The shadow systems that have become operational critical
In many organizations, local solutions have emerged to quickly address business needs when the central systems have not been able to meet new requirements quickly enough. Over time, these solutions become business-critical without the organization fully realizing it. For example, an Excel sheet can become the primary source for financial reporting, forecasting, or budget management. Similarly, an AI agent can be used to analyze customer cases, generate decision support, or support operational processes. Despite this, documentation, version control, continuity planning, risk analysis, and designated owners are often lacking. Who manages the shadow systems?
The business risks are significant. Incorrect calculations or AI-generated conclusions can lead to erroneous investments, incorrect financial reporting, lack of regulatory compliance, and strategic decisions based on flawed assumptions. If a key person leaves the organization, critical knowledge risks being lost, which can cause serious operational disruptions or business disruptions. Furthermore, deficiencies in information security can result in data leaks, regulatory sanctions, loss of customer trust, and increased audit notes.
In the long term, an uncontrolled amount of shadow IT can create extensive technical debt where costs for maintenance, troubleshooting, quality assurance, and risk management grow faster than the organization’s ability to manage them. In the worst case, erroneous financial reporting, serious security incidents, regulatory interventions, or prolonged business disruptions can have such large financial consequences that the organization’s profitability, competitiveness, and in extreme cases its continued existence are threatened. Therefore, business-critical Excel sheets, AI agents, and other local solutions must be considered information systems with the same requirements for ownership, governance, management, and continuity as the organization’s other business-critical systems.
Zero point
- Operational critical solutions are used without a designated system owner.
- Knowledge is concentrated in individual individuals.
- Documentation, version management, and continuity plans are lacking.
- AI agents are used without defined ownership or AI governance.
- There is no comprehensive inventory of critical local solutions.
Risks
- Addictions to people.
- Inaccurate decision-making material.
- Deficiencies in information security and regulatory compliance.
- Disruption when key personnel leave the organization.
- Increased technical debt and management costs over time.
Desired location
- All business-critical shadow systems have been identified.
- Each solution has a designated business owner.
- Management requirements are defined based on the criticality of the solution.
- AI agents are governed by a common AI governance model.
- Management has transparency regarding risks, costs, and dependencies.
Knowledge areas that are required or need to be utilized
| Field of knowledge | Why it is needed |
| Information management | To define ownership, information classification and lifecycle management |
| IT governance | To create governance and decision-making models |
| Enterprise Architecture | To understand the dependencies between solutions and processes |
| AI Governance | To manage AI agents in a controlled manner |
| Information security | To reduce data risks and access issues |
| Risk Management | To prioritize critical solutions |
| Process development | To identify why shadow systems arise |
| Change management | To gain acceptance for new working methods |
| Financial management | To make costs and technical debt visible |
Additional areas of knowledge
- Microsoft Power Platform Governance or equivalent
- Microsoft Copilot Governance or equivalent
- Data Governance
- Digital asset management
- Continuity and crisis management
- ISO 27001 / NIS2-compliant governance (where applicable)
Proposal for a solution in the short term
Phase 1: Invent all critical shadow systems. Conduct a structured mapping of:
- Excel sheets used for reporting or decision-making
- AI agents
- Copilot solutions
- Access databases
- Low-code/no-code solutions
- Custom integrations and scripts
For each solution, documentation is provided:
- Owner
- Purpose
- Number of users
- Process supported
- Business influence
- Information classification
- Technical environment
Results: A common register of all critical local solutions.
Phase 2: Introduction to a criticality model. Examples of classification:
| Class | Description |
| K1 | Operational critical |
| K2 | Business-relevant |
| K3 | Local support solution |
| K4 | Personal workspace |
The classification is based on:
- Economic impact
- Regulatory requirements
- Information security
- Operational impact
- Number of users
Phase 3: Appointment of formal system owners. Recommended principle:
| Responsibility | Role |
| System owner | Operations Manager |
| Information owner | Process owner |
| Technical manager | IT |
| AI Responsible | AI Governance Board |
| Risk owners | Risk function/CFO |
Here, the management should make a formal decision that eliminates the accountability vacuum described in the problem statement. [chiefofstaff.se]
Phase 4: Towards a ”Lightweight Governance”. Not all solutions need to be treated like SAP, Dynamics, or other business systems.
