Over the last year, I've started noticing something strange about AI adoption inside organizations.

It rarely announces itself.

There is no kickoff meeting where someone declares that work will fundamentally change on Monday. No clean organizational transition from "before AI" to "after AI." No executive memo that perfectly maps reality.

Instead, the shift arrives sideways.

A manager uses an LLM to summarize a lengthy regulatory update before a meeting. Someone drafts a presentation in an afternoon that would once have taken days of coordination and iteration. A proof-of-concept quietly appears inside a team backlog. An engineer experiments with generating boilerplate code. A difficult email becomes easier to write.

The work still looks familiar from the outside.

The deliverable still exists. The meeting still happens. The report still gets submitted.

What changes first is often invisible: the workflow behind the work.

Behavior has already changed before governance has caught up to explain it.

That realization has changed how I think about the phrase shadow AI.

When people hear the term, they often imagine unauthorized employees secretly pasting sensitive information into ChatGPT or bypassing company rules. That certainly exists, and in highly regulated industries the risks are real.

But there is a broader and more interesting version of shadow AI emerging:

The gap between how people are already working and how the organization officially understands, supports, or governs that work.

And once you start noticing it, you see it almost everywhere.

The First Change Is Usually Delegation

One of the more interesting patterns I've noticed is that AI often changes delegation before it changes systems.

For many organizations, the first visible shift is not a dramatic workflow replacement or autonomous system. It is much smaller and quieter: drafting, summarization, planning, research synthesis, formatting, and communication become faster.

A rough idea becomes a structured outline. A dense document becomes a useful summary. A presentation framework appears before the first meeting is scheduled.

If this sounds familiar, it overlaps with an idea I explored in Try More Things: when the cost of first attempts collapses, experimentation increases. AI lowers the friction required to move from "idea" to "something worth reacting to."

Importantly, none of this removes the need for expertise.

Judgment still matters. The human still validates, contextualizes, edits, and decides what is worth trusting. But expectations begin to shift once first-draft work becomes dramatically cheaper.

The Shadow AI Gap

The simplest mental model I've found for understanding this is something I think of as The Shadow AI Gap.

Organizations now operate on two different timelines.

The first is adoption speed.

This is how quickly people are actually integrating AI into work, whether formally approved or not.

The second is governance speed.

This includes policy, security review, procurement, IT support, legal guidance, approved workflows, training, and operational standards.

In practice, those timelines rarely move together.

Adoption tends to move faster.

Not because organizations are careless, but because useful tools spread through behavior long before they spread through process.

Someone finds a faster way to write. Someone experiments with summarization. Someone improves turnaround time on a deliverable. A team prototypes an idea because experimentation suddenly became cheap.

Meanwhile governance moves more deliberately, for understandable reasons.

These are not bureaucratic obstacles. They are real responsibilities.

But the result is often a widening gap between how work is already changing and how organizations formally describe work changing.

That gap is where shadow AI lives.

Why AI Policies Often Feel Incomplete

Something I've become more sympathetic to recently is how difficult AI governance actually is.

It is easy to criticize policies for being overly cautious, vague, or behind the moment. In reality, most organizations are trying to solve two competing problems at once:

1. Reduce organizational risk.
2. Preserve organizational advantage.

But before governance even begins, organizations run into a more fundamental problem: visibility.

Two questions I've found myself asking repeatedly in departmental discussions are surprisingly simple:

Who is actually using AI for more than one or two tasks a week?

Do we have any visibility into which tools or platforms people are actually using?

Those questions matter more than they initially seem.

Organizations often try to govern AI from policy before they understand behavior.

If adoption is already occurring informally, and in many places it is, then governance starts with understanding reality.

Otherwise, organizations risk building rules around assumptions instead of practice.

You cannot meaningfully govern behavior you cannot see.

Most early AI policies therefore focus on urgent questions first:

• What data absolutely cannot be entered into public systems?
• Which tools are approved?
• What kinds of outputs require human validation?
• When should security or IT become involved?

But they are rarely sufficient.

After the first wave of experimentation, harder questions begin to emerge:

• What work is acceptable to delegate to AI?
• When does experimentation become dependency?
• How do successful experiments become supported workflows?
• What happens when expectations shift around "first draft" work?
• Who owns the operational path from prototype to production?

This is where governance becomes more than compliance. It becomes organizational design.

A Maturity Model for Shadow AI

Most organizations are messy mixtures of experimentation, hesitation, enthusiasm, and policy lag. Different departments may exist in entirely different realities.

Still, a maturity model can help explain what is happening.

Stage 0 - Denial

AI feels hypothetical or too risky. Informal experimentation exists, but leadership has little visibility.

Stage 1 - Delegation

AI starts appearing in drafting, summarization, planning, communications, slide creation, formatting, and research synthesis.

Stage 2 - Experimentation

Proof-of-concepts multiply. Teams test workflows and internal tools.

Stage 3 - Integration

Successful experiments create pressure for repeatability, governance, and operational support.

Stage 4 - Governance

Policy catches up to behavior and creates clarity around tools, review, and implementation paths.

A Five-Minute Shadow AI Audit

What I'm Still Processing

The part I continue to think about is how often organizations speak about AI in future tense.

"This may eventually change how we work."

In many places, I suspect it already has. Quietly.

Through delegation. Through speed. Through changing expectations.

And perhaps the more useful question is no longer:

"Are we adopting AI?"

But:

"How far behind our own behavior is our governance?"

Because shadow AI is not necessarily hidden. Sometimes it is simply organizational reality waiting for structure to catch up.