CO-ORGANISED BY
VENUE
TAKING PART
AI without literacy, without reskilling and without governance does not scale productivity: it scales risk.
The CriterIA© Observatory measures twice a year which public AI-governance signals related to the EU AI Act can be seen from outside in a sample of Spanish organisations: SMEs and the wider business fabric, large companies, universities and schools, and public administrations. The Index is presented in four indicators, calculated only from the signals that the CriterIA© Radar observes automatically on corporate websites. What organisations declare voluntarily and anonymously in the CriterIA© 7, and the analyses they request with Huella de IA©, are recorded separately and are never mixed with those four indicators: from the second edition, on 20 April 2027, they are published in an indicator of their own, D5, in a separate chapter. From that edition, a general indicator also summarises D1 to D4 and is published alongside them, never instead of them; D5 is not part of it. No organisation is named.
NEWAI Damage Report: the first cases on 20 November ‹
REGULATION (EU) 2024/1689 · ARTS. 4 AND 50 · FIRST EDITION 20·10·2026 · SECOND EDITION 20·04·2027
Final cut-off 15 October 2026 · first edition presented on 20 October
with enough read to enter the first edition of the Index, presented on 20 October 2026 in Madrid with AEEN
25,873 websites visited · 18,137 read · 14,514 with enough read to enter the Index · 1,853 conversational channels detected
Final figures as of 15 October 2026, 23:59. The data file is sealed with SHA-256, anchored in Bitcoin block 971,838 on 17 October 2026, and is never recalculated: the receipt is checked at the seal of the Spanish page.
No percentage is published below one hundred observations: with fifteen, a single change moves the result by tens of points. It is an editorial rule, not a statistical one, and reaching one hundred does not turn a convenience sample into a representative one. We would rather be late than publish a figure that would not survive a question.
Exclusive preview · closed report figure
Of the 761 organisations with a conversational channel detected on their website, 742 give no notice that whoever answers may be an automated system. That is 97.5 %. Article 50(1) obliges the provider of the system to ensure the person knows they are talking to an AI: the signal is observed in the public channel, without prejudging who must remedy it.
This measures absence of public signal, not non-compliance: Article 50(1) obliges the provider of the system to design it so that it informs, and detecting a conversational channel does not prove that an AI answers it. The remaining figures, and the breakdown by the four sectors, are published with the first edition, presented on 20 October 2026 in Madrid with AEEN, with the sample closed on 15 October.
You can contribute your data — and learn where you stand — in ninety seconds.
Take the CriterIA© 7Free · no sign-up · no email required · your answer joins the Observatory anonymously and counts in D5 from the 2nd edition
First edition · Índice de Criterio© 2026-S2 · cut-off 15 October 2026, 23:59
AI is already in use. How it is governed is barely visible. Four indicators, each with its own base, read separately and, in this first edition, with no single score. They measure public signal: not non-compliance, and not internal governance. All four bars use the same scale, from 0 to 40%.
D1 · AI notice in the chat
1.5 %
27 of 1,853 conversational channels state that an automated system may be answering
Article 50(1) places the obligation on the PROVIDER of the system: a missing notice is not a breach by the organisation observed. A “channel” is a chat, an assistant or a messaging link; the Radar does not check whether an AI or a person answers.
Observed · base: 1,853 channels
D2 · Published AI use policy
0.1 %
11 of 14,514 organisations publish one
Good practice, not required by the Regulation. An organisation that does not publish one may still have one: from the outside, it simply cannot be known.
Observed · base: 14,514 organisations
D3 · AI mentioned in legal pages
36.2 %
5,258 of 14,514 name it in the legal notice, privacy or cookie policy
Good practice, not required. 5,250 of them publish no use policy: naming is not explaining. The working hypothesis, pending semantic review, is that much of it reflects GDPR information duties on automated decision-making.
Observed · base: 14,514 organisations
D4 · Content marking · experimental
0.2 %
4 of 1,853 channels mark or flag AI-generated content
Article 50(2) places the obligation on the PROVIDER of the system, and Article 50(4) on the DEPLOYER, only for deep fakes and for text on matters of public interest. D4 records public signal: it does not measure compliance with either.
