AuthList Clear — The Vape & ENDS Retailer/Distributor PMTA & State Product-Registry Authorization Desk

Executive summary

AuthList Clear is a done-for-you SKU authorization compliance desk for independent and small-regional vape/ENDS (electronic nicotine delivery system) retail chains and wholesale distributors. Every month, and on demand before any new product ships or is placed on a shelf, we cross-match the operator's actual product catalog against (a) the FDA Center for Tobacco Products' Tobacco Products Marketing Orders directory (the federal list of the only ~30-40 e-cigarette products ever granted marketing authorization under FD&C Act Section 910), and (b) the fast-growing patchwork of state PMTA product registries (14+ states live as of mid-2026 and rising), and deliver a signed, dated, evidence-backed Authorization Pack: an Authorized-to-Sell list, a Remove-Now exception list with contract/registry citations, a supplier-certification request pack, and — when a warning letter or civil money penalty (CMP) notice arrives — a Corrective-Action Response Pack drafted for the operator (and, where a CMP hearing is contemplated, a referral to an independent tobacco-regulatory attorney).

The operator never touches a directory-matching tool. They receive a subscription deliverable each cycle and an on-demand deliverable whenever they consider a new product or a new state. AI performs the SKU/flavor-variant extraction, canonicalization, and directory cross-referencing at a scale and refresh cadence no small operator's staff can sustain manually across 15+ fragmented, differently-formatted government sources; a trained compliance analyst resolves ambiguous matches and signs off; the retailer's owner remains the FDA-facing "responsible party" and license holder.

Decision: Blueprint. The candidate clears the evidence threshold on a specific, painful, well-documented regulatory problem; a narrow, reachable buyer; active enforcement and legislative momentum through 2026; existing (but upstream- or software-only) competitor/budget proof; a one-feature MVP wedge; and a credible 50%+ gross-margin, subscription-priced service model that gets stronger as more states add registries and as frontier models get better at parsing messy regulatory sources.

Thesis

Regulatory "product legality" has quietly become a moving target for a category of retailer that is not equipped to track it: independent vape and smoke shops and the distributors who supply them. The federal list of legally sellable e-cigarette products is short (a few dozen SKUs) and static; the market is enormous and dominated by disposable-flavor products that were never authorized. On top of the stable federal baseline, individual states are now bolting on their own registries, each with a different submission format, different penalty ladder, and different effective date. No single spreadsheet stays current for long, and the operator who gets it wrong faces FDA civil money penalties (~$20K per action, escalating on repeat violations), state license suspension/revocation, product seizure without refund, and increasingly, termination of the card-processing relationship that lets the store function at all.

This is a textbook AI-native, done-for-you service opportunity: the underlying task (match a catalog of SKUs against several structured-but-messy government lists, on a recurring cadence, and produce an audit trail) is exactly the kind of extraction-classification-monitoring workflow large language models are strong at and getting stronger at every model generation, while the consequence of getting it wrong is expensive and rising — a combination that supports recurring paid subscriptions priced well above the AI's marginal cost, with a thin human review layer at the judgment chokepoints (ambiguous flavor-variant name matches, supplier certification disputes, and the decision to escalate to legal counsel).

Discovery rationale

This run's research sequence (18 targeted web searches/fetches) deliberately swept several adjacent, under-mined verticals flagged by the standing instruction to avoid the manifest's heavy skew toward generic multi-city permit-completeness and invoice-overbilling "desk" patterns: HR/benefits administration (ACA 1095-C/226-J reporting, COBRA administration, 401(k) nondiscrimination testing), workers' compensation experience-mod auditing, Medicaid HCBS waiver redetermination, special-education/IEP compliance, and restaurant health-inspection readiness. Manifest cross-checks (full-text and semantic) confirmed each of those five verticals already has a dedicated, materially similar prior blueprint (see Anti-Duplication Analysis). Rather than force a weak variant of an already-covered market, discovery pivoted into regulated-retail product-legality compliance — a vertical the manifest has not yet touched — and surfaced the FDA/state vape-product-authorization gap through fresh 2025-2026 sources: Truth Initiative's NielsenIQ-based unauthorized-market-share analysis, FDA's Center for Tobacco Products newsroom (recurring 2024-2026 warning-letter and civil-money-penalty batches), a 2026 GAO report on enforcement gaps, and industry compliance-vendor blogs documenting the new wave of state PMTA product registries effective through mid-2026.

