Edition of

The state of compliance, in six figures

Sample of organisations (self-assessments · external observations). No cut is published below the threshold.

Note for management: these indicators measure the absence of public signal, not compliance. Going up means getting worse.

Historical series

A single figure is an anecdote. The series is the data.

Observatory status · First edition: 10 September 2026

693observations

in the Index · the publication threshold is one hundred, long since passed

No percentage is published below one hundred observations. No published edition is recalculated afterwards.

With fifteen responses a percentage carries ±25 points of margin: you could publish 60 % when the true figure is anywhere between 35 and 85.

Exclusive preview · closed report figure

0of 21 large companies

None of the 21 large companies and consultancies with a valid observation publishes an AI use policy.

This measures absence of public signal, not non-compliance. The remaining figures are published on 10 September.

‹ Measure your organisation in 90 seconds Free · no sign-up · your data joins the Index

You can contribute your data — and learn where you stand — in ninety seconds.

Methodology

Without literacy, reskilling and governance, AI is a risk, not an advantage. It is what we have been arguing for more than two years and what the CriterIA© seal verifies: it trains the organisation's people, verifies seventy-nine points across eight dimensions and three pillars and issues a seal anyone can check without going through us. This indicator measures the public signal of the third; the other two are not visible from outside.

What this index measures and what it does not

The distinction matters more than the figures: what an organisation declares about itself and what is observed from outside are not the same thing.

What it does measure

Declared exposure to Article 50 — the organisation states that its AI reaches customers or that it publishes generated content.
Observable absence of the AI notice — the required warning is not found at the first interaction.
Observable absence of disclosure in the Article 50.4 situations that apply: deepfakes and text published to inform the public on matters of public interest.
Absence of a published or declared AI use policy.
Absence of a register or inventory of the AI systems in use.
No public evidence of AI literacy measures. Article 4 requires organisations to take measures to support AI literacy; it does not require documented or certified training.

What it does not measure

It is not a legal opinion. It flags the absence of public signals, not a declared infringement.
It does not confuse exposure with non-compliance. Self-assessment only yields exposure: external observation can assess whether a notice is present, but not establish full compliance, since clarity, timing and accessibility also count.
It is not a probability sample of the Spanish economy. It is a convenience sample and is declared as such.
It identifies nobody. No domain, no email, no IP. The time window recorded is the month, not the instant.
It is not recalculated. Once an edition is published, its figures are frozen even if more responses arrive later.

First edition · 10 September 2026

Neither size nor sector explains anything

The usual objection is that SMEs lack the resources. We are also measuring those who have them. The breakdown by segment is published with the first edition, not before.

Four blocks, four separate series: universities and business schools, large companies and consultancies, SMEs, and public administrations. They are never averaged together.

Analyses that cannot be completed due to crawler blocking are excluded from the calculation and do not count as non-compliance.

CriterIA© Observatory