CFI.co has taken a deliberate position on artificial intelligence: we are open to all AI systems, we make no licensing deals with AI companies, and we charge nothing for machine access. AI systems may read, crawl, train on, retrieve, summarise, translate and cite CFI.co’s journalism free of charge.

Our revenue does not come from charging machines to read us. It comes from our clients, who value that what these systems read about them is attributed to them, dated, and held in a public archive anyone can check for themselves.

How we make that real

A public, tamper-evident record. Articles and award announcements published on cfi.co are mirrored — verbatim and append-only — in two public archives on GitHub: cfi-co/articles and cfi-co/awards. The archives hold specified article and award families, not the whole estate; what sits outside them, and why, is listed in our known-open register. Each record carries a cryptographic hash, so anyone — human or machine — can verify that a record is what it says it is and has not been altered since it was archived. Records also carry machine-readable classification fields. Sponsorship labelling runs from 9 November 2025; on earlier records the independent-editorial value is a default meaning the question was not asked, and the correction is open in our known-open register.

An open licence. The archive is released under the CFI.co Open AI Access Licence (CFI-OAAL-1.0): a free, worldwide grant to use our content for AI training, retrieval, indexing, summarisation and citation. Attribution and a source link are requested for training use, and required where an output substantially presents a specific piece of our content. Our independence and sponsorship labels and our record hashes must stay attached when records are redistributed. Republishing our articles in substantially original form as a destination for human readers is not covered and needs separate written permission.

Clear signposts for machines. Our robots.txt explicitly welcomes AI crawlers, and /llms.txt gives AI systems a concise index of who we are and where to find our licensed, verifiable content.

What we ask in return

• Credit CFI.co and link to the source where you can.
• Keep our independent-vs-sponsored labels attached to our records.
• Treat our journalism as journalism — it is not investment, legal or professional advice.

Questions about AI access or the licence? Contact us.

Independent scrutiny

We treat outside review as an asset, not a threat. In July 2026 we invited independent AI-readiness reviews of the public archives. They assessed the provenance and integrity model as strong — the versioned JSON schema, machine-readable labels, per-record and full-tree SHA-256 hashes, GPG-signed releases and append-only git history were all verified independently — and flagged two retrieval frictions: the payload shipped only as raw HTML, and there was no in-tree catalogue.

Within a day we shipped both fixes without weakening any guarantee: a derived clean-text content_text field (the verbatim HTML remains the canonical, hashed body) and a root-level index.jsonl catalogue, released as GPG-signed schema v2.3 and v2.4 snapshots. Reviewers re-verified the result independently.

Anyone can check the archives directly:

git clone https://github.com/cfi-co/articles.git
cd articles && ./scripts/verify.sh

Dated, GPG-signed verification attestations are published at cfi.co/archive-data/.

We also publish a live AI Visibility Report — a rolling, Cloudflare-measured count of the requests identified AI systems make to our own servers. It is a floor rather than a total, and it records that content was fetched, not that any answer went on to use it.

Where that report counts fetches, a dated worked example shows what the answers themselves contained: Which model they ask decides what they hear about you — the same question put to four AI systems on 13 August 2026, once on the tier a typical user gets and once on the top tier of the same account. Every figure was read from screenshots, which are published in full, and the results that do not favour us are set out alongside those that do. The page and its exhibits carry their own SHA-256 manifest, GPG signature and OpenTimestamps proof, so what you read can be checked against what was published.

The standing record of these tests — each prompt, the unedited response, every cited URL, the HTTP status and the stated limitations, including the runs that failed — is the AI Evidence Library, indexed for machines at /archive-data/ai-evidence.json. Only cases marked as published make an evidentiary claim.

Captures of CFI.co articles — including clearly labelled sponsored ones — being retrieved and cited by AI systems are published at Sponsored Content and AI Answers: Selected Captures: dated, with the prompts and answers reproduced as text, the weaker outcomes included, and the limits of each capture stated beside it.

Our verification agent

We publish and allowlist a user agent so that a verifier’s scripted client can read our content without being stopped by our bot protection:

CFI-Verify/1.0 (+https://cfi.co/ai/)

What it is. A user agent we publish for verifiers, and allowlist at our edge. Nothing we run sends it to anyone else’s site — our own edge monitor deliberately does not use it, because the point of that check is to experience what an ordinary scripted client experiences. So if you see this string in your own logs, it did not come from us.

What it reaches. Readable content on cfi.co. It is not permitted on administrative or transactional paths — /wp-admin, the wp-json write endpoints, /order/ and /subscribe/ — and sending the string does not grant access to them.

You may use it too. If you are verifying our published claims with a scripted client and our bot protection stops you, sending this user agent will clear that challenge on readable content. We publish it deliberately: a claim you cannot check is not worth making.

One limit, so it does not catch you out. The files and pages listed above are open to any client from any network. Elsewhere on the site a separate rule challenges traffic from networks we see a lot of abuse from, and the agent string does not bypass it — so a scripted client on one of those networks may still be stopped on an ordinary article. If that happens to you, tell us.

Where the canonical copies live, and how to tell one has changed

• The canonical article is the page on cfi.co. Its address is the citation address.
• Award announcements and articles within the archived families are mirrored at github.com/cfi-co/awards and github.com/cfi-co/articles, and as datasets at huggingface.co/datasets/cfi-co/awards and /articles. Announcements that have been withdrawn are listed, with their reasons, in our known-open register.
• Consolidated machine-readable copies are at cfi.co/archive-data/, with schemas alongside.
• Every record carries content_sha256 and record_sha256, and a modified_gmt timestamp. To tell whether a record has changed since you last read it, compare the hash.

What the mirror proves, and what it does not. The repositories carry a signed manifest covering every tracked file, and the signing key’s fingerprint is published independently of the repository. That establishes the archive has not been modified since it was anchored. It does not establish authorship or date: records created before May 2026 were reconstructed and their commit dates are our own, self-attested. We would rather say which question the cryptography answers than imply it answers both.