Candidate comparison

Five candidates were independently researched this run. Four were rejected as duplicates of existing, materially similar manifest entries (fatal disqualifier: "can't be differentiated from existing providers" / prior work); one — the winner — was confirmed novel against the 702-entry manifest.

Because candidate 1 was the only non-duplicate, fully-evidenced option, it was carried through full CODE validation, the six-gate rubric, and the evidence threshold below rather than force-ranked against already-disqualified peers on all nineteen scoring criteria.

CODE validation

Consumer/buyer trend

Two trends are converging on the same operator right now. First, FDA enforcement against unauthorized e-cigarettes has escalated into recurring multi-retailer batch actions through 2025-2026 (warning-letter waves of 61, 80, and 115 retailers; CMP actions seeking ~$20,000 each against repeat violators) and an April 2026 GAO report criticizing the mismatch between enforcement resources and the scale of illegal sales. Second, individual states have started layering their own PMTA product registries on top of the federal list — 14 states active as of May 2026, with Virginia and Wisconsin going live July 1, 2026 and unannounced inspections following — turning "is this SKU legal to sell" into a jurisdiction-by-jurisdiction question that changes on a rolling basis.

Opportunity

The specific underserved problem: small and mid-size vape/smoke shop operators and their distributors have no practical way to keep a live, evidence-backed answer to "which of our current SKUs are actually authorized to sell in each state we operate in" — 86.3% of the market they sell into is, by definition, unauthorized product, and neither the federal marketing-order list nor any of the 14+ state registries is published in a retailer-friendly, matchable format.

Demand

Demand signals are visible in three places: (1) FDA's own recurring public enforcement newsroom posts naming batches of retailers by name; (2) a live compliance-tooling market already selling adjacent pieces of this problem (POS-integrated age-verification and compliance data feeds from vendors like Token of Trust, Qredible/Sunfire POS, and VapeRisk, and upstream PMTA-submission consulting for manufacturers from firms like Broughton Group and J&J Consulting Group); and (3) payment processors publicly documenting elevated underwriting and termination risk for vape merchants tied to unauthorized-product exposure.

Economic sizing

Primary addressable buyer pool: 10,591 US vape/e-cigarette specialty shops (IBISWorld, 2024, $8.8B category revenue) plus an unquantified but real subset of the 151,975 US convenience stores (NACS, 2026) that carry ENDS product, plus wholesale ENDS distributors (count not separately published; treated as Unverified/estimated). At an average blended subscription of roughly $500-$2,500/month per account (single-location self-serve up through multi-location portfolio and distributor tiers) and a conservative 2-6% penetration of multi-location operators and distributors over several years, the addressable recurring revenue range is roughly $4M-$25M/year before accounting for churn, CAC, or the warning-letter/CMP response line — a wide range reflecting genuine uncertainty in penetration and distributor count, not a promise.

Rubric scorecard

Target buyer

Primary ICP: Owner-operator or regional manager of an independent or small-regional vape/smoke shop chain with 3-25 locations, operating in or expanding into at least one of the 14+ states with an active PMTA product registry, carrying a rotating catalog of 150-600+ ENDS/vape SKUs across multiple brands, and lacking any dedicated regulatory-compliance staff.

Secondary/channel ICP: Regional ENDS wholesale distributors supplying 25-500+ independent retail accounts, for whom a shipment of non-conforming product into a registry state risks seizure without refund and jeopardizes downstream retailer relationships.

Buyer/economic decision-maker: The owner-operator or VP of Operations (single signer on most accounts this size); at distributors, a Director of Compliance or the General Manager.

Why this buyer, not a broader convenience-store chain: Large c-store chains typically already retain compliance counsel and enterprise GRC tooling; the underserved, reachable, and currently uninsured segment is the small-to-mid vape/smoke shop operator and the mid-size distributor — large enough to have real SKU-count and multi-state exposure, small enough to have no compliance department.

Jobs-to-be-Done

• "When I add a new flavor/brand to my shelves, tell me — before I place the order — whether it's legal to sell here and in every other state I operate in."
• "Every month, hand me a dated, evidence-backed list I can show an inspector or my landlord/franchisor proving my current catalog is authorized."
• "When an FDA warning letter or a state notice shows up, help me respond fast, correctly, and with a paper trail — before the 30-day clock runs out and a CMP defaults against me."
• "Warn me before I lose my state tobacco retail license or my card processor cuts me off because of what I didn't know was on my shelf."
• "As a distributor, stop me from shipping product into a state where it isn't authorized, so I don't get it seized at my cost and burn my retailer relationships."

