# Public Evidence Edition: methodology
Version PE-2026.10-v4 · Research cut-off: 10 October 2026

## What this edition measures
The AI Native Index is Mayden's research programme on how AI changes enterprise operations. This public edition measures the **breadth and specificity of documented public evidence** in a deliberately selected company cohort. It is exploratory. It is not a validated measure of actual AI-native capability, an audit, a certification or a representative estimate of Gulf adoption.

Mayden's working definition is an enterprise that repeatedly converts AI capability into useful, accountable work across a defined organisational scope. The definition and nine-theme framework remain hypotheses for empirical validation.

## Cohort and geographic scope
The review includes eighty selected entity records: ten each in Banking, Telecommunications, Energy & Utilities, Aviation & Logistics, Manufacturing & Materials, Retail & Consumer, Healthcare, and Real Estate & Construction. Each selected sector cohort has two headquarters records in Saudi Arabia, the UAE, Qatar, Kuwait and Bahrain. Energy includes operating subsidiaries and public utility corporations; aviation/logistics combines distinct business models. The added sectors also mix operating roles: manufacturing spans materials and processing, retail includes food production, healthcare includes provider groups and public services, and real estate includes destination development and asset operations. These are explicit editorial cohorts, not homogeneous samples. Selection is purposeful, based on relevance to a launch study and identifiable public corporate disclosures. It is not random sampling, a complete industry census, or a selection established by a market-share threshold. Oman is not included; this is not full GCC coverage.

The assessment unit is stated separately for each company. The corpus mixes international groups, local operators and subsidiary practices. Headquarters labels do not show where every practice operates. stc group overlaps with stc Kuwait and stc Bahrain; e& has an interest in Mobily. No country average, national league table, GCC prevalence estimate or pooled company average is produced. Sector positions compare this selected corpus only; mixed scopes limit comparability.

## Research process and source access
A bounded desktop review used targeted corporate-domain searches and annual, sustainability, governance and implementation reports, predominantly in English with limited Arabic discovery. Researchers sought evidence across all nine themes, followed relevant primary sources and recorded search boundaries. The search was not exhaustive or a preregistered systematic review. Different publication practices, language access and retrieval failures create disclosure bias.

The underlying research archive retains company records, claim-level coding, URLs, publication dates where available, access dates, locators, implementation stages, source limitations, search notes and adjudications. Published reports cover mixed periods, including historical and 2025 disclosures available by the cut-off. They do not represent one common financial-year observation window. Undated source records remain undated.

Corporate reports establish **what a company reports**, not independent verification of its operations. A readable company-authored report on a third-party mirror can qualify, with provenance and lack of issuer hash matching disclosed. Search-result snippets and indexed-only excerpts are retained as leads but excluded from scoring unless the exact claim is independently readable in an eligible full-source page or document. Vendor announcements and memoranda are not proof of a customer's deployment.

## Nine dimensions
The framework examines AI in core workflows; workforce and skills; ecosystem integration; interfaces; data lineage; experimentation; autonomy; organisational knowledge; and governance. Each asks about an operating practice, not spending, technology brand names or the number of announcements.

A single practice can inform more than one theme only where the claim explicitly supports each construct. Repeated claims do not add points within a theme. This first framework may contain correlated dimensions; we have not demonstrated discriminant validity or an optimal weighting scheme.

## Evidence anchors
| Level | Meaning | Minimum requirement |
|---|---|---|
| U | Unknown in this review | No accessible qualifying claim. This does not mean absent capability. |
| 1 | Specific commitment or pilot | A named practice and concrete action, pilot or implementation commitment. Generic ambition earns no points. |
| 2 | Implemented practice | An explicit statement that a relevant AI practice is in use in the assessed operating scope. |
| 3 | Implemented practice with operating detail | Level 2 plus a specific mechanism, coverage detail, evaluation process or decision authority. This is evidence specificity, not proven enterprise-wide excellence. |

Customer AI products, infrastructure capacity for customers and general digitalisation do not by themselves demonstrate internal AI-native operating practices. AI used to deliver the operator's own service may qualify where the operating mechanism and entity scope are explicit. Generic privacy or data policies cannot automatically establish AI governance.

## Normalisation and positions
For each company, take the highest eligible anchor in each of the nine dimensions. Assign 1, 2 or 3 documented points. U contributes no documented points to the calculation while remaining **unknown** in the displayed profile.

