A controller built a budget model and handed it to her manager on a floppy disk. He adjusted some values, added a layer of analysis, handed it back. In another office, a finance manager sent targeting templates out to departments; staff filled in their numbers and he linked the results together. Elsewhere, people noticed a useful feature in a colleague's file and asked how it was done, or had a more experienced coworker drop formulas and macros into a spreadsheet they'd built themselves. These scenes come from two studies published in 1990 — an ethnography of spreadsheet collaboration and a survey of more than 500 finance and accounting professionals across 18 companies. Both found that spreadsheets spread through interpersonal communication, colleague to colleague. Information-systems departments were peripheral to the whole thing.
That is how spreadsheets became infrastructure. One person showed another something useful. The second person adapted it, and the adapted version became the starting point for someone else's work. Copied, modified, and forwarded enough times, a file was running part of the business. Nobody had decided it was a production system.
Governance came in through a different door entirely. The Basel Committee first named end-user computing as a risk category in 1989, roughly a decade after VisiCalc launched the spreadsheet era. The PCAOB issued explicit spreadsheet-control guidance in 2009. Basel's dedicated risk-data principles, which asked banks to have policies wherever they relied on end-user tools, arrived in 2013. Those documents were produced by audit findings, supervisory review, incident response. None of those processes had much reason to intersect with the hallway where the floppy disk changed hands.
This April, a Census Bureau working paper covering more than 117,000 firms turned up a familiar shape. Among firms surveyed, 6.8% reported workers using AI on tasks with no formal firm-level adoption at all. Another 2.5% reported formal adoption with no corresponding worker-task use. The authors call these "distinct channels of diffusion": firm-level implementation moving through business functions and workflow integration, worker experimentation proceeding task by task. The paper is careful about its own limits. The two measures cover different time windows, and the answers about worker use generally came from someone speaking for the whole firm rather than from workers themselves, which probably undercounts the decentralized kind.
Tools that let a worker encode a decision without filing a ticket travel through informal channels, the ones those 1990 studies documented. Oversight arrives through formal ones: compliance review, audit findings, regulatory guidance. The two serve different purposes, run on different clocks, and report to different parts of the organization, which is why the separation reappears with each generation of tool instead of getting closed once.
What accumulates in the interval matters: which decisions get encoded, which dependencies form, how much institutional knowledge migrates into tools nobody is inventorying. Organizations will govern AI use eventually, the way they eventually governed spreadsheets. What gets built in the meantime is harder to see, and harder to undo.
- Spreadsheet errors in practice: A peer-reviewed audit of 25 operational spreadsheets found 117 confirmed errors, with the largest carrying a $100 million impact — the kind of accumulated risk that governance frameworks were eventually built to catch.
- Federal bot lifecycle gaps: A GSA Inspector General audit found that 55 of 56 custodians assigned to decommissioned bots did not have access removed within the agency's 14-day policy window, illustrating how governance controls can exist on paper while failing operationally.
- Agent production patterns today: A 2025 study of deployed agent systems found that 68% executed ten steps or fewer before human intervention, suggesting that production teams are already trading autonomy for controllability in ways the governance channel hasn't yet formalized.
- Legacy systems as durable substrate: GAO reported in July 2025 that the federal government directs about 80% of its IT spending to operations and maintenance of existing systems, a reminder that new tools often layer onto infrastructure that predates the governance frameworks meant to manage them.