I have watched organizations buy an observability platform, announce the migration, get a few teams onboarded, and then discover eighteen months later that half of engineering is still shipping logs to the old system, while three teams quietly built something homegrown that nobody in leadership knows exists. The official story says one thing, what people actually do says another, and nobody is exactly lying.
The U.S. Census Bureau published a working paper in April that puts national-scale numbers on a version of this for AI. Drawing on surveys of more than 117,000 businesses conducted from late 2025 through early 2026, it found about 18% of firms using AI in their operations and about 23% with workers using AI for job tasks.
Those two groups don't fully overlap. About 14% reported both. But 6.8% had workers using AI with no formal organizational adoption at all, and 2.5% had formally adopted AI with no reported worker use.
If you've spent any time inside a large organization, neither of those surprises you. Tools get bought and never really rolled out. Tools get used without anyone buying them. What makes the Census data useful is that it measures both directions at once, across the whole country, so you can see how big each one is relative to the other.
The first group, workers using AI their organization never formally adopted, has deep roots. Sevda Polat connected it to the spreadsheet pattern in this publication earlier this year: local usefulness outran governance, and individually helpful tools hardened into infrastructure before anyone designed a system. The Census survey can't tell us exactly what's happening inside that 6.8%. It was answered by firm representatives rather than individual workers, and the questions used different time windows. But the shape is familiar. People find something that helps them do their jobs and they start using it. Approval shows up later, or it doesn't.
The second group gets less attention, and it's the one that surprised me. These are firms that formally adopted AI (procured it, deployed it, reported it on a government survey) where no workers are reported using it for tasks. The Census authors suggest this fits centralized or background systems running without direct employee interaction. It could also be mandates that never turned into actual workflow changes. The survey can't tell those apart.
The number I keep coming back to, though, is this one: 64% of AI-using firms reported making none of the listed institutional adjustments. The list covered training, workflows, data practices, and capital investment, and nearly two-thirds of these firms touched none of it. They adopted the thing and didn't adapt anything around it, which means that wherever usage exists, it's being shaped by individual habit instead of by anybody's design.
For agent governance specifically (and to be clear, the Census paper covers AI broadly, not agents), this points to two problems landing at the same time. You have to maintain and understand what was formally deployed; the companion piece on XCON shows what that looks like when a successful system's knowledge grows faster than the organization can keep track of it. And you have to find and govern what grew informally: the locally assembled prompts, tool configurations, and workarounds that nobody approved and nobody inventoried.
An inventory of approved agent platforms misses whatever people built on their own. Digging through informal agent use misses the formally deployed systems whose actual behavior nobody is watching very closely. Spreadsheets came into organizations this way, and so did cloud services and the monitoring tools I opened with. For agents, either governance gets designed for both directions from the start, or it gets designed for one and blindsided by the other.
I know which one I'd bet on, and it isn't the first.