**Public evidence points = 100 × (sum of the nine documented theme levels) ÷ 27.**

The display rounds to a whole point. In the downloadable JSON, a null theme value means U (unknown), not zero capability. The denominator is fixed; it does not shrink when evidence is missing. No min–max rescaling, percentile transformation or z-score is applied. A score of 50 does not mean “50% AI-native”. The profile and the number of themes with qualifying evidence must appear alongside the total.

The anchors are ordinal judgments. Summing them assumes equal numerical steps that have not been empirically calibrated. A maximum captures the strongest located disclosure; one narrow implementation can fill a theme without establishing firm-wide coverage. Each theme has equal nominal weight. This is a transparent initial design choice, not an empirically validated estimate of importance. Positions use unrounded totals within each ten-entity sector cohort. Equal totals share a position; the next position reflects the number of records above it. A record with no qualifying evidence is unranked, rather than labelled the least capable. Search and market filters do not change published positions.

The fixed normalisation enables reproducible arithmetic, but does not solve differences in disclosure, scope or source availability. A one-point coding change moves the normalised score by approximately 3.7 points. Close positions are therefore especially fragile. The release does not establish statistically significant differences between companies and does not publish confidence intervals unsupported by a sampling model.

## Outcomes stay separate
Reported time savings, financial returns, customer metrics and forecasts are recorded separately from capability evidence. Attribution, baseline, period and denominator must accompany interpretation. A company's reported percentage is not a causal estimate merely because it appears in an annual report. We do not average heterogeneous outcome percentages or turn them into capability points.

## Review and reproducibility
AI research agents extracted and challenged source claims. A separate AI review pass checked proposed level-3 anchors and selected lower-level, access and exclusion decisions. Review changes are retained in the archive. This is not human expert sign-off, independent assurance or a completed inter-rater reliability study. A second AI reader can share errors with the first.

The public JSON release contains the company profiles, eligible and excluded claims, sources attached to claims, literature references, report texts and this method. A reproducible builder and a SQLite research database are retained by Mayden on D:. The archive hashes the research records. Some expansion documents are retained privately for review; the public bundle does not redistribute those source documents. The separate collector fingerprints only its explicitly attempted URLs, not every source in the corpus. Source pages may subsequently change.

## How the research synthesis was assembled
The accompanying research series comprises eleven visual reports, including eight sector reports and three cross-sector reports. Its research register contains 34 selected references spanning empirical studies, organisational measurement research and methodological frameworks; these are not 34 comparable experiments or a complete literature census. The synthesis is a scoped rapid evidence review. Its evidence table records design, population, sample, setting, findings, limits and measurement implications. It is not a new statistical meta-analysis, systematic literature review or pooled effect estimate. Studies of a writing task, a contact centre and a software repository cannot establish one enterprise-wide productivity effect.

## From disclosure research to a validated company study
Public evidence and proprietary company assessment must remain separate instruments. The existing nine-question self-check is qualitative and private to the browser. The downloadable 27-question instrument is a draft for cognitive testing, not a validated survey or automated certification.

The next development gates are: expert content review; English and Arabic cognitive interviews; a recruited UAE/Saudi cross-sector pilot; independent coding of blinded evidence; test–retest and respondent-role checks; construct and outcome validation; and sensitivity analysis of missingness, weights and aggregation. Sample sizes should follow the measurement model and required precision, rather than a convenient participant target. A small pilot can test comprehension and feasibility; it cannot establish general population norms.

The company study should collect multiple perspectives where feasible, distinguish “no”, “unknown” and “not applicable”, and request corroborating operating evidence. Results should separate capabilities, outcomes and evidence confidence. Participation consent, confidentiality, retention and permitted aggregation must be agreed before collecting confidential records or voice interviews.

## Corrections, editions and independence
Mayden owns its original framework, code, compiled research records and editorial analysis subject to applicable rights; it does not own the underlying public facts or third-party reports. Companies may submit corrections or additional sources through the contact page. Contributions enter the same evidence protocol. Payment, sponsorship and advisory work must not purchase points or a position.

This release is a dated snapshot. Substantive changes require a versioned correction log and regenerated dataset. Future trend reports must distinguish changed evidence availability, changed company scope, instrument changes and actual operating change. A stable core questionnaire and a separately versioned emerging-practice module will support longitudinal work.

