Risk Register & Mitigations

The biggest risk in this company is the simplest one: it has not signed its first paying contract. Everything else is secondary to that. This register sets out the risks we see, grouped by kind, and what is being done about each, without softening the ones that matter.

The existential risk

No signed revenue yet. CeibaQ is pre-revenue, and the entire thesis depends on reaching the first contract, GATE 0. This is the number-one due-diligence question and we treat it as one. The mitigation is threefold: two entry tracks are pursued in parallel so the company is not betting on a single counterparty; the field pilot calibrates the model independently of any contract, so the asset is built whether or not the first deal closes on time; and the case is structured so that a floor data business — selling to companies, insurers and registries — stands even if no government ever adopts the jurisdictional layer.
Dependence on one jurisdiction at entry. The first contract concentrates on a single jurisdiction. The mitigation is to run the two entry hypotheses as a hedge and to open a second jurisdiction early, so the denominator is not hostage to one relationship.

Financial and structural risks

The grant is not secured. The roughly $19.3M non-dilutive backbone is planned, not in hand. We treat the no-grant path as a co-base, not a remote downside: the fallback is concessional debt, which preserves founder control, with the dilution paths in Cap Table & Dilution and the financial impact in Downside & Stress.
Payer credit risk. A regional government can be slow to execute its own budget. The mitigation is to route payment through the national environmental fund PROFONANPE by escrow or direct pay, and to favour the grant and donor track over a jurisdiction's own thin budget.
Gross-versus-net revenue recognition. As a subcontractor, an auditor could require revenue to be shown net rather than gross, lowering the headline. The contracts are structured as a service procurement with CeibaQ as principal to support gross recognition; this is covered in Accounting, Tax & IFRS and flagged as a structuring goal.
Tax-rate eligibility. The 5% Amazon tax rate for the data company rests on a position that Peruvian counsel must confirm, with a 10% or 29.5% fallback.

Execution and technical risks

Field measurement must prove out. The model depends on hitting biomass error under 15% on the pilot, and on sensor nodes surviving and powering under the canopy. The mitigation is that the pre-seed funds exactly this pilot, so the field numbers are validated before any scale-up.
Independent-verifier acceptance. The monitoring stream (IS3) is only worth its price if a validation body accepts the output and it qualifies as allowed evidence under the carbon methodology. The mitigation is an API that returns uncertainty and signed provenance on every value, and a calibration campaign against the developer's own plots before the first verification.
Capacity at scale. Expanding across jurisdictions with a small team is a real constraint. The mitigation is a capacity gate: the sales and field build-out starts only after the growth round and the hires it funds, not before.
Key-person dependence. The company is closely identified with its founder. The mitigation is a real senior team and advisory bench, a reserved option pool for a chief technology officer and other leadership hires, and the governance set out in Team & Governance.

Legal, data-rights and moat risks

Intellectual-property assignments are unsigned. The inventor and contractor assignments to AWAKEN AI must be executed before due diligence; completing them is a named step of this round.
Biodiversity-data and indigenous-data rights. Environmental-DNA and any data touching indigenous territory carry a separate legal regime under the Nagoya Protocol and Peru's law on collective indigenous knowledge. The mitigation is to keep that data behind an access firewall, to complete benefit-sharing and free, prior and informed consent agreements, and to enter indigenous programs as a measurement supplier, not an owner of the communities' data.
Open data could erode the enterprise moat. A public-good version of the jurisdictional product could leak the layer that the data license depends on. The mitigation is a deliverable-specification firewall: only the final degradation output is ever made public, while the reference model, the AI weights and the eDNA library stay private as background intellectual property.

Market risks

Carbon-market credibility. The voluntary carbon market is still rebuilding trust after 2023. The mitigation is that CeibaQ sells into the regulated and integrity-driven tailwind — the EU deforestation rules, Article 6.2 and mandatory disclosure — where verified data is becoming a requirement rather than a preference.
Competition and new entrants. Incumbents carry more capital, and the EU-compliance tools, the large ESG-data houses and government monitoring programs could expand into the space. The mitigation is the regulated tailwind and the first signed contract, and the structural point that the players who read the forest from a distance depend on the ground layer they cannot build, which turns competitors into customers.

The honest read

This is a long list because we would rather show it than have it found. But the risks are not equal. The financial, legal and execution risks are the ordinary risks of an early company, and each has a concrete mitigation already in motion. The one risk that dominates the rest is the first one: the company is pre-revenue, and the plan has to reach GATE 0. The whole structure of this raise — a small bridge, a de-risking pilot, two entry tracks and a floor business that does not need government adoption — is built around retiring exactly that risk first.