anthropic a two-year prototype OTA with a $200M ceiling through the CDAO (announced July 14, 2025; identical $200M OTAs went to OpenAI, Google, and xAI). GovDash customers won $5B+ in awards. Comparable govtech/defense-software outcomes (Palantir, Second Front, the GovDash/Sweetspot cohort) show eight-to-nine-figure revenue potential and strategic-acquirer interest. The defense wedge’s ceiling is 10–100× the FDD wedge’s.

PART 3 — THE BROAD PLATFORM THESIS

Funded AI-for-regulated-documents startups (2023–2026):

Company	Vertical	Founded	Funding raised	Latest valuation	What it automates	Wedge→expand?
Harvey	Legal	2022	$1.2B+	$11B (Mar 2026)	Legal research, drafting, due diligence, contract review; 25,000+ custom agents	Yes — law firms → in-house → tax/insurance
Norm Ai	Regulatory compliance	2022	$87M (disclosed) / ~$130M (PitchBook)	n/d	”Regulations-as-code” AI agents; compliance review of content/filings	Started financial services/insurance, expanding
Hebbia	Financial/legal docs	2020	~$160M (a16z-led $130M Series B)	~$700M (reported)	Document Q&A/analysis over large corpora	Finance → legal/enterprise
EvenUp	Legal (personal injury)	2019	$385M	$2B+ (Oct 2025)	Demand letters, claims docs from medical records	PI demand letters → full case lifecycle
Eve	Legal (plaintiff)	—	$103M+	$1B+	PI case workflows	Narrow plaintiff focus
Robin AI	Contracts	2019	$40M+ (distressed; assets sold to Scissero Dec 2025)	down round	Contract review/drafting	Cautionary tale — ran out of runway
Legora (Leya)	Legal	2023	~$150M Series C	$1.8B	Collaborative legal AI workflows	Fast EU expansion
Spellbook	Contracts	—	$120M+ ($80M equity + $40M debt)	n/d	Word-native contract drafting/review	Solo lawyers → enterprise
Luminance	Contracts	2016	$115M+	n/d	Contract analysis	—
Vanta	Compliance (SOC 2)	2018	$504M	$4.15B (Jul 2025)	SOC 2/ISO/HIPAA evidence + monitoring	SOC 2 → GRC/vendor risk/AI risk
Drata	Compliance	2020	$353M+	~$2B (2024)	SOC 2 + multi-framework	SOC 2 → compliance-as-code
Secureframe	Compliance	2020	$100M+	n/d	Multi-framework incl. FedRAMP/NIST	—
Fieldguide	Audit/accounting	2020	$125M	$700M (Feb 2026)	Audit workpapers, testing agents (98% vs 54% human)	Audit → advisory
Numeric	Accounting (close)	—	$89M	n/d	Month-end close	Close → finance data platform
Materia	Tax/audit	—	acquired by Thomson Reuters (Oct 2024)	—	Agentic tax/audit research	Absorbed by incumbent
Abridge	Healthcare docs	—	$800M+	$5.3B (2026)	Clinical documentation from visits	Scribe → enterprise health systems
Tennr	Healthcare referrals	—	$101M+ Series C	$605M	Referral/faxed-document processing	Referrals → revenue cycle
GovDash	Defense/GovCon	—	$40M+ ($30M Series B)	n/d	Proposals, compliance mapping, CDRLs	Proposals → full procurement lifecycle
Sweetspot	GovCon	—	$2.2M seed	n/d	Contract search + proposal	Search → capture/proposal

(Insurance doc AI — Federato, Sixfold, Indico — and additional healthcare names — Anterior, Co:Helm, SmarterDx, Regard, Freed — sit in the same “vertical document + expert-in-the-loop” pattern; figures for these were not individually re-verified within research budget.)

Closest to the founder’s exact thesis (“regulated docs companies must legally maintain + human expert certifies”): Norm Ai (regulations-as-code + compliance-officer-in-the-loop), Fieldguide (audit workpapers + CPA certifies), and the CMMC automation cohort (Paramify/Workstreet/FutureFeed — SSP generation + RPO/assessor certifies). The model is proven across verticals.

Harvey wedge-then-expand timeline (the founder’s reference):

2022: Founded by Winston Weinberg (ex-O’Melveny litigator) + Gabriel Pereyra (ex-DeepMind/Meta). Beachhead: a single proof-of-concept on landlord-tenant law; cold-emailed Sam Altman; became an early OpenAI Startup Fund investment.
End 2023: ~$10M ARR. 2024: ~$65.8M ARR (558% YoY per GetLatka); $100M Series C (July 2024) at $1.5B.
2025: $300M Series D at $3B (Feb) → $300M Series E at $5B (June) → crossed $100M ARR (August, ~3 years after founding, per Sacra) → $160M at $8B (Dec).
Jan 2026: $190M ARR. March 25, 2026: $200M growth round at $11B, total funding past $1B (CNBC; Harvey). Sacra estimates $300M ARR by May 2026.
What made it defensible beyond the model: When frontier models commoditized legal reasoning (Harvey scrapped its fine-tuned legal model for multi-model agentic workflows), the moat became (1) embedded “legal engineers” who build/maintain custom agents alongside customers, (2) workflow orchestration across M&A/diligence/drafting, (3) deep enterprise integrations (iManage, NetDocuments, Word add-in), (4) seat-expansion economics — internal usage data show median seat count doubles within 12 months (Sacra), and (5) distribution/relationships (majority of AmLaw 100, 500+ in-house teams, LexisNexis alliance). Sequoia’s Pat Grady: “They sort of wrote the playbook for what it means to be an AI-native application company, which is the same thing Salesforce did back in the day with the cloud transition.” The lesson for this founder: the model is not the moat — proprietary workflow data, the human-expert layer, integrations, and distribution are.