Painful problem

Only about 34-41 e-cigarette products (roughly 13.7% of measured retail e-cigarette sales) have ever received FDA marketing authorization, yet the category is dominated by disposable flavored products that were never submitted, were denied, or remain in unresolved PMTA review — meaning the great majority of what is actually on vape-shop shelves nationally is, by FDA's own framework, unauthorized. FDA runs recurring, publicly-named enforcement batches (61, 80, 115 retailers at a time in recent actions) and pursues civil money penalties of roughly $20,000 per retailer for repeat violations after a warning letter is ignored or not fully corrected. Layered on top, 14+ states now run their own PMTA product registries with independent SKU lists, submission formats, and penalties — Wisconsin escalates penalties after 30 days of continued non-compliance, Virginia begins unannounced fulfillment-record inspections July 1, 2026 — and a small operator has no realistic way to track federal-plus-14-state SKU legality by hand across a catalog that turns over constantly as new flavors and disposables launch. The downside is not abstract: product seizure without refund, civil penalties, state tobacco-license suspension or revocation, and — increasingly — termination of the merchant's card-processing relationship, which can functionally shut the store down.

The outcome we sell

A done-for-you, dated, evidence-backed Authorization Pack delivered every cycle (monthly, plus on-demand before any new-SKU or new-state decision): a per-location Authorized-to-Sell list, a Remove-Now exception list citing the specific federal marketing order or state registry entry (or absence of one), a supplier-certification request pack the retailer can forward to distributors/manufacturers, and — only when needed — a Corrective-Action / CMP Response Pack with a referral to independent tobacco-regulatory counsel for any hearing. We do not sell software the retailer must operate; we sell the finished answer and the paper trail behind it. We are not legal counsel and do not represent retailers in FDA or state enforcement proceedings.

First one-feature MVP wedge

Evidence summary

18 targeted searches/fetches were run this cycle across federal agency sources (FDA CTP newsroom, FDA.gov compliance pages), a research nonprofit (Truth Initiative), trade/watchdog press (STAT News summarizing an April 2026 GAO report), and industry compliance vendors and consultancies. Strong/Verified evidence establishes: the tiny size of the FDA-authorized product list versus overall market share; a live, recurring, named-retailer federal enforcement program with real penalty dollar figures; a real and growing state PMTA-registry patchwork with specific 2026 effective dates and penalty mechanics; and the existence of adjacent paid compliance tooling and upstream PMTA consulting, which validates that this buyer segment already spends money on pieces of this problem. Two claims are explicitly Unverified this run — the count of independent ENDS distributors, and the actual at-risk-SKU detection rate a pilot operator will see — and are treated as pilot-measurement objectives, not assumptions the blueprint depends on.

Claim table (Verified / Inferred / Unverified)

Source-claim matrix

Market and demand evidence

Market size: 10,591 US vape/e-cigarette specialty shops (IBISWorld 2024, $8.8B category revenue, +18.3% shop count vs. 2022) plus a real but unquantified subset of 151,975 US convenience stores (NACS 2026) that stock ENDS products, plus an unverified number of wholesale ENDS distributors. Demand for the underlying compliance problem is visible in FDA's own recurring, publicly-named enforcement newsroom posts (batches of 61, 80, and 115 retailers), an April 2026 GAO report explicitly criticizing the mismatch between FDA enforcement capacity and the scale of the illegal market, and the buildout of 14+ independent state PMTA registries through 2026 (with more states adding registries on a rolling basis per industry trackers). Regulatory-change-driven demand growth is a defining feature here: the compliance surface area is expanding by state, not contracting.

Active buyer conversations

Public evidence of buyer-side attention includes: FDA's own named-retailer warning-letter and CMP newsroom posts (which retailers and their trade press actively track — e.g., Convenience Store News/CSP Daily News tobacco-beat coverage of these actions); industry compliance-vendor blog content written explicitly to alert retailers and distributors to the new state registries and 2026 deadlines (Token of Trust's "14 States Now Have Active PMTA Product Registries... Here Is What Every Online Vape Retailer Must Do Before July 1"); and payment-processor and merchant-services trade content documenting elevated underwriting scrutiny and account-termination risk specifically tied to unauthorized-vape-product exposure. Taken together, these are the trade-press and vendor-content equivalent of "buyers actively asking/being warned" for this category, though we did not this run capture direct forum/Reddit/Facebook-group retailer complaint threads — a gap flagged for the pilot's warm-outreach phase to close with direct buyer interviews.

