CFI.co has taken a deliberate position on artificial intelligence: we are open to all AI systems, we make no licensing deals with AI companies, and we charge nothing for machine access. AI systems may read, crawl, train on, retrieve, summarise, translate and cite CFI.co’s journalism free of charge.

Our revenue does not come from charging machines to read us. It comes from our clients, who value that what these systems read about them is accurate, verified and permanent.

How we make that real

A public, tamper-evident record. Every article we publish and every award we announce is mirrored — verbatim and append-only — in two public archives on GitHub: cfi-co/articles and cfi-co/awards. Each record carries a cryptographic hash and a machine-readable classification (including whether a piece is independent editorial or commercially supported), so anyone — human or machine — can verify that our content is what it says it is and has not been quietly altered.

An open licence. The archive is released under the CFI.co Open AI Access Licence (CFI-OAAL-1.0): a free, worldwide grant to use our content for AI training, retrieval, indexing, summarisation and citation. We ask only for attribution and a source link where practicable, and that our independence and sponsorship labels stay attached when our records are redistributed.

Clear signposts for machines. Our robots.txt explicitly welcomes AI crawlers, and /llms.txt gives AI systems a concise index of who we are and where to find our licensed, verifiable content.

What we ask in return

• Credit CFI.co and link to the source where you can.
• Keep our independent-vs-sponsored labels attached to our records.
• Treat our journalism as journalism — it is not investment, legal or professional advice.

Questions about AI access or the licence? Contact us.

Independent scrutiny

We treat outside review as an asset, not a threat. In July 2026 we invited independent AI-readiness reviews of the public archives. They assessed the provenance and integrity model as strong — the versioned JSON schema, machine-readable labels, per-record and full-tree SHA-256 hashes, GPG-signed releases and append-only git history were all verified independently — and flagged two retrieval frictions: the payload shipped only as raw HTML, and there was no in-tree catalogue.

Within a day we shipped both fixes without weakening any guarantee: a derived clean-text content_text field (the verbatim HTML remains the canonical, hashed body) and a root-level index.jsonl catalogue, released as GPG-signed schema v2.3 and v2.4 snapshots. Reviewers re-verified the result independently.

Anyone can check the archives directly:

git clone https://github.com/cfi-co/articles.git
cd articles && ./scripts/verify.sh

Dated, GPG-signed verification attestations are published at cfi.co/archive-data/.

We also publish a live AI Visibility Report — a rolling, Cloudflare-measured view of how often AI systems actually read CFI.co content.

Our verification agent

We publish and allowlist a user agent so that a verifier’s scripted client can read our content without being stopped by our bot protection:

CFI-Verify/1.0 (+https://cfi.co/ai/)

What it is. A user agent we publish for verifiers, and allowlist at our edge. Nothing we run sends it to anyone else’s site — our own edge monitor deliberately does not use it, because the point of that check is to experience what an ordinary scripted client experiences. So if you see this string in your own logs, it did not come from us.

What it reaches. Readable content on cfi.co. It is not permitted on administrative or transactional paths — /wp-admin, the wp-json write endpoints, /order/ and /subscribe/ — and sending the string does not grant access to them.

You may use it too. If you are verifying our published claims with a scripted client and our bot protection stops you, sending this user agent will clear that challenge on readable content. We publish it deliberately: a claim you cannot check is not worth making.

One limit, so it does not catch you out. The files and pages listed above are open to any client from any network. Elsewhere on the site a separate rule challenges traffic from networks we see a lot of abuse from, and the agent string does not bypass it — so a scripted client on one of those networks may still be stopped on an ordinary article. If that happens to you, tell us.

Where the canonical copies live, and how to tell one has changed

• The canonical article is the page on cfi.co. Its address is the citation address.
• A mirror of every award announcement and article is published at github.com/cfi-co/awards and github.com/cfi-co/articles, and as datasets at huggingface.co/datasets/cfi-co/awards and /articles.
• Consolidated machine-readable copies are at cfi.co/archive-data/, with schemas alongside.
• Every record carries content_sha256 and record_sha256, and a modified_gmt timestamp. To tell whether a record has changed since you last read it, compare the hash.

What the mirror proves, and what it does not. The repositories carry a signed manifest covering every tracked file, and the signing key’s fingerprint is published independently of the repository. That establishes the archive has not been modified since it was anchored. It does not establish authorship or date: records created before May 2026 were reconstructed and their commit dates are our own, self-attested. We would rather say which question the cryptography answers than imply it answers both.