Unwritten Rules: The Institutionalized Shadow AI

I spoke with an IT manager on a Monday morning. I asked:

“How many AI agents are running in your organization?”

The answer came back like this:

“Everyone knows but there’s no count. HR has a Notion database where they paste CVs into Claude and extract summaries. The product manager uses ChatGPT while writing new docs. The data team has a Python script with an embedded model that nobody explicitly set up, but it works. Finance is pulling results through an LLM endpoint for billing automation — someone hooked it up, but there’s no documentation.”

I asked: “Do you have a policy?”

“No. And there’s no prohibition either. Everyone does it, nobody sees it as wrong. But there’s no written board decision, no contract, not even a list.”

This is undocumented institutionalization. The most dangerous version of shadow AI.

Human Rules and AI Rules Are Not the Same

Human process works like this: “Roadmap reviews happen in Monday meetings.” Everyone knows it. Not written, but organizational memory carries it. When someone leaves tomorrow, the old employee or new manager, the ritual remains. Human decision-makers automatically transfer unwritten rules.

AI process should not work like this: “Someone in Finance passed an API key, there’s a script in the data team, it works, but who has the spec? When did we last update the model? Is the company paying for external SaaS? Is the data-sharing agreement signed?”

To answer these questions, someone must write down the process, document it, and assign responsibility.

Unwritten AI rules are a crisis waiting to happen.

Institutionalized Shadow: Known But Not Documented

Shadow AI comes in two versions:

Widely Known: Everyone knows the accounting manager pastes email drafts into ChatGPT. It’s not a secret. But there’s no written rule. If this practice is risky according to the company’s data policy, or contains customer data, nobody can stop it because there’s no written prohibition.

Carried by Organizational Precedent: If Finance claims they only use LLM on specific datasets, the auditor asks: “Which LLM? Are the data encrypted in transit?” Answer: “I don’t know.” That answer goes into an audit report.

Both are risky.

The Fragmentation of Undocumented Responsibility

As unwritten rules age, who owns what?

Day 1: A data analyst puts a model script in a private repo. Internal use only.

Month 2: Another team adapts the script for a different dataset. Still private.

Month 4: The output starts being stored in the general database. Now five people depend on it.

Month 6: The original analyst leaves the company. Who owns the script? Officially, nobody.

Month 8: The script produces an error. The miscalculated number in the database makes it into a financial report. Who answers?

When “unwritten rules” are invoked, nobody can.

How Risk Penetrates the Organization

Undocumented AI rules carry three risks:

Data Risk: If rules aren’t written, it’s hard to define which data goes to which AI system. Result: sensitive data can enter what looks like a reasonable practice.

Accountability Risk: If a system fails or causes harm, a structure without a named owner leaves the question of responsibility open. The organization’s response can’t be concluded with a name.

Change Risk: Changing or improving undocumented rules is nearly impossible. Because nobody has heard the original rule defined, they cannot design something better.

How to Start: Inventory + Written Form

One step:

1. Ask: “Do we have any AI routines right now that are institutionalized, everyone knows, but written nowhere?”
2. For each answer, write a mini-document: “What work does it do? Who uses it? What is its data? If something breaks, who hears about it?”
3. Color-code this list by risk: green (low risk), yellow (audit required), red (written policy needed).

Unwritten rules are not a sign of organizational maturity. The opposite: a sign of control gaps.

About This Post: Undocumented but institutionalized AI use in an organization is the most dangerous form of shadow AI. The first step is seeing the gap between “everyone knows this” and “we manage this.”