Observed · base: 1,853 channels
Fixed order: this is not a ranking. The channels of universities and schools and of public administrations do not reach one hundred observations, so the report gives them in absolute numbers. “No block assigned”: organisations without a validated sector classification; they count in the total, not in block comparisons.
| Block | In the Index | With channel | D1 · notice | D2 · policy | D3 · mention | D4 · marking |
|---|---|---|---|---|---|---|
| SMEs and the rest of the business fabric | 7,079 | 941 | 3 | 1 | 2,502 | 0 |
| Large companies and consultancies | 3,899 | 371 | 8 | 4 | 1,418 | 2 |
| Universities and business schools | 162 | 68 | 4 | 4 | 82 | 0 |
| Public administrations | 233 | 44 | 3 | 0 | 72 | 0 |
| No block assigned | 3,141 | 429 | 9 | 2 | 1,184 | 2 |
| Total | 14,514 | 1,853 | 27 | 11 | 5,258 | 4 |
What cannot be concluded: that these organisations break the law —publishing a policy is not an obligation, and Articles 50(1) and 50(2) place the obligation on the provider of the system—, that they lack internal governance, or anything about “all of Spain”: the sample is a convenience sample.
How to cite it: “11 of 14,514 web domains of organisations observed publish their AI use policy (Índice de Criterio© 2026-S2, indicator D2, cut-off 15 October 2026)”.
28 screens · method, sources and seal · CC BY 4.0 · data file (JSON) · launch presentation, 20 October (in Spanish)
ÍNDICE DE CRITERIO© 2026-S2 · CUT-OFF 15/10/2026 23:59 · n = 14,514 · SHA-256 51E14BD1… · BITCOIN, BLOCK 971,838 · CC BY 4.0
After the Index
The Index does not publish results by organisation: only aggregates. If you want to know what visitors to your website see from the outside, and where you stand on Articles 4 and 50, this is the way.
Step 1 · Huella de IA©
Your website, with the same analysis. Enter your domain and see which signal is missing, on which page it was looked for, and whether each obligation is yours or your provider's.
huella.estrategicamente.info · free
Step 2 · CriterIA© 7
What cannot be seen from outside. Seven questions on Articles 4 and 50 that tell you where you stand. No registration and anonymous.
Take the CriterIA© 7 · ninety seconds
Step 3 · CriterIA© Business Session
Your case, with us. 45-minute assessment session: current AI use, project, applicable grants, risks and roadmap.
Frequently asked questions
11 of 14,514 web domains of observed organisations publish their AI use policy (Criterion Index© 2026-S2, indicator D2, cut-off 15 October 2026). Publishing it is good practice, not an obligation under the EU AI Act.
27 of the 1,853 conversational channels observed, 1.5 % (indicator D1). The duty to inform people that they are interacting with an AI (Article 50.1 of the AI Act) falls on the provider of the system and applies from 2 August 2026.
14,514 organisations (web domains) are included in the first edition: those read without error and with at least two pages. The Radar visited 25,873 websites and read 18,137. Cut-off 15 October 2026.
No. It measures public signals visible from outside, not non-compliance or anyone's internal governance. The data are anonymous and aggregated: no organisation is named.
On 20 April 2027. It will read the same websites again to measure how each indicator evolves and will add, in a separate chapter, indicator D5, with what organisations declare in CriterIA© 7 and what they analyse with Huella de IA©.
Yes, under a CC BY 4.0 licence, citing the source. The edition data are in a JSON file whose SHA-256 fingerprint is anchored in Bitcoin block 971,838.
Second edition · Tuesday 20 April 2027
The first edition reported what can be seen from outside. The second does three more things: it shows whether that has changed in six months, summarises it in a general indicator and adds, for the first time, what organisations see of themselves.
1
The same sample, read again
The Radar reads the same websites again with the same method. D1 to D4 are published next to the first-edition figure and by universe: SMEs, large companies and consultancies, public administrations and higher education. That shows which signal has appeared, and where. And a general indicator summarises them: it is always published alongside them, never instead of them.
