# Candidate instrument v0.1

16 September 2026 · for expert review and cognitive testing, not deployment as a validated benchmark

Purpose: assess a scoped organization's AI operating capability using observable practices. Preserve the nine website themes while testing their meaning, overlap and usefulness. This draft provides 27 candidate core items, outcome measures and the rules needed to turn interviews into comparable records. Full item-specific 0–4 response options require cognitive testing before production.

## Scope and intake

Confirm operating entity/business unit, countries covered, sector, size band, parent relationship, respondent role, functions represented, time in role, assessment date and language. Ask whether answers describe UAE operations, Saudi operations, a GCC unit or the entire global company. Record AI types used: predictive/analytical, generative, agentic, other/uncertain. Explain that ordinary rules-based automation alone does not establish AI use.

Identify 3–5 material workflows before asking for success stories. Select one as an interview example, but gather coverage across the predeclared set so a single showcase pilot does not become an enterprise rating. Record workflow-selection rationale and volume/materiality. Avoid requiring revenue data if the participant can safely provide a size band or another suitable materiality measure.

Ask “What did you decide not to automate, and why?” This helps distinguish thoughtful human oversight from inability or uncontrolled automation. It is contextual, not automatically a score penalty.

## Core items

For each item, ask about current practice with examples from the last 90 days. Capture the source of knowledge, organization coverage and whether the respondent can answer directly. Where a practice is not relevant in the stated scope, capture the reason for review rather than automatically excluding it from the denominator.

| ID | Domain and question | Candidate evidence / follow-up |
|---|---|---|
| C01 | AI Core: In which material recurring decisions is AI routinely used, and who owns its use? | Decision inventory; distinguish an experiment from recurring production use |
| C02 | AI Core: How do the responsible teams obtain sufficiently current, reliable and permitted data for those uses? | Quality checks and access process; request a recent failure example |
| C03 | AI Core: What happens when the AI service or its required data becomes unavailable or unreliable? | Fallback procedure and exercise/incident record |
| W01 | Workforce: Which relevant roles use AI in their normal work, and how is actual use known? | Eligible role denominator, usage evidence or work samples; no employee surveillance requirement |
| W02 | Workforce: How do you determine whether people can use and challenge AI effectively in their role? | Task-based competence assessment; training attendance alone is insufficient |
| W03 | Workforce: What responsibilities or work steps changed when AI was introduced? | Before/after role or process description; ask who checks outputs and handles exceptions |
| E01 | Ecosystem: How do you evaluate whether to build, buy or partner for a material AI use? | Decision criteria and one completed decision, including constraints and alternatives |
| E02 | Ecosystem: How are external AI dependencies monitored against the business's requirements? | Supplier/service evaluation, performance and access controls |
| E03 | Ecosystem: How could you continue, switch or exit if a critical AI supplier became unsuitable? | Exit plan, portability test or risk-appropriate continuity arrangement; vendor independence is not assumed possible everywhere |
| I01 | Interfaces: Where is AI integrated into the normal workflow rather than used through manual copy/paste? | Workflow map and deployment state; ask which handoffs remain manual |
| I02 | Interfaces: What proportion of the defined eligible workflow volume actually passes through that AI-enabled process? | Defined numerator/denominator and period; separate available capability from use |
| I03 | Interfaces: How do exceptions and failed handoffs get detected and resolved? | Queue, accountable owner, service target and a recent resolved exception |
| D01 | Decision lineage: For a selected AI-supported output, can you reconstruct the input sources, system version and consequential actions? | Redacted trace or supervised demonstration; avoid collecting unnecessary raw inputs |
| D02 | Decision lineage: What do operators see that tells them whether the deployed process is working acceptably? | Operational quality/latency/cost indicators and thresholds, not just a count of outputs |
| D03 | Decision lineage: Can you identify who accepted, changed or overrode an important output? | Proportionate approval/override record; account for decision risk |
| X01 | Experimentation: Before adoption, how is performance compared with an appropriate baseline or alternative? | Defined task, representative evaluation data and baseline |
| X02 | Experimentation: What evidence causes a use to be scaled, revised or stopped? | Predeclared decision rule and an example, including unsuccessful work |
| X03 | Experimentation: How is performance re-evaluated after deployment or a material model/process change? | Change evaluation and monitoring record; examples of learning affecting practice |
| A01 | Operating model: Who is accountable for the outcome and has authority to change or stop each material AI-enabled workflow? | Named role and decision rights; existence of a central AI team alone is insufficient |
| A02 | Operating model: How are permitted actions and human approval points matched to the risk of the workflow? | Defined permissions/limits; appropriate human-only decisions can score highly |
| A03 | Operating model: How can an affected person or operator challenge, reverse or escalate a consequential action? | Tested recourse/rollback/escalation route appropriate to the context |
| K01 | Knowledge: Who maintains the institutional knowledge used by people and AI, and how is it kept current? | Ownership, update procedure and a recent correction |
| K02 | Knowledge: How is access to that knowledge controlled and the reliability of retrieved answers checked? | Permission tests and retrieval/answer evaluations; a vector database is not evidence of correctness |
| K03 | Knowledge: How are lessons from one deployment reused by another team? | Concrete reuse of an evaluation, process, failure lesson or approved component |
| G01 | Governance: How do you know which material AI uses exist and what risks they create? | Inventory and risk assessment reflecting real deployed uses, including unsanctioned-use discovery |
| G02 | Governance: What security, privacy and other relevant risk checks are completed before use and after material changes? | Risk-proportionate control records and decision authority; no automatic legal compliance conclusion |
| G03 | Governance: How are incidents, complaints and control failures detected, investigated and addressed? | Incident process, exercises and corrective actions; no recorded incident does not prove perfect safety |

## Anchors and scoring protocol

A reusable starting progression is: 0 absent; 1 isolated/informal; 2 repeatable in limited scope; 3 systematic across the defined relevant scope; 4 sustained, reviewed and demonstrably improved. This progression must be adapted to each item; it is not a substitute for an explicit rubric. Record actual coverage alongside maturity so small and large firms are not compared using raw deployment counts.

