Risks and Mitigations

Risk	Likelihood	Impact	Mitigation
Cryptographic flaw in firmware	Low	Critical	External audit; mainstream curve and library; conservative receipt format
Signer-key compromise	Low	Critical	KMS/HSM with multi-region access controls; multi-signer firmware support; rotation procedure with overlapping validity
Hardware partner slippage	Medium	High	Maintain at least two qualified launch partners; treat OEM dates as soft until contracts signed
BLE UX too painful for non-technical users	Medium	High	Pilot specifically tests this; fall back to QR-coded receipts as a secondary path if BLE adoption disappoints
Token-price volatility makes subscription pricing impractical	High	Medium	Subscription tiers priced in USD-denominated reference amount and converted to TATSU at burn time using a published exchange-rate schedule
Regulatory uncertainty (token + IoT)	Medium	Medium	Conservative jurisdictional choice; legal review before mainnet; clear separation between TATSU utility and any speculative claims
Competing approach gains traction first	Medium	Low	The architecture is a moat in itself; first-mover advantage is real but not decisive