However, for each K1 or K2 solution, the following is required:
- Documentation
- Version management
- Backup
- Authority control
- Incident management
- Transfer of skills
- Annual risk review
Proposal for a long-term solution
Establish a permanent Digital Governance Board. Participants:
- CIO
- CFO
- Business representatives
- Information Security Officer
- HR
- Enterprise Architect
- AI Governance Lead
- Chief of Staff
Responsibility:
- Prioritizing new solutions
- Risk management
- Governance of AI agents
- Administrative decisions
- Liquidation decision
Create a common ”Citizen Development Framework”. Instead of opposing local initiatives, the organization should enable them in a controlled manner. The model includes:
- Approved platforms
- Templates
- Safety requirements
- Data guidelines
- AI guidelines
- Administrative requirements
Towards AI Governance as a permanent function. For each AI agent, the following should be defined:
- Business Manager
- Data sources
- Permitted use
- Quality measures
- Risk classification
- Discharge plan
No agent should be able to be operational critical without formally being covered by the governance model.
Target for 3 years. The organization has:
- Complete overview of critical shadow systems
- Clear ownership
- AI agent register
- Controlled innovation
- Reduced personal dependence
- Lower technical debt
- Higher information security
Responsibility and Drive (RACI)
| Activity | CEO/Management | CIO | CFO | Operations Manager | IT | Risk/ Security | HR | Chief of Staff |
| Inventory | A | R | R | R | C | C | I | R |
| Classification | A | R | C | R | C | R | I | C |
| Appoint system owner | A | C | C | R | I | I | I | R |
| Management model | C | A | C | R | R | C | C | C |
| AI governance | A | R | C | C | C | R | I | C |
| Transfer of skills | I | C | I | R | C | I | A | C |
| Risk monitoring | C | C | A | R | C | R | I | I |
| Disassembly of solutions | A | R | C | R | C | C | I | C |
A = Accountable
R = Responsible
C = Consulted
I = Informed
Need for consultants
External consultants should only be used where specialist expertise is lacking.
| Area | Mission | Action |
| Enterprise Architecture | Mapping dependencies | Short project effort |
| AI Governance | Design of the governance model | Limited specialist intervention |
| Information security | Risk assessment and classification | Point bet |
| Change management | Implementation of new working methods | Temporary support |
| Data Governance | Information ownership and data management | Specialist support |
Important requirement: all consulting assignments must include structured knowledge transfer to the organization's own administrators.
Summary and short action plan
The fundamental insight is that the problem is not Excel or AI agents per se. The problem arises when they become business-critical without anyone being responsible for them. Just as the article describes, this is primarily a governance and management problem rather than a technical problem.
| Action | Responsible | Time horizon | Expected result |
| Invent all the shadow systems | CIO + business | 0-3 months | Full transparency |
| Classify solutions | CIO + Risk function | 1-3 months | Priority risk picture |
| Appoint system owner | Management team | 2-4 months | Eliminated the responsibility vacuum |
| Towards lightweight management | CIO | 3-6 months | Reduced personal risk |
| Establish the AI Governance Board | Management | 3-6 months | Controlled AI use |
| Towards citizen-led development governance | CIO + business | 6-12 months | Controlled innovation |
| Establish permanent digital control | Management | 12 months+ | Sustainable management |
Recommendation: Treat business-critical Excel sheets, AI agents, and low-code solutions as information systems as soon as the business becomes dependent on them. Then the same principles should apply: identified ownership, defined governance, risk management, and continuity planning.
Read more about prioritization->
Go to business problems ”Shadow system”->