2
New indicator · D5
D1 to D4 only see what an organisation publishes. D5 brings together two sources that did not count in the first edition: what each organisation declares in CriterIA© 7 about literacy and transparency, and what it analyses on its own website with Huella de IA©, fourteen controls graded from A to E. It is the part that cannot be observed from outside.
3
In a separate chapter
D5 is never added to or averaged with D1 to D4, nor is it part of the general indicator: D1 to D4 still come only from external observation, that way the trend is compared with the same method. And a declaration does not prove compliance: D5 measures exposure and self-assessment, not what an organisation has in place. Its exact definition, and the formula of the general indicator, will be published with the edition's methodology.
Our goal is for the indicators to improve from one edition to the next, through the dissemination work of the Observatory and its collaborating organisations. Measuring is not enough if nobody hears about it: that is why we ask associations to take the Index to their members.
Second edition · 20 April 2027
We are looking for associations, professional bodies and networks that want to take the second edition to their members. Collaborating costs nothing and commits no member.
What we ask
Share it with your members. A dedicated link to CriterIA© 7 so that each organisation can see where it stands; every answer counts, anonymously, in the new D5 indicator of the second edition. And an invitation to report cases to the AI Damage Report.
What you get
The results, for your members. The report of each edition, with the reading for the universe they belong to, and your organisation listed among the collaborators of the second edition.
How we start
A half-hour conversation. We explain the method, see what fits your organisation and prepare the material for your newsletter.
Methodology
Without literacy, reskilling and governance, AI can stop being a productivity tool and become a source of errors, uncritical dependence, poorly supervised decisions and loss of trust. It is what we have been arguing for more than two years and what the CriterIA© seal verifies: it trains the organisation's people, verifies seventy-nine points across eight dimensions and three pillars and issues a seal anyone can check without going through us. This indicator measures the public signal of the third; the other two are not visible from outside.
The distinction matters more than the figures: what an organisation declares about itself and what is observed from outside are not the same thing.
Media, analysts or researchers? The data may be cited freely with attribution: «Criterion Index©, EstratégicaMente».
Ninety seconds · No sign-up
The CriterIA© 7 tells you where you stand on Articles 4 and 50. Your answer is added anonymously and in aggregate to the Observatory. From the second edition it counts in indicator D5, in a separate chapter; indicators D1 to D4 are based exclusively on externally observable signals.
Take the CriterIA© 7How it works
Three routes feed information into the Observatory. The four external-observation indicators, D1 to D4, and from the second edition the general indicator that summarises them, are calculated only from the Radar’s own sweep. Huella de IA© and CriterIA© 7 are recorded separately and, from the second edition, form an indicator of their own, D5, in a separate chapter that is never added to or averaged with the other four. Each percentage is calculated on its own base. The fourth door brings no data. It is the one that explains why this Index measures only part of the problem.
Door 1 · CriterIA© Radar
External observation, without asking for anything. A crawler reads each organisation’s public pages: home page, assistant paths, legal notice, privacy and cookies. It respects robots.txt and stops when the site forbids it. Ingestion requires at least two readable pages; if it does not get them, the observation is discarded: it does not count as non-compliance, it counts as not observed. Each reading is labelled solid, minimal or limited according to the pages read, and limited readings are read again before each close.
Currently provides practically the whole sample
Door 2 · Huella de IA©
A complementary tool: it does not enter D1 to D4. You enter your domain and get, for your own website, the analysis the Observatory runs on all of them: which signal is missing, on which page it was looked for, what the provision says and —what hardly anyone will tell you— whether that obligation is yours or your provider’s. It does not enter D1 to D4: from the second edition it is published in D5, in a separate chapter. Its purpose is to let each organisation see itself, and to serve as a test bench for the Radar itself. It is at huella.estrategicamente.info.
The most demanding engine of the three · counts in D5 from the 2nd edition
Door 3 · CriterIA© 7
What you declare. Seven questions on Articles 4 and 50. A self-declaration only indicates exposure, never compliance: saying that your chat shows a notice does not prove that the notice is there. Only external observation proves that.