Competitive landscape

Competitor and budget validation

The existence of paid POS-compliance features (Qredible/Sunfire), paid age-verification/compliance content subscriptions (Token of Trust), paid vape market-intelligence products (VapeRisk), and paid upstream PMTA consulting (Broughton, JJCC) demonstrates that retailers, distributors, and manufacturers in this category already allocate real budget to pieces of the authorization/compliance problem — this is not a market with "no competitors" because no one cares; it's a market where the pieces are sold separately and none of them delivers the finished, human-signed, monthly Authorization Pack a retailer actually needs to show an inspector. AuthList Clear is not a clone of any of these: it is the downstream, done-for-you, retailer/distributor-facing service none of them currently offers.

Pricing evidence and proposed pricing

Pricing evidence: FDA civil money penalties run ~$20,000 per retailer per enforcement action against repeat violators (verified, FDA CTP newsroom); product seizure at a distributor's cost is uncompensated; card-processing account termination can be existential for a small retailer. Against that downside, a monthly subscription priced in the hundreds to low thousands of dollars is a legible insurance-like purchase, consistent with what these operators already pay for POS/compliance software add-ons.

Never hourly. No contingency/success-fee pricing is used here — unlike an overbilling-recovery engine, the value delivered (avoided penalty, avoided seizure) is not a cleanly recoverable dollar amount, so contingency pricing would be both hard to audit and closer to a guarantee we cannot legally make; flat subscription and flat-fee pricing avoids that regulatory and credibility risk.

Regulatory and compliance considerations

Federal: Family Smoking Prevention and Tobacco Control Act, codified at FD&C Act Section 910, requires premarket authorization (a Premarket Tobacco Product Application, "PMTA") before a new tobacco/ENDS product may be legally marketed; FDA's Center for Tobacco Products maintains the Tobacco Products Marketing Orders directory of authorized products and pursues warning letters and civil money penalties against retailers selling unauthorized product. PACT Act (Prevent All Cigarette Trafficking Act) registration and age-verification/shipping rules are a related but distinct federal obligation we do not duplicate (already covered elsewhere in the manifest as an excise-tax engine) — AuthList Clear focuses on product-authorization status, not excise tax or shipping registration. State: 14+ states now operate independent PMTA product registries (e.g., North Carolina live May 1 2026; Virginia and Wisconsin effective July 1 2026) each with its own submission format, update cadence, and penalty ladder, plus separate state tobacco-retail-licensing statutes that can suspend or revoke a retailer's license for repeat violations.

Licensing boundary

AuthList Clear is an operational compliance-verification and documentation service, not a law firm and not a substitute for legal counsel. AI may extract, classify, and monitor: SKU/flavor-variant identity, matching status against the federal marketing-order directory and each state registry, and drafting of corrective-action narrative language. Trained compliance analysts may review and sign off on: ambiguous matches, supplier-certification requests, and the final Authorization Pack delivered to the client. The company does not represent retailers before FDA or any state agency, does not negotiate settlements, and does not provide legal advice on liability exposure; any warning-letter hearing or CMP settlement negotiation is referred to an independent, retailer-retained tobacco-regulatory attorney under a standard referral arrangement (fee disclosed, no kickback structure that would create a conflict). Every deliverable carries a written disclaimer: "This report is a compliance-documentation aid, not legal advice; consult qualified counsel before responding to any enforcement action." All analyst actions and AI match decisions are logged with a timestamped audit trail suitable for production to a regulator or the retailer's own attorney.

AI-native advantage

This is AI-native beyond "uses ChatGPT" in three concrete ways. First, scope: no small operator's staff can manually parse and re-check 15+ differently-formatted federal and state sources (PDF tables, state-agency web portals, CSV exports with inconsistent brand/flavor naming) every month at the SKU level across a catalog of hundreds of products — an LLM-based extraction-and-matching pipeline makes that economically possible for the first time. Second, speed and freshness: state registries update on a rolling basis (Wisconsin's own 30-day escalation clock is a good proxy for the cadence operators need); automated re-crawling and re-matching lets the desk catch a change within days instead of at the next manual audit. Third, defensibility: the audit trail an LLM-assisted pipeline produces (every match decision logged with its source citation and confidence score) is itself the evidence pack the retailer needs in an inspection or hearing — the AI's working notes become the deliverable's backbone, not just an internal tool.