Example item-specific rubric, X01 evaluation:

- 0: No comparison with a baseline or alternative is performed.
- 1: Informal examples or individual impressions guide adoption.
- 2: At least one repeatable evaluation compares a relevant baseline on predefined measures, but coverage across material uses is limited.
- 3: Material uses in the stated scope are evaluated against appropriate baselines with documented quality/benefit criteria before adoption.
- 4: The level-3 process is sustained and independently challenged where appropriate; evaluation weaknesses are identified and corrected using subsequent operating evidence.

“Don't know,” “not permitted to disclose,” “not applicable” and “not answered” remain separate codes. A refusal to disclose does not become zero. Evidence sufficiency is separately rated and never silently substitutes for the practice rating.

Pilot baseline for complete records: domain = 25 × mean of its three item ratings; total = mean of nine domains. A provisional domain needs at least two answers, with coverage visible. Do not give an overall point estimate if any item is missing; report the profile and missing-data bounds as specified in the strategy. Do not calculate a percentile before an eligible comparison cohort exists.

For ratings claimed at 3–4, ask a neutral corroboration question. Accept appropriate alternatives to document upload. For discrepancies, preserve each answer, request clarification and record the adjudicated rationale. Unresolved disagreements remain unresolved. Give participants a chance to correct factual interpretation. Reviewers cannot raise scores to help a sale.

## Outcomes: separate from the capability score

For up to three material AI-enabled workflows, ask for comparable before/after values and periods. Include a materially unsuccessful or discontinued use where one exists. Do not sample only the strongest success story.

| Measure | Question and denominator | Guard against |
|---|---|---|
| Cycle time | Median or other defined time per completed case, before/after, same task definition | Comparing different task mixes or time windows |
| Quality | Error/rework rate per defined cases; error severity and escape rate if available | Faster work hiding additional rework or harm |
| Cost | Total operating cost per accepted output/case including inference, licenses, review and maintenance | Quoting gross time saved as realized cash savings |
| Capacity | Accepted output per paid hour or another predeclared capacity measure | Double-counting capacity as both savings and revenue |
| Growth | Incremental conversion, revenue or retention with a stated attribution method | Assigning all business growth to AI |
| Risk | Incidents and near misses relative to exposure, severity and observation period | Treating zero detected incidents as zero risk |
| Work experience | Change in workload, confidence and task quality, directly reported by affected workers where studied | Inferring employee satisfaction from a manager's opinion |

Store units/currency, denominator, baseline date, follow-up date, measurement method, evidence status, uncertainty and confounders. Distinguish estimated, measured, finance-reviewed and independently evaluated outcomes. No measured outcome yet is an acceptable and informative answer.

Ask: “What else changed during that period?” and “What is the strongest reason the result may not be caused by AI?” Revenue and quality effects may need longer observation than a productivity measure. Never calculate ROI without attributable benefits, all relevant costs and an explicit period.

## GCC and sector modules

Keep these context modules outside the core score until tested:

- Countries of processing and service delivery; applicable organizational and sector constraints; observed impact on deployment choices.
- Arabic/English workflow volumes, terminology, code-switching and evaluation by actual task/language. A global average can conceal a local-language failure.
- Procurement and vendor access, group/subsidiary decision rights, legacy integration and data-sharing barriers.
- Workforce role/skill availability, internal ownership and the ability to maintain deployed systems.
- Sector-specific consequences, oversight and recourse for finance, healthcare, infrastructure or other material uses.

Do not label a response legally compliant. The study assesses practices and reported constraints; any compliance opinion requires a separately scoped professional review.

## Short public check

Test a nine-item short form covering one behavior per theme. Do not assume nine selected items reproduce the 27-item diagnostic or its thresholds. Initially return plain-language reported strengths, unknowns and useful next questions. Show no initial default score and no fake peers. Offer continuation after useful feedback.

Legacy self-check responses, if ever retained, must be tagged with the original instrument and kept separate from future diagnostic research. There is currently no evidence that the existing browser-only implementation has a stored research dataset.

## Interviewer instructions

Use the same core question intent and time window in every mode. Clarify through an approved glossary. Ask one follow-up at a time. Do not assume an answer from public material or the respondent's seniority. Never answer for the participant. Let them nominate an informed colleague.

For voice, display the transcript and proposed structured interpretation for correction. Confirm names, numbers, negatives, percentages and scope. Freeze core responses before showing tailored advice. Log mode and wording/model versions. Pilot language and mode equivalence before pooling without qualification.

## Pilot review sheet

For every item record comprehension, answer time, missingness, floor/ceiling effects, evidence feasibility, reviewer disagreement, duplication and usefulness in the private report. For the whole interview record fatigue, abandonment, consent comprehension, perceived usefulness and willingness to repeat. Revise questions that mainly measure eloquence, technology budget or willingness to disclose.