1. Thesis

The Belgium NIS2 Conformity Evidence Desk sells Belgian essential and important entities a done-for-you, auditor-facing evidence packet that maps current controls, policies, incident-response records, supplier files, management-body oversight, and remediation exceptions to the Belgian NIS2/CyberFundamentals or ISO pathway. The buyer is not asked to operate an AI compliance tool; a human cybersecurity/compliance lead receives, reviews, and submits a source-linked workpaper set prepared by an internal AI evidence engine and approved at explicit expert chokepoints.

2. Discovery rationale

The run scanned cybersecurity regulation, AI governance, securities filing access, climate disclosure, consumer subscription rules, and medical-device laboratory deadlines. NIS2 Belgium won because it combined official, current regulatory timing with concrete evidence pathways, cross-sector buyer urgency, and a workflow that is heavily document-based but still requires human cyber judgment. Click-to-cancel and LDT were rejected because current court or FDA actions weakened the regulatory trigger; SB 261 was weakened by enforcement uncertainty; EDGAR Next was credible but narrower and less repeatable.

3. Candidate comparison

4. Hard disqualifier check

5. Rubric scorecard

6. Opportunity

The wedge is not broad cyber consulting. It is turning scattered operational proof into a packet that a management body, CISO, and assessor can inspect without manually rebuilding the evidence chain.

7. Evidence quality and source-claim matrix

8. Why now

Verified

Belgium's CCB identified April 18, 2026 as a critical milestone for essential entities to demonstrate implementation and a recognized pathway. NIS2 requires risk-management and incident-reporting obligations across covered sectors. CCB's 2026 threat landscape says Belgian organizations remain under sustained pressure from ransomware, DDoS, account compromise, supply-chain attacks, and AI-enabled cyber operations.

Inferred

Post-deadline entities that have partial documentation will need remediation and evidence normalization more than generic policy templates. Ireland's CyFun adoption suggests the Belgian control-evidence architecture may become more reusable.

Unverified

No buyer interviews were conducted in this run, so willingness to pay for a specialized packet desk remains unverified until pilots.

9. Customer & PMF

10. The outcome we sell

Deliverable: a source-linked NIS2/CyFun or ISO evidence packet for one legal entity, with control map, evidence index, missing-proof register, remediation tasks, incident-reporting drill output, supplier-risk appendix, and management-body signoff memo.

Acceptance criteria: every claimed control status has linked evidence, owner, date, framework reference, reviewer decision, and exception path. Exclusions: formal certification, legal advice, penetration testing, and implementation of technical controls unless separately scoped. Rework policy: one assessor-feedback revision is included when the customer supplies the requested source evidence within ten business days.

11. Internal AI engine architecture

12. AI-vs-human operations pipeline

13. Operations as product

Variance is eliminated through a fixed kickoff questionnaire, framework-version lock, required evidence checklist, evidence freshness rules, confidence scoring, reviewer assignment by control domain, exception queues, source-link audits, and postmortems after every assessor comment. The operation becomes a factory for control evidence, not a bespoke consulting essay.

14. No-holes quality engine

• No hallucinated citations: every control assertion links to a customer source file or official framework source.
• No silent green statuses: green requires source, owner, effective date, reviewer, and test result where applicable.
• No stale evidence: policies, tests, incidents, suppliers, and board approvals get freshness thresholds.
• No certification claims: the service says readiness packet, not certified compliant.
• No hidden remediation: gaps become priced remediation tasks or exclusions.

15. Pricing, pricing legality, and unit economics

Primary pricing: fixed per-entity packet, starting at EUR 12k-25k for a 30-40 control pilot, EUR 35k-85k for full Important/Essential readiness depending on scope, plus EUR 2k-6k monthly refresh. These are inferred price hypotheses from compliance-consulting precedent and must be tested.

Why not hourly: hourly billing rewards slow evidence collection and prevents operating leverage. Pricing legality: avoid contingency based on regulatory outcomes; charge for packet production and remediation deliverables. Unit economics: pilot COGS EUR 7k-12k; mature COGS EUR 14k-25k on a EUR 45k packet; model cost under EUR 200; reviewer time target 6-12 hours per packet; mature gross margin target 55-65%.

16. Nonlinear scaling plan

Start with a 34-control pilot pack, then reuse control evidence schemas, request templates, source parsers, and assessor-feedback libraries. Target 70% automated evidence classification, 50% automated first-pass gap narratives, under 20% escalation rate, and two packets per reviewer per week once intake quality stabilizes.

17. Moat & Sam Altman test

Better models improve extraction from messy policies, SOC tickets, vendor questionnaires, and board minutes, which expands throughput and lowers reviewer time. The moat is not generic drafting; it is the versioned Belgian NIS2/CyFun evidence ontology, assessor-feedback corpus, secure chain-of-custody, partner network, and disciplined claim boundary. The strongest commoditization threat is GRC platforms adding good NIS2 evidence mapping; the counter is faster done-for-you packet delivery and CAB-ready remediation workflows.

18. Buyer-specific go-to-market

Selected GTM: founder-led outbound plus CAB, ISO consultant, MSSP, and cyber-insurance channel partnerships. First 50 prospects: Belgian mid-market essential/important entities with public NIS2 exposure, recent cyber incidents, supplier-risk intensity, or visible ISO/CyFun activity. Trigger events: missed April milestone, assessor scheduling, board cyber review, cyber-insurance renewal, incident tabletop failure. Outreach wedge: "we turn your existing evidence into a CCB/CAB-ready packet in 21 days and show the exact gaps you should not claim."

