Unwritten Rules: The Institutionalized Shadow AI

I spoke with an IT manager on Monday morning. I asked:

“How many AI agents are running in your organization right now?”

The answer came back like this:

“Everyone knows, but there is no count. HR has a Notion database where they paste CVs into Claude and pull out summaries. The product manager uses ChatGPT when writing new product specs. The data team has a Python script with an embedded model — nobody explicitly set it up, but it works. Finance is pulling results through an LLM endpoint for billing automation; someone connected it, but there’s no documentation.”

I asked: “Do you have a policy?”

“No. And no prohibition either. Everybody does it, nobody sees it as wrong. But there’s no written board decision, no contract, not even a list.”

This is undocumented institutionalization. The most dangerous version of shadow AI.

Human Rules and AI Rules Are Not the Same

Human process works like this: “Budget reviews happen in Monday meetings.” Everyone knows it. Not written, but organizational memory carries it. If someone leaves tomorrow, the ritual stays. Human decision-makers automatically transfer unwritten rules.

AI process should not work this way: “Someone in Finance passed an API key, there is a script in the data team, it works, but who has the spec? When did we last update the model? Is the company paying for external SaaS? Is the data-sharing agreement signed?”

To answer these questions, someone must write down the process, document it, and assign responsibility.

An unwritten AI rule is a crisis waiting to happen.

Institutionalized Shadow: Known But Not Documented

Shadow AI comes in two versions:

Widely Known: Everyone knows the accounting manager pastes email drafts into ChatGPT. It’s not a secret. But there’s no written rule. If this practice is risky according to the company’s data policy, or handles customer data, nobody can stop it — because there’s no written prohibition.

Carried by Organizational Precedent: If Finance claims they only use LLMs on specific datasets, the auditor asks: “Which LLM? Is the data encrypted in transit?” Answer: “I don’t know.” That answer goes into an audit report.

Both are risky.

The Fragmentation of Undocumented Responsibility

As unwritten rules age, ownership dissolves:

Day 1: A data analyst puts a model script in a private repo. Internal use only.

Month 2: Another team adapts the script for a different dataset. Still private.

Month 4: The output starts being stored in the general database. Now five people depend on it.

Month 6: The original analyst leaves the company. Who owns the script? Officially, nobody.

Month 8: The script produces an error. A miscalculated number in the database makes it into a financial report. Who answers?

When you invoke “unwritten rules,” nobody can.

How Risk Penetrates the Organization

Undocumented AI rules carry three risks:

Data Risk: If rules aren’t written, it’s hard to define which data goes into which AI system. Result: sensitive data can enter what looks like a routine practice.

Accountability Risk: If a system fails or causes harm, a structure without a named owner leaves the question of responsibility open. The organization’s response can’t be concluded with a name.

Change Risk: Changing or improving undocumented rules is nearly impossible. Because nobody has heard the original rule defined, they cannot design something better.

How to Start: Inventory + Written Form

One step:

1. Ask: “Do we have any AI routines right now that are institutionalized, everyone knows, but written nowhere?”
2. For each answer, write a mini-document: “What work does it do? Who uses it? What data does it process? If something breaks, who hears about it?”
3. Color-code this list by risk: green (low risk), yellow (audit required), red (written policy needed).

Unwritten rules are not a sign of organizational maturity. The opposite: a sign of control gaps.

About this post: Undocumented but institutionalized AI use in an organization is the most dangerous form of shadow AI. The first step is seeing the gap between “everybody knows this” and “we manage this.”