The AI Native Index™ name is used as a brand; no claim of registered trademark status or completed clearance is made. A validated enterprise benchmark remains the programme's objective, not a result established by this public evidence series.

## Methodological foundations
The design draws on the [OECD/JRC Handbook on Constructing Composite Indicators](https://doi.org/10.1787/9789264043466-en), the [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework), and [Boateng and colleagues' scale-development primer](https://doi.org/10.3389/fpubh.2018.00149). These sources inform design choices; none validates Mayden's instrument.




## What changed in the second edition
The first edition remains downloadable with its original bytes. This edition expands the corpus and publishes score-contribution tables, deciding claim IDs, review decisions, search records and deterministic robustness tests. The change log separates new companies from corrections to existing coding. A changed number between editions is not evidence that a company changed its operations.

Eligibility now enforces explicit extraction exclusions, rejects invalid or future publication dates (including future months), and prevents a source-level access recovery from validating unrelated claims. New reviewed claims must bind to the exact serialized claim record; adverse access decisions and unresolved or conflicting reviews cannot silently promote an anchor. New implemented anchors require a deployed or scaled status. A detailed pilot remains a pilot. Older adjudications are identified as legacy records rather than retroactively described as hash-bound reviews.

## What changed in the third edition
The third edition adds forty selected entity records across Manufacturing & Materials, Retail & Consumer, Healthcare, and Real Estate & Construction. It adds nine primary research references and a flagship report that separates task performance, workflow adoption, decision authority, business consequences and organisational learning. Earlier editions retain their versioned records; the larger corpus is not a new observation of regional adoption prevalence.

The construction remains the same nine-theme maximum-anchor method, fixed 27 denominator and twenty-one declared specifications. New sector packets receive claim-bound AI challenge of all proposed level-3 claims and a purposive sample of lower anchors and exclusions. Review can correct an implementation-stage label while preserving the exact original claim and its hash. A future commitment cannot receive an implemented anchor merely because its raw extraction called it deployed.

A separate replay of the prior forty-company snapshot reproduced its point totals and examined dependence on individual source URLs. It is an audit of that snapshot, not evidence of temporal change or independent corroboration. The new flagship's conceptual exhibits are operating frameworks and questions; they are not survey distributions or estimates from the selected company corpus. Any plotted corpus quantities must identify the edition and denominator from which they were computed.

## Inspect an individual calculation
For every company the interface lists each theme's maximum, its contribution out of 100 and all eligible claims tied at that maximum. The underlying records retain the proposed anchor, accepted anchor, exclusion reasons, publisher, source type, locator and review rationale. These records permit an external reader to reproduce the arithmetic and challenge the coding. They do not turn a publisher's account into verified operational fact.

Claim fingerprints bind structured research records, not the truth of a statement. Source fingerprints bind retrieved bytes; different byte hashes may reflect web templates, navigation or other unrelated page changes. Source URL counts are not counts of independent observations. A vendor customer story, an issuer release and their republications may share one origin. No numerical probability of truth or independent-assurance claim is assigned.

## Twenty-one declared specification checks
The baseline is accompanied by twenty alternative specifications: omit all level-1 points; cap level 3 at 2 while retaining the fixed 27 denominator; and, separately for each of nine themes, halve or double its weight while all other weights stay 1. Weighted scores divide by three times the sum of weights. All alternatives recalculate tied positions within the unchanged sector cohort, using unrounded values. The published company profile exposes the resulting score and position and the range across the declared specifications.

These are deterministic assumption checks, not confidence intervals, probabilities, significance tests or proof that one specification is correct. Capping anchors at2 deliberately lowers the attainable score to 66.7 on the existing scale; it does not redefine the scale to 18. Weight changes test local design dependence, not empirically estimated importance. An all-U result remains unranked in every specification.

For each company a separate check removes one qualifying source URL at a time and recalculates the profile from surviving claims. The largest drop exposes dependence on a particular located document. This removes each retained claim’s primary URL; required corroborating sources are not yet removed as dependencies. This is weaker than removing an entire source family: mirrored or republished copies can remain. It does not imply that a long annual report is less trustworthy. Reconcile source families and operating cases before interpreting this as corroboration sensitivity.

