What Is The Compounding Technology Shadow Wave™?

Posted on May 8, 2026

0


“Every technology wave leaves behind operational shadows. AI is the first wave capable of learning from, interacting with, and accelerating all the previous ones simultaneously.” — ARA™ RAM 2025™ multimodel framework

That second sentence names a phenomenon the discourse has not yet given a name to. I am giving it one.

The Compounding Technology Shadow Wave™ is the structural condition the enterprise enters when each successive technology wave fails to displace the prior wave’s shadow infrastructure, and the cumulative shadow stack starts feeding, accelerating, and propagating through the next wave’s deployments. It is what makes the AI implementation success problem categorically different from the three prior waves’ implementation problems. And it is what the standard “shadow IT” and “AI governance” framings keep mis-naming as discrete waves, when the structural reality is that none of the prior waves ever ended.

The post that introduced the four-wave pattern — Marijn’s Data Is Wave Four — established that bottom-up technology adoption has outrun sanctioned governance four times in the last thirty-five years: spreadsheets in the 1990s, BYOD from 2007, SaaS apps from 2012, AI from 2022. What that piece did not yet name is what happens when those four waves are present in the enterprise simultaneously, all of them still operating, with AI now running on top of the cumulative stack.

That is the Compounding Technology Shadow Wave™. This piece is the structural diagnosis.

The pattern that hasn’t ended

Start with what’s actually still in the enterprise as of 2026.

Wave 1 — Spreadsheets. Not in decline. Roughly 85 to 90 percent of organizations still rely on spreadsheets for core procurement, finance, and analytical work, with 2026 data from AutoRek, Dresner, and ThoughtSpot all converging in that range. Excel alone has 800 million users globally; Google Sheets adds another 160 to 180 million. Thirty-five years after the spreadsheet wave entered the enterprise, it is still at near-saturation. Every “death of the spreadsheet” prediction in the last twenty years has been wrong.

Wave 2 — BYOD. 95 percent of organizations permit BYOD in 2026 (Cybersecurity Insiders). 82 percent have formal policies. 90 percent of employees use a mix of company-issued and personal devices for work — and most importantly, 67 percent of employees use personal devices for work regardless of whether their employer has a policy, meaning two-thirds of the workforce is in BYOD shadow even where governance exists. 97 percent of business executives access work accounts on personal devices. Eighteen years after the iPhone, the perimeter the IT function once defended has not been reconstituted. It has been ceded.

Wave 3 — SaaS apps. Zylo’s 2026 SaaS Management Index puts the average enterprise at 305 SaaS applications. CloudNuro’s figure for large enterprises (5,000+ employees) is 371. Other 2026 measurements run as high as 410. The Forrester/Airtable figure of 367 apps from December 2022 — which I documented at the time — has been corroborated and exceeded. 56 percent of SaaS purchases happen outside IT; one 2026 study puts unsanctioned SaaS at 65 percent of the typical workplace’s stack. Only 38 percent of SaaS spend is managed by IT. Average per-employee SaaS spend is now $9,643 a year, with 25 to 44 percent of licenses unused or underutilized. Fourteen years after the SaaS sprawl reports started circulating, the wave has not been resolved. The shadow fraction of Wave 3 alone is larger than the sanctioned footprint of most prior waves.

Wave 4 — AI. 47 percent of procurement professionals use AI every working day (Overvest, May 2026), with only 8 percent in organizations that have formally embedded it and 83 percent operating without an enforced AI policy. Outside procurement specifically, Microsoft’s Work Trend Index found 70 percent of employees already using generative AI at work, with half having started without leadership approval. Menlo’s data puts 60 percent of AI users on personal or unmanaged tools rather than enterprise-approved ones. Three and a half years after ChatGPT’s launch, AI is at adoption rates spreadsheets took two decades to reach.

The cumulative picture is the point. None of the four waves has been displaced. All four are operating simultaneously. Every prior wave’s shadow infrastructure is still in the enterprise, and the AI wave is being added on top of all of them — at a cadence the prior waves never approached.

How the compounding works

The compounding mechanics are not abstract. There are three specific structural pathways through which the prior waves’ shadows act on AI implementations, and through which AI propagates the prior waves’ problems forward at machine cadence.

Input contamination. AI deployments draw inputs from the data the organization actually has — and that data lives in spreadsheets, accessed through BYOD-era device patterns, and routed through SaaS applications, procurement never sanctioned. The AI is performing perfectly against inputs that have inherited every error, every shadow workflow, every guardrail bypass from the prior three waves. Wave-4-quality decisions made against Wave-1-quality inputs are not Wave-4 outcomes. They are Wave-1 outcomes accelerated by Wave 4.

Provenance breakage. AI-generated outputs have to be defensible — to auditors, to regulators, to the board, and increasingly to courts. Defensibility requires knowing where inputs came from, what assumptions they embedded, and what guardrails they were validated against. Spreadsheets carry no provenance. BYOD-era data flows carry no provenance. Shadow SaaS applications carry partial provenance at best. When AI outputs need to be defended, the chain breaks at whichever upstream wave’s shadow the inputs traversed. The Wave 4 deployment may have succeeded technically; the Wave 1, 2, and 3 shadows have made the success undefendable.