Never enters an observed indicator · counts in D5 from the 2nd edition
Door 4 · What enters through no door
Adopting AI with judgement rests on three pillars, and this Index can see only one. Literacy: people knowing when not to believe the answer. Without it, the tool does not help to decide; it decides. Reskilling: redesigning jobs around what the person contributes. Without it, AI does not free up work; it hollows it out. Governance: which systems exist, who supervises each one and what trace is left. It is the only one of the three that leaves a public signal, and it is the one we measure.
The other two are verified with the CriterIA© seal, not from outside
And one rule that orders all of the above: each observation keeps the version of the detector that produced it. If the detector changes, new observations are not compared with old ones as if nothing had happened. A published edition is never recalculated; if a defect is found in the measuring instrument, the edition is withdrawn with a public erratum and a stated reason, and the original figures are kept intact.
Ninety seconds · No prior registration
The CriterIA© 7 tells you where you stand on Articles 4 and 50. Your answer is added to the CriterIA© Observatory anonymously and in aggregate. From the second edition it counts in indicator D5, in a separate chapter: the other four indicators come only from what can be observed from outside.
Take the CriterIA© 7New monthly section of the CriterIA© Observatory
Real errors, real impact and the judgement to decide. Every month, cases from companies and education: what failed for lack of literacy, reskilling or governance, what it cost and what would have prevented it. The first report goes out on 20 November 2026.
When AI fails, we look for what was missing.
Nobody knows when not to believe the answer. The tool does not help to decide: it decides.
Jobs are not redesigned around what the person contributes. AI does not free up work: it empties it.
Nobody knows which systems exist, who oversees each one or what trace remains of what was decided.
And when what fails is the tool itself, we report that too: the case is classified as such and not forced into any of the three.
Where we look
Internally, every case carries its source, date, evidence and classification. We anonymise any sensitive information and check every regulatory statement against the version and date of the rule before publishing it.
The report does not feed the Índice de Criterio©: the index measures what can be seen from outside; the report tells what is already happening inside. Cases are not a sample: we describe patterns among the cases received, never percentages.
Every edition ends with that question. Receive the report every month or tell us about a case you know.
Receive it monthly
On the 20th of every month, from 20 November 2026. All we need is your email.
Know of a case?
Tell us through a five-part form. We verify it and anonymise it before publishing.
Send a caseWant to know where your organisation stands? Take the CriterIA© 7, free, or review it with us in the CriterIA© Business Session.
We do not analyse the AI that is announced. We analyse the AI that is already happening in organisations.
Who reviews this
A measurement that is published and cited cannot be reviewed only by whoever produces it. The Monitoring and Oversight Committee of the CriterIA© Observatory, made up of top-level professionals in law and regulation, business schools and universities, AI education and literacy, people and reskilling, public innovation and technology governance, and the digital economy, reviews the methodology and its limitations before each edition and records whether or not it endorses it. Disagreements are recorded in named minutes, and the minutes are published. Members who send no observations are recorded as “no observations received”, never as in agreement.
It was constituted by written adherence. Its membership, with the conflict-of-interest declarations of all its members, is published with the minutes, together with the first edition.
First edition · 20 October 2026 · Madrid, with AEEN
The usual objection is that SMEs lack the resources. We are also measuring those who have them. The breakdown by block is in the first edition: among large companies, 4 of 3,899 publish a use policy and 8 of their 371 channels give a notice; in public administration, none of the 233 publishes a policy and 3 of their 44 channels give a notice.
Four blocks, four separate series: universities and business schools, large companies and consultancies, SMEs and the rest of the business fabric, and public administrations. An SME follows Commission Recommendation 2003/361/EC: fewer than 250 employees; the block also includes organisations with no headcount data, and says so. Each block has its own index, and the overall Index is calculated on the joint population, not as an average of the four.
Analyses that cannot be completed due to crawler blocking are excluded from the calculation and do not count as non-compliance.