Internal AI engine architecture

AI-vs-human operations pipeline

Never fully automated: the sign-off on any exception, the decision to escalate to a Corrective-Action Response Pack, and any interaction resembling legal advice or enforcement representation.

Dynasty translation layer

Anti-duplication analysis

Similar existing services: upstream PMTA-submission consultants (Broughton, JJCC) serve manufacturers, not retailers; POS-bundled "automated compliance" features (Qredible/Sunfire) and compliance-content vendors (Token of Trust, VapeRisk) sell self-serve tools or data, not a signed, human-reviewed monthly deliverable. Within the manifest itself, the closest prior entry is "Pact Act Vapor Excise Tax Compliance Engine," which addresses PACT Act excise-tax registration and reporting — an entirely different statute, workflow, and buyer pain (tax remittance vs. product-authorization legality) with no overlapping deliverable. No other manifest entry references PMTA, marketing-denial orders, or state vape-product registries. The narrow wedge that differentiates AuthList Clear: it is the only offering identified that (a) is retailer/distributor-facing rather than manufacturer-facing, (b) treats the growing state-registry patchwork as a first-class, continuously-monitored data source rather than a one-time consulting engagement, and (c) delivers a signed, dated evidence pack rather than a dashboard or data feed the retailer must interpret themselves.

Anti-commoditization analysis

If a future frontier model makes "check my SKU list against the FDA list" a trivial one-shot prompt anyone can run, the durable value does not disappear — it shifts to: (1) the continuously-maintained, always-current retrieval index across 15+ fragmented and independently-changing government sources, which is an ongoing monitoring commitment, not a one-time lookup; (2) the audit trail and human sign-off that make the pack usable as actual evidence in an inspection or hearing, which a bare model output is not; (3) the supplier-certification chase-down relationship work, which is operational, not computational; and (4) the referral network of tobacco-regulatory attorneys built over time. A retailer who "just asks an AI" gets an unverified, unsigned answer with no audit trail and no one accountable for being wrong — exactly the gap this service is built to close.

Service delivery workflow

1. Operator uploads current POS SKU export + confirms operated states via secure portal.
2. AI normalizes SKUs and cross-matches against the federal marketing-order directory and each relevant state registry, scoring confidence per match.
3. Deterministic rules force-route any low-confidence, Tier-2, or Tier-3 match to the analyst queue; nothing is auto-cleared without passing this gate.
4. Compliance analyst resolves each routed exception, contacting the supplier/manufacturer for certification documentation where status is genuinely ambiguous.
5. Analyst approves the final Authorized-to-Sell list, Remove-Now list, and supplier-certification request pack; QA samples a subset of "cleared" (non-routed) items each cycle.
6. Authorization Pack (PDF + CSV) is delivered via portal and email, dated and logged.
7. Any warning letter or state notice received by the client triggers an expedited Corrective-Action Response Pack workflow and, if a hearing is contemplated, a referral to independent counsel.
8. Renewal: pack refreshes automatically each month; any new state entered triggers a New-State Expansion Readiness Audit.

Operations as product

Structured intake checklist (SKU export format, state list, prior warning-letter history); required-evidence list per exception type (supplier certification letter, manufacturer PMTA acknowledgment number); automated completeness checks before any pack is marked ready for analyst review; an exception queue with reviewer-assignment logic by state/complexity; confidence scoring surfaced to the analyst on every routed item; a full audit trail (who/what/when/source-citation) on every match decision; version-controlled SOPs and gold-standard example packs used to onboard new analysts and to red-team the matching pipeline monthly; a root-cause review on any pack that is later found to contain an error, feeding a postmortem log that updates the SOP.

No-holes quality engine

Every SKU in a client catalog must resolve to exactly one of three states before a pack ships: (a) matched to a federal marketing order and, where applicable, a state registry entry, with citation; (b) matched to a denial/absence and placed on the Remove-Now list with citation; or (c) flagged as an unresolved exception pending analyst/supplier action and explicitly listed as "pending" in the pack — no SKU is ever silently dropped or silently cleared. QA re-runs a random 10% sample of auto-cleared matches through independent verification each cycle; any discrepancy triggers a full-catalog re-check for that client and a root-cause note.