## Research coverage is not operational coverage
The public research-input file includes the recorded queries or search topics, source IDs, dates, languages where recorded and access gaps. These logs describe performed work. They are not a search-recall estimate, a complete list of all relevant documents or proof that all nine themes were searched equally. Theme coverage counts themes with qualifying claims. Operational coverage asks how many relevant employees, workflows or decisions actually use a practice; that denominator is often undisclosed. The three concepts must not be substituted for each other.

## The source collector: a tested beginning
The collector is a bounded, manually invoked public-source checker. It uses an approved HTTPS host and URL register, a declared user agent, request limits and pacing, robots access checks, conditional requests where supported, byte and extracted-text hashes, and dated retrieval receipts. It distinguishes first observations, unchanged content, rendering-only changes, content changes and access failures. HTML keyword matches and discovered links are research leads only. PDF fetching in this prototype fingerprints bytes; it does not extract or validate PDF claims.

Retrieved text is treated as untrusted source material. The collector cannot accept a claim, assign an anchor, modify the released dataset or publish a ranking. It has no credentials for confidential company systems and no paid-data connector. Restricted material would require permissioned access and a separate agreement. This is not an official government crawler, an external certification or continuous monitoring. Run receipts state precisely which URLs were attempted, and automated access can fail even when a separate manual research route succeeds.

Its HTTP request deadline and request budget bound collection after DNS resolution; DNS remains subject to the host operating system resolver. Supported content formats, publisher access rules, language coverage, dynamic pages, changing page templates and PDF extraction remain engineering limits. The current prototype records hashes and bounded discovery metadata rather than a complete immutable archive of the web. A production service would require persistent job scheduling, source-family management, extractor validation, review queues, storage/retention controls and operating ownership.


## What changed in the fourth edition
The fourth edition follows two separately tasked AI challenge teams and a panel adjudication. The consulting-style briefs do not imply affiliation with BCG or McKinsey. This is an AI-assisted challenge of research and publication choices, not independent human review or validation of enterprise capability. The release retains the eighty company records, nine-theme anchors and baseline score construction. Editorial and diagnostic additions do not establish a change inside any company.

Every report now identifies the AI-assisted nature of source review locally. Internal production instructions have been removed from report prose. The healthcare discussion links to the original AIRIS-TB study and keeps issuer-reported throughput, retrospective model evaluation and prospective workflow effects separate. The methodological report labels its twenty-record v1 example as historical and adds a separate eighty-record v3 sensitivity comparison. Neither is a time-series measure of adoption.

A worked calibration set covers all nine themes using actual retained claim IDs and decisions. It includes positive cases, interpretation boundaries and exclusions; where the frozen corpus lacks a particular category, the absence is stated rather than filled with an invented claim. These are teaching examples, not a blinded reliability study. The company-instrument validation protocol specifies human content review, bilingual comprehension work, independent coding, multi-informant checks and outcome validation as future gates. None is claimed complete.

## Evidence dates and continuity
Publication date, observation period, retrieval date and confirmation of continuing use answer different questions. The frozen v3 corpus contains 224 eligible claims: 79 have no recorded publication date and 28 have a recorded date before 2025. An undated record may describe a dated reporting period; it is not automatically obsolete. A 2026 release label does not make historical implementation current.

A companion dated-source check retains eligible claims whose recorded publication date begins in 2025 or later and recomputes the profile against the same denominator. This is a sensitivity rule about recorded source dates, not evidence that older or undated practices stopped. The baseline remains unchanged. Evidence from an older source can still be useful, while continuity requires a separate dated operating confirmation. Do not substitute this date filter for a current-maturity score.

## A bounded source-family and operating-case pilot
The provenance pilot maps two Emirates NBD PCA claims to one issuer account and one operating case. They concern different dimensions but are not independent confirmations. Removing the declared two-claim family or case changes that company's calculated evidence points from 92.5926 to 70.3704 before whole-number display rounding. Both checks give the same result because the declared member sets are identical.

This limited mapping has been checked against the frozen v3 record and its arithmetic. It is not a reconciled source-family graph for all companies. Required corroborating-source dependencies remain unadjudicated in this pilot and are represented as unknown, not inferred. The existing whole-corpus removal check remains a single-primary-URL test. Mirrored publications, common assertion origins, case overlap and required dependencies must be resolved before claiming comprehensive corroboration sensitivity.