Conversion path: free 10-control evidence sanity check, paid 34-control pilot, full readiness packet, quarterly refresh. Expected sales cycle: 3-8 weeks. Proof before scaling: two paid pilots, assessor feedback accepted, reviewer time under target, and less than 15% quality rework.

19. Pilot design and early-demand trap mitigation

Run a capped pilot with three entities, one pathway, and 30-40 controls. Success means 95% source-linked claims, a board-ready memo accepted by the sponsor, assessor/cyber reviewer feedback with fewer than five major packet defects, and a repeatable evidence request list. Kill if buyers only want cheap template libraries, refuse secure evidence access, or require broad implementation labor before valuing the packet.

20. Competitive landscape

Incumbents: big-four cyber practices, ISO consultants, Belgian CAB ecosystem, MSSPs, GRC platforms. AI-native competitors: compliance automation vendors adding AI evidence mapping. Services firms: NIS2 readiness advisors, incident-response firms, supplier-risk consultants. Internal teams: CISO/GRC teams using spreadsheets and SharePoint evidence rooms. Do nothing: wait for assessor or regulator requests and respond reactively.

21. Regulation, compliance, and licensing boundary

NIS2 creates the risk-management and reporting basis; Belgium's CCB and CyberFundamentals materials define the local evidence pathway. The desk must not present itself as a CAB, ISO certification body, law firm, or regulator. Counsel-approved disclaimers should say the service prepares evidence and remediation workpapers, while formal assessments, certifications, regulatory decisions, and legal opinions remain with authorized professionals and authorities. Privacy controls include EU hosting, encryption, redaction, least-privilege reviewer access, retention limits, and immutable audit logs.

22. Compact founding team and expert map

23. Exhaustive risk register

24. Tech stack & build plan

Stack: secure document intake, Postgres evidence graph, object storage with per-file hash, queue-based extraction workers, OCR for PDFs, LLM extraction/classification with schema validation, deterministic control rules, reviewer UI, packet renderer, and audit-log stream. Build sequence: framework library, evidence schema, intake checklist, control map renderer, reviewer queue, packet PDF/HTML export, incident-drill module, supplier appendix, and assessor feedback loop.

25. Dynasty translation layer

Classification: Dynasty vertical blueprint. Fit: clear buyer, paid outcome, repeatable inputs, deterministic controls, guided activation path, and strong evidence objects. Modules: entity scoping, pathway selection, secure evidence intake, CyFun/ISO control mapper, incident-reporting drill, supplier-risk appendix, exception queue, reviewer approval, packet renderer, refresh monitor. Tenant objects: entity, site, service, control, evidence item, supplier, incident drill, reviewer decision, exception, remediation task, framework version, board memo.

Activation path: guided; instant activation would be unsafe until evidence access, security review, and reviewer assignment are complete. Warranted claims: packet production, evidence mapping, gap register, and readiness workpaper. Unwarranted claims: certification, guaranteed compliance, legal advice, or regulator acceptance. Deployability guess: spec. Anti-duplication: unlike Dynasty's generic service-business automation/HVAC module ladder, this is a regulated Belgian cybersecurity evidence workflow with CAB-facing artifacts. Recommendation: pilot.

26. Metrics & KPIs

27. What could kill this

The business fails if Belgian entities believe NIS2 is already solved, if the team cannot safely access sensitive evidence, if buyers demand broad cyber implementation rather than packet production, if assessors reject the packet format, if GRC tools produce equivalent evidence rooms, or if human review time stays too high for fixed pricing.

28. 90-day validation and launch plan

Weeks 1-2: interview CAB/ISO/MSSP partners, lock engagement boundary, build 34-control evidence checklist. Weeks 3-4: recruit three Belgian pilot entities and run free 10-control sanity checks. Weeks 5-7: deliver paid pilot packets, track minutes per control, reviewer overturns, and missing evidence causes. Weeks 8-10: incorporate assessor feedback, package remediation bundles, and publish anonymized sample packet. Weeks 11-13: close first quarterly refresh contracts and decide whether to expand to Ireland CyFun or stay Belgium-only. Kill if no paid pilot signs by week 6 or if packet COGS cannot fall below 55% by the third pilot.

29. Sources

• European Commission AI Act page
• EUR-Lex NIS2 Directive text
• CCB NIS2 April 18, 2026 deadline
• Safeonweb NIS2 law page
• Safeonweb CyberFundamentals Framework
• Safeonweb NIS2 and CyberFundamentals FAQ
• CCB FAQ NIS2 Belgium PDF
• CCB 2026 Belgian cyber threat landscape
• Ireland NCSC CyFun page
• Brand Compliance CyFun accreditation
• Elevate Consult NIS2 readiness service
• Hyperproof NIS2 requirements overview
• DORA register prior blueprint anti-duplication

Machine-checkable validation

• Exactly one hour-01 output produced: this HTML plus matching PDF.
• Manifest updated at root override path.
• All 29 required sections present.
• At least five candidates considered.
• Source-claim matrix present.
• At least 10 risk details included.
• Dynasty reference and addendum found and read.
• No remote scripts, remote fonts, external frameworks, or CSS nesting used.

Judgment validation

The business is a done-for-you outcome service, not a customer-operated co-pilot. It is adjacent to prior DORA and NYDFS cybersecurity blueprints, but it is not duplicative because it uses Belgian NIS2/CyFun control evidence, national assessment pathways, cross-sector entity scope, and CAB/CCB-ready packet delivery. The biggest uncertainty is direct willingness to pay after the April 18 milestone; the first 90 days must test that before scaling.