What the human expert actually does

Minimum viable offer

Free SKU Risk Scan (lead magnet) → paid Single-Location or Multi-Location Authorization Desk subscription. The first paid offer is deliberately narrow: federal marketing-order matching plus one target state, delivered as a manually-assisted (spreadsheet + analyst) pack for the first 5 pilot clients before any custom automation is built, so the SOP is proven on real catalogs before engineering investment.

Fulfillment process

First 3 customers are fulfilled largely by hand: founder/analyst manually downloads the current FDA marketing-order list and the one relevant state registry, matches the client's SKU export in a spreadsheet with documented match logic, and produces the pack from a template. What is not automated at first: state-registry scraping (done manually per cycle), fuzzy-matching (done by eye with a documented ruleset). What is automated later, once the manual SOP is proven: retrieval-index refresh, first-pass matching, and pack templating — always kept behind the same human sign-off gate. The offer evolves from spreadsheet-plus-analyst → templated SOP → AI-assisted pipeline with human QA → (eventually) a lighter self-serve tier for single-location shops once the model is fully hardened.

Tools and systems

Launch stack: a shared spreadsheet/Airtable base for SKU matching and exception tracking, a simple secure-upload form (e.g., a form + cloud storage) for intake, a document template for the Authorization Pack, and a CRM (e.g., a lightweight pipeline tool) for renewal and exception follow-up. Post-pilot: an LLM-API-based matching pipeline, a scheduled scraper/retrieval job per source, and a client portal — built only after the manual SOP has proven the workflow on real client catalogs.

Human-in-the-loop quality control

Every pack passes two human checkpoints before delivery: the analyst who resolves routed exceptions, and a second reviewer (founder, at launch) who spot-checks the full pack against the intake checklist before release. No pack ships without both signoffs recorded in the audit log.

Nonlinear scaling and unit economics

Full COGS breakdown at scale (Year 1 target, % of revenue): model inference/API ~8-12%; hosting/software ~4-6%; compliance-analyst review minutes ~15-20%; QA sampling ~3-5%; support ~4-6%; filing/documentation costs (e.g., certified-mail, portal fees) ~2-3%; rework ~1-2%; sales follow-up ~5-8%; attorney-referral coordination overhead ~1-2% — netting to a 55-65% gross margin target, consistent with the 50%+ objective. CAC payback target: <6 months on the Multi-Location tier. Conversion assumptions (to be validated in pilots, currently Inferred): free Risk Scan → paid trial ~15-25%; pilot → paid renewal ~60-75%; annual retention ~80%+ given the recurring, regulation-driven nature of the need.

Distribution proof table

Sales and outreach plan

Lead with a diagnosis, not a demo: every outbound touch opens with a specific, named finding (e.g., "we ran your public product list against the FDA marketing-order directory and found X SKUs with no current authorization") rather than a generic pitch. Warm GTM starts with the founder's existing network plus free-scan users; targeted outbound focuses on distributors and multi-location chains, personalized around their actual state footprint and product mix.

Founder-led content plan

Founder/expert-led content teaches the exact pain: what a PMTA is and isn't, why 86% of the market is technically unauthorized, what each new state registry actually requires, what an FDA warning letter response timeline looks like, and real (anonymized) examples of what gets caught. Content is written to be genuinely useful even to someone who never buys, which is what earns trust with a skeptical, enforcement-wary retailer audience.

First 30 days of content

• 10 educational posts: (1) "What is a PMTA and why does it matter to your shelf" (2) "The 34-product federal list, explained" (3) "Reading the FDA Tobacco Products Marketing Orders directory" (4) "State PMTA registries: the 2026 list so far" (5) "What happens after an FDA warning letter — the 30-day clock" (6) "Civil money penalties: how FDA calculates them" (7) "Why your card processor cares about your SKU list" (8) "Supplier certification: what to ask for and why" (9) "New state, new registry: an expansion checklist" (10) "Distributor liability: what happens when a shipment gets seized"
• 3 diagnostic teardown formats: "We scanned a public vape-shop menu against the federal list — here's what we found" (anonymized); "Reading a real FDA warning letter line by line"; "Comparing two state registries side by side"
• 2 lead-magnet angles: Free SKU Risk Scan (upload catalog, get % exposure); "2026 State PMTA Registry Tracker" (running reference doc, gated behind email)
• 1 webinar/live-review idea: "Live shelf review: is this catalog compliant?" with a volunteer retailer's anonymized SKU list reviewed on-screen
• 1 outbound diagnosis template: "We checked [Company]'s public menu against the FDA + [state] registry and found [N] SKUs worth a second look — want the full list?"