Recommendations

Stage 1 (months 0–6): Validate FDD as the beachhead, build the engine.

Lead with FDD. Rationale across the three axes: speed-to-revenue (no FedRAMP, no clearance, commercial LLMs work today, buyers reachable via IFA/franchise bar); founder fit (a software engineer + small team can ship an MVP that ingests last year’s FDD + this year’s data and produces a redlined, examiner-ready update); defensibility (genuine greenfield on the franchisor side + UPL moat if you partner with attorneys).
Build the human-in-the-loop core as a vertical-agnostic engine (ingest → extract → compare-to-prior → draft delta → route to SME for certification). FDD is the first instance; the architecture must generalize to SSPs and ITAR packages.
Sell to franchise law firms first (compress their 20-hour update to ~2 hours) rather than direct-to-franchisor, to sidestep UPL. Price as seat/per-update SaaS to firms; target the proprietary-platform firms (Internicola, Spadea) as design partners or acquirers.
Benchmark to change course: If you cannot land 3–5 paid pilots with franchisors/firms at ≥$3,000 ACV within 6 months, or if pilots reveal the attorney must still redo >50% of the output, the FDD SAM is too thin and UPL too binding — pivot resources to defense.

Stage 2 (months 6–18): Architect and credential for defense in parallel.

Use FDD revenue + the proven engine to enter defense via the lower-frequency, higher-judgment, less-crowded documents: ITAR/EAR classification packages, DCAA incurred-cost submissions, TDP/CDRL compliance — NOT head-on into the crowded CMMC-SSP or proposal lanes (GovDash, FutureFeed, PreVeil already there).
Leverage the Air National Guard affiliation for credibility, design partners, and a clearance path. Pursue an SBIR Phase I (AFWERX, given the ANG tie) as non-dilutive validation and a direct line to program managers.
Build on AWS Bedrock GovCloud (Claude, IL5) from day one — do not build a commercial product and retrofit. Budget realistically: FedRAMP Moderate ~$500K–$1.5M / 12–24 months if you need your own ATO, or inherit via GovCloud and a Game-Warden-style platform (Second Front) to compress to months.
Benchmark to escalate: An SBIR Phase II award, a prime subcontract, or 2–3 defense-contractor LOIs justify shifting the company’s center of gravity to defense (10–100× the FDD ceiling).

Stage 3 (18+ months): Platform. Whichever wedge shows seat-expansion and data-compounding economics first becomes the platform spine; the other becomes a vertical. Follow Harvey/Norm Ai: invest in the human-expert (“legal/compliance engineer”) layer and integrations as the durable moat.

PART 4 — VERDICT

11. Lane status by wedge:

FDD (franchisor-side AI drafting/updating): OPEN. No AI-native competitor on the drafting/update side; only franchisee-side analyzers and compliance-tracking dashboards exist. Justification: dedicated scan found zero franchisor-side AI drafting products and no one claiming the flag.
FDD (franchisee-side review): CROWDED/COMMODITIZED. $49–$197 analyzers already exist; avoid.
Defense — CMMC SSP/POA&M & proposals: CONTESTED-to-CROWDED. FutureFeed, Paramify, Workstreet, PreVeil, GovDash, Sweetspot, Procurement Sciences, pWin.ai all active.
Defense — ITAR/EAR classification, DCAA ICS, TDP/CDRL: OPEN-to-CONTESTED. No AI-native leader; highest-judgment, document-heavy, best fit for the SME-certified model.

12. Launch sequence: FDD first (speed, founder fit, greenfield), defense second (ceiling, defensibility). FDD proves the human-in-the-loop engine cheaply and fast; defense is where the revenue ceiling and authorization moat live. Do not start solo-in-defense: the FedRAMP/clearance/sales-cycle cost would burn runway before revenue.

13. Single biggest risk: UPL/liability collapses the model into a thin “tool for lawyers” (FDD), or the FedRAMP/clearance/sales-cycle cost exceeds runway before a Program of Record (defense). Confirm/rule out with: 25–40 franchisor + franchise-attorney discovery interviews; 3–5 paid FDD pilots measuring attorney-rework rate (<25% = green); for defense, ≥2–3 contractor LOIs and an SBIR Phase I award before committing FedRAMP capital.

Caveats

Market-size figures for FDD are ESTIMATES built from corroborated per-brand costs ($4K–$15K update) × the FRANdata brand count (~9,000 active brands, 2026 Outlook). The serviceable count (3,000–5,000 multi-state active sellers) is my assumption, not a published figure; treat SAM ($15M–$30M ARR) as directional.
Funding/valuation figures are drawn from company announcements, Sacra/PitchBook/Crunchbase estimates, and press; several ARR numbers (Harvey, Abridge, Vanta) are analyst estimates, not audited. Norm Ai’s $130M (PitchBook) vs. $87M (company, March 2025) reflect different sources/dates; valuation undisclosed.
The defense competitive set is moving fast — pWin.ai’s April 2026 acquisition of Vultron’s customers and Robin AI’s late-2025 distress show this category both consolidates and culls quickly. Crowding assessments are as of mid-2026.
UPL and state-bar rules vary and are the single biggest legal uncertainty for the FDD wedge; obtain franchise-law counsel before structuring the product’s attorney-in-the-loop model.
FedRAMP 20x could materially lower the defense barrier (cost/timeline) but is still in pilot for Moderate as of mid-2026 — do not assume the cheaper numbers until your target baseline is authorized under 20x.
I was unable to complete dedicated searches on Hebbia and several healthcare names (Anterior, Co:Helm, SmarterDx, Regard) within the research budget; figures shown for those are from earlier corroborated sources or marked as reported/uncertain.