When Excel sheets and AI agents become mission-critical without anyone owning them
In almost every major organization, they exist. Excel sheets that calculate key metrics, compile monthly financial statements, manage budget processes, or form the actual truth behind important management decisions. In recent years, the same phenomenon has begun to emerge around AI agents, Copilot solutions, Claude-based applications, and low-code platforms like Lovable. They are often created to solve real problems quickly and efficiently. The problem is that they are rarely considered systems. Until the organization realizes that it can no longer function without them. The underlying business problem is not about Excel or AI. It is about the lack of governance, ownership, and lifecycle management of business-critical information solutions.
The business problem and its consequences
When an Excel sheet is used to calculate financial results month after month, it has in practice become part of the organization's information system. The same applies to an AI agent that analyzes customer inquiries or generates decision-making material for the business.
Despite this, the components that normally surround a formal IT system are often missing:
• System owner
• Management model
• Documentation
• Version management
• Risk analysis
• Transfer of skills
• Continuity planning
The result is that the organization gradually builds up a parallel system environment, sometimes called shadow IT or shadow systems.
The symptoms are well-known:
• No one knows exactly how many solutions there are.
• No one has a comprehensive overview of dependencies.
• Critical knowledge exists in individual individuals.
• The solutions lack the budget for maintenance.
• Security and quality risks increase over time.
The real risk arises when the key person behind the solution becomes ill, changes jobs, or retires. Then the organization discovers that a seemingly simple spreadsheet is actually a business-critical component. For AI agents and generative AI solutions, the consequences can be even greater because they are often integrated with multiple data sources and business processes simultaneously.
Who owns the responsibility?
Perhaps the most important question is not who built the solution, but who owns it. In many organizations, a conflict arises between the responsibility vacuum: The business believes that the solution is technical and therefore the responsibility of IT. IT believes that the solution was developed locally by the business and therefore is the responsibility of the business. The result is that no one has a clear mandate. Ultimately, this is a management issue. The management team needs to define:
• When a local solution becomes mission-critical.
• What requirements should apply then.
• Who becomes the system owner.
• How the solution should be managed.
Normally, it should be:
• The operations manager should be the system owner.
• IT support with technology, security and architecture.
• The finance and risk functions contribute with a control perspective.
• HR contributes to skills supply and knowledge transfer.
A Chief of Staff does not replace these roles but can create the coordination that is often lacking between them.
Possible rotor issues
Several underlying causes can explain why the problem arises.
- The organization's needs evolve faster than the central systems
When business needs change, the organization often finds that existing systems are not sufficient.
Signs to investigate:
• Many manual processes.
• Recurring local initiatives.
• High usage of Excel as an integration platform.
In these situations, the spreadsheet or the AI agent becomes a way to fill a gap. - No common definition of what constitutes a system
Many organizations consider only purchased or centrally developed solutions to be systems. But if the operation depends on a solution to function, it has already become a system, regardless of the technology used.
Signs:
• Excelark is used in official reporting.
• AI agents are used in regular workflows.
• Local databases are used as the primary source of information. - Innovation incentives without management responsibility
Organizations often encourage innovation but lack corresponding requirements for long-term management. Employees receive recognition for creating new solutions, but rarely are they held accountable for their life cycle.
Signs:
• Many pilot projects.
• Few settled solutions.
• Unclear financing after implementation. - Deficient information architecture
When the organization lacks a unified view of information flows, local solutions naturally emerge.
Signs:
• Double registration of data.
• Many local data copies.
• Incomplete information owners. - Underestimation of technical debt. An Excel sheet is often perceived as ”free” to develop. But the cost is still there:
• Risk of errors
• Person addictions
• Maintenance
• Quality assurance
• Audit work
The same applies to AI agents that need to be updated when models, data sources, or business rules change.
This is how the problem can be solved
Step 1: Make the extent of the problem visible
Objective: Create an inventory of business-critical local solutions.
Responsible: CIO, CFO or business management.
Chief of Staff's contribution: Coordinate the mapping between operations, IT and finance.
Signs of progress: The organization has a common list of critical Excel sheets, databases, AI agents, and low-code solutions.
Step 2: Preparing for classification
Not all local solutions need to be treated equally.
Objective: Identify which solutions are business-critical.
The classification can be based, for example, on:
• Economic impact
• Number of users
• Regulatory requirements
• Information security
• Operational impact
Signs of progress: Critical solutions identified and prioritized.
Step 3: Choose an owner
Every critical solution needs a responsible owner.
Goal: Eliminate the responsibility vacuum.
Responsible: Executive management.
Chief of Staff's contribution: Ensuring that responsibility is documented and decided upon.
Signs of progress: Every critical solution has an assigned system owner and contact person.
Step 4: Towards a lightweight management model
Not all solutions need to be treated like large business systems.
But they need basic management requirements.
Examples:
• Documentation
• Version management
• Eligibility control
• Backup
• Transfer of skills
• Continuity plan
Signs of progress: Documented management procedures for all critical solutions.
Step 5: Establish AI governance
For AI agents, this becomes particularly important.
The organization needs to define:
• Who owns the agent.
• What data it is allowed to use.
• How quality is monitored.
• When it is to be phased out or replaced.
Signs of progress: Common guidelines for AI solutions and agent development.
Chief of Staff's contribution
The problem with shadow systems is rarely technical. It is organizational. Here, a Chief of Staff can play a crucial role by:
• Create the management's overall overview.
• Identify risks that lie between the business and IT.
• Coordinate the responsibilities of multiple functions.
• Ensure that decisions are translated into actual management.
• Follow up to ensure that responsibility is truly assigned and adhered to.
The Chief of Staff serves as the cohesive link between the management team’s strategic ambitions and the organization’s practical reality. This is particularly important when new AI solutions emerge faster than the organization’s existing governance models.
Conclusion and next steps
The central question is not really how many Excel sheets or AI agents are in the organization. The central question is which of them have become so critical to the business that the organization can no longer function without them. The moment a local solution becomes necessary for financial reporting, decision-making, or operational activities, it has practically gone into production. This also creates a leadership responsibility. The next step for the leadership team should therefore be to decide on an inventory of business-critical local solutions and establish the principle that each such solution must have a defined owner, a management model, and a plan for continuity.
A Chief of Staff cannot solve the problem alone, but can provide the leadership, coordination, and implementation power required to ensure that innovation does not turn into the technological and organizational liability of the future.