Lead magnet and waitlist plan

Primary lead magnet: the free SKU Risk Scan — operator uploads a POS export (or even a public menu URL for a lighter version), receives a percentage-exposure estimate and a short sample of flagged SKUs (not the full pack) within 48 hours. This proves value, captures the pain signal (their actual exposure %), and creates a natural next step: "want the full Remove-Now list and supplier-certification pack? That's the paid Desk." A lead qualifies as sales-ready when they've completed a scan and either replied to the results email or booked a call.

Warm GTM plan

Founder's existing network in the trade (any prior retail/CPG/compliance contacts), free-scan users, and a short list of the earliest state-registry states' retailer associations, approached with a free scoped-review offer rather than a sales pitch: "review your current catalog against your state's new registry, no charge, to show you what the paid Desk looks like."

Targeted outbound plan

Perfect-fit prospects: multi-location vape/smoke-shop chains (3-25 locations) in the 14+ active-registry states, and ENDS wholesale distributors identifiable via trade-show exhibitor lists and industry directories. Every outbound message leads with a specific, personalized diagnosis of that prospect's actual exposure (built from their public menu or product list where available), not a generic "we do compliance" pitch.

Answer-engine/search visibility plan

Publish structured, directly-citable reference content (e.g., "Is [product] FDA authorized?" pages, a maintained state-registry tracker) written to be pulled cleanly into AI-assistant answers, with clear sourcing to FDA and state primary documents and a scan CTA embedded in every page, so operators who ask an AI assistant about a specific product land on our content and offer.

Pilot design and early-demand-trap mitigation

Pilot cohort: 5 design partners, capped, drawn from warm outreach and free-scan responders, weighted toward multi-location operators in states with a registry deadline in the next 90 days (urgency helps close pilots and stress-tests the SOP under a real deadline). Early-access incentive: 50% off the Multi-Location Desk for 3 months in exchange for structured feedback and permission to use an anonymized case study. Feedback mechanism: a short structured survey after each monthly pack plus a 15-minute call after pack #2. What counts as product feedback (feeds the SOP/rules) vs. custom work (billed separately or declined): a request to change the matching logic or pack format is product feedback; a request for one-off legal opinion work is declined and referred out. Early-demand-trap mitigation: waitlist signups and free-scan completions are explicitly not treated as validated demand — only a completed paid pilot with a renewed second month counts as real product-market signal.

Early-access feedback flywheel

Every analyst correction and every client-reported miss becomes a rule update to the deterministic-routing layer or an addition to the gold-standard SKU set used for QA and onboarding; every state-registry format quirk discovered during a pilot becomes a documented parser spec for that state, reducing future manual effort for every other client in that state.

Build-before-scale checkpoints

After 5 pilots: harden the intake checklist and required-evidence list based on what actually caused delays or disputes. After 10 pilots: harden SOPs, the exception queue's routing rules, and reviewer checklists based on observed match-confidence accuracy. After 20 pilots: pause new pilot intake until COGS, rework rate, escalation rate, and cycle time are actually measured and reviewed before continuing to scale — never scale pilots by adding analysts faster than the SOP is proven; a rising manual-exception rate per client is the signal the model isn't yet scalable, while a stable or falling rate with growing client count is the signal it's ready to scale.

7-day / 30-day / 90-day launch plans

7 days

• Stand up the free SKU Risk Scan intake form and manual scoring process
• Publish first 3 educational posts
• Identify and warm-outreach the first 15 candidate pilot accounts

30 days

• Close 5 pilot design partners; deliver first monthly packs manually via spreadsheet + template
• Publish remaining first-30-days content set
• Run first live-review webinar

90 days

• Deliver 3 consecutive monthly cycles to all 5 pilots; hit the MVP success metric (<2% ambiguous-match rate by cycle 3)
• Begin automating first-pass matching behind the human sign-off gate
• Open the Distributor Channel Desk conversation with 2-3 target distributors identified during pilot outreach

Metrics and KPIs

• Free scans completed / week; scan-to-paid conversion %
• Pilot-to-paid-renewal rate (2nd month renewal)
• Cycle time (intake to delivered pack)
• Analyst-flagged exception rate per client per cycle (trend down = SOP maturing)
• Post-delivery error/rework rate
• Gross margin per client cohort
• Escalations to Corrective-Action Pack (volume and outcome)
• Monthly recurring revenue and net revenue retention

Risks and mitigations

The largest risks are regulatory-model risk (state registry formats and rules changing faster than the retrieval pipeline can be updated), false-clearance risk (an incorrect "authorized" determination exposing the client to the exact penalty we're selling protection from), and market-education risk (operators underestimating their exposure until an enforcement action actually hits them). Mitigations: the deterministic force-routing rule keeps low-confidence matches out of automated clearance entirely; every pack is dated and versioned so a later correction can be issued and tracked; and the free Risk Scan itself is the primary market-education tool, converting abstract risk into a concrete, named percentage before any sales conversation happens.

Exhaustive risk register

What could kill this

The scenario most likely to kill this business is not enforcement fading (see risk register) but a failure of the core deliverable's accuracy — if the matching pipeline produces even a small rate of false clearances that lead to a real client enforcement action, trust in a compliance-service category collapses fast, and word travels quickly in a tight trade community. The second most dangerous scenario is discovering during pilots that the addressable multi-location/distributor base is smaller or less willing to pay recurring fees than estimated, in which case the honest next step is to pivot pricing toward transaction/audit-based fees or to the single-location self-serve tier earlier than planned, not to force the subscription model.

Go/no-go reasoning

Go. The problem is specific, painful, actively enforced, and getting more complex by the state, not less. The buyer is narrow and reachable. Existing paid tooling and consulting in adjacent slices of the same problem validate willingness to pay without being direct substitutes. The MVP wedge (one state, one federal list, five pilots, manual-first) is genuinely narrow and can be fulfilled by a founder plus one analyst before any custom platform is built. The clearest gaps — exact distributor count and real-world at-risk-SKU detection rate — are appropriately treated as pilot-measurement objectives rather than blueprint assumptions, which is consistent with a disciplined evidence threshold rather than a reason to withhold a Go decision.

Final recommendation

Proceed to build AuthList Clear as specified: launch the free SKU Risk Scan and the Single-Location/Multi-Location Authorization Desk, fulfill the first 5 pilots manually against the federal list plus each pilot's most urgent state registry, and automate the matching pipeline only after the manual SOP is proven — expanding state coverage, then the distributor channel, then a lighter self-serve tier, in that order.

Source list

• Truth Initiative — U.S. retail sales data show 86% of e-cigarette sales are for unauthorized products
• Truth Initiative — The majority of e-cigarettes on the market are illegal
• FDA — Tobacco Products Marketing Orders
• FDA — Advisory and Enforcement Actions Against Industry for Unauthorized Tobacco Products
• FDA — Retail Sales of Tobacco Products
• FDA — Tobacco Retailer Warning Letters
• FDA CTP Newsroom — FDA seeks approximately $20,000 each from 22 retailers selling Elf Bar and other unauthorized e-cigarettes
• FDA CTP Newsroom — FDA issues warning letters to 80 retailers selling unauthorized Elf Bar and Lost Mary e-cigarettes
• FDA CTP Newsroom — FDA warns 61 brick-and-mortar retailers over sale of unauthorized e-cigarettes popular among youth
• Buchanan Ingersoll & Rooney — FDA issues 115 warning letters to retailers selling unauthorized e-cigarettes
• FDA — Statement from FDA Commissioner Marty Makary, M.D., M.P.H. encouraging retailers to stop selling illegal vapes
• STAT News — GAO report shows gap between scale of illegal vapes and enforcement (Apr 10, 2026)
• Token of Trust — FDA's 2026 Enforcement Guidance for Vape Retailers: Three Inventory Risk Tiers
• Token of Trust — 14 States Now Have Active PMTA Product Registries
• Token of Trust — PMTA Directory Laws: What Vape and Nicotine Businesses Need to Know Now
• NACS — U.S. Convenience Store Count
• mydelta8store.com — How Many Vape Shops and Stores Are in the US? (IBISWorld-sourced figures)
• Sunfire POS / Qredible — Automated Compliance for Smoke Shops, Vape Shops & CBD Retailers
• VapeRisk — Vape Compliance & Market Intelligence
• vapecompliance.com — E-liquid & Vape Hardware Regulatory Compliance
• Broughton Group — Premarket Tobacco Product Application (PMTA) services
• J&J Consulting Group (JJCC) — PMTA Expert Consulting Guide