Reversion path reactivation. When AI deployments stall or produce unexpected outputs, users revert. They do not revert into a vacuum. They revert to the wave they were operating in before the AI deployment landed — usually the spreadsheet, sometimes the SaaS app, occasionally a personal device workflow. Each reversion path is a different prior-wave shadow being reactivated. The Wave 4 implementation does not just fail in isolation when this happens; it pushes the organization backward through the wave stack, reactivating shadow patterns that had been partially dormant. Failure cascades downward through prior waves.

These three mechanisms are not additive. They are multiplicative. A 20 percent error rate in Wave 1 spreadsheets, compounded by a 15 percent visibility gap in Wave 2 BYOD, compounded by a 30 percent shadow sanction rate in Wave 3 SaaS apps, produces an AI deployment whose effective decision quality is degraded by far more than any single wave’s contribution would predict. This is what the discourse fails to name when it treats each wave’s shadow as a discrete governance problem.

Why AI is structurally different from the prior waves

The opening line of this piece names the structural difference in three verbs. AI is the first wave capable of learning from, interacting with, and accelerating all the previous ones simultaneously. Each verb does specific work.

Learning from. AI deployments are trained on or fed inputs from the prior waves’ artifacts. Spreadsheets become training data. SaaS app outputs become context. BYOD-era email and document corpora become retrieval material. Every prior wave’s shadow becomes substrate for the AI wave. Spreadsheets did not learn from anything. BYOD did not learn from anything. SaaS apps largely did not learn from each other in any deep sense. AI is the first wave that consumes the prior waves as input rather than just sitting alongside them.

Interacting with. AI agents reach into the prior waves’ systems and exchange with them in real time. The AI is reading the spreadsheet, calling the SaaS API, accessing data through BYOD-era access patterns, and executing within the SaaS application’s permission scope. The prior waves were largely passive substrates that humans interacted with. AI interacts with them directly, often without a human in the loop. This is a category shift in what the prior shadow waves do once AI is present — they become surfaces the AI operates against, not just artifacts the human operates against.

Accelerating. AI propagates not only its own decisions at machine cadence but also the prior waves’ embedded assumptions, errors, and unvalidated logic at machine cadence. Wave 1 spreadsheet errors that used to surface gradually as humans noticed them now surface at the speed AI consumes them. Wave 3 SaaS data hygiene problems that used to be tolerable because humans were the bottleneck now scale because the bottleneck is gone. AI does not just compound the prior waves. It speeds them up.

This is why the Compounding Technology Shadow Wave™ is structurally different from prior shadow IT problems. The prior waves added to the stack. AI operates on the stack.

The cadence has compressed

Each successive wave has reached near-universal status faster than the one before it.

Spreadsheets took roughly 35 years to reach 85 to 90 percent saturation. BYOD reached 95 percent in 18 years. SaaS apps reached effective ubiquity in 12 years. AI is at 47 percent daily use after 3.5 years. The implication is structural: by the time the organization has finished diagnosing wave four, wave five will already be at 30 to 40 percent adoption. The grace period the prior waves afforded — fifteen years for the spreadsheet wave to surface its structural failures, three to five years for SaaS sprawl — is gone. AI failure modes that took a decade to manifest in 1998 will manifest in fifteen weeks in 2026.

This is the part most current AI-readiness commentary keeps missing. The structural risk of shadow adoption has been with us for thirty-five years. What changes in 2026 is the speed at which the risk converts into consequences the organization can no longer absorb gracefully.

What addresses the Compounding Technology Shadow Wave™

Single-wave governance does not work against a multi-wave structural phenomenon. Shadow IT remediation tools address Wave 3 inside Wave 3. AI governance platforms address Wave 4 inside Wave 4. Mobile device management addresses Wave 2 inside Wave 2. Spreadsheet rationalization addresses Wave 1 inside Wave 1. None of those tools, by themselves or in combination, address the compounding effects across waves — because each tool was designed to a single-wave problem definition.

What addresses the Compounding Technology Shadow Wave™ is structurally different. It is a two-tier resolution architecture, not a single intervention.

Phase 0™ is the diagnostic that surfaces the multi-wave shadow stack — across all four waves, in a single readiness profile, before AI deployment lands on top of it. The methodology is wave-agnostic by design. It does not care whether a shadow workflow is from Wave 1 or Wave 4. It cares that the workflow exists, where the data lives, what guardrails it bypasses, and how decisions flow through it. The output is a documented exposure map the organization can use to either remediate the exposure before deployment or scope the deployment to account for it.

Phase 0™ surfaces. It does not remediate alone.

The first tier of the resolution architecture is the relational governance layer. Andy Akrouche’s Strategic Relationship Solutions Relationship Business Model (SRS RBM®) replaces transactional vendor contracts with adaptive Relationship Charters that can evolve as the technology evolves. SRS RBM® sits between the exposure map and the operational disciplines for a structural reason: the operational work depends on having a contractual frame that can adapt to what the operational work surfaces. Without the relational layer in place, the operational disciplines are constrained by vendor relationships that cannot accommodate what they discover. The resolution stalls at the contract boundary. While other relational models are available on the market, SRS was the first to operationalize this approach successfully, which is why the framework references it here as the integrated relational governance instrument.

The second tier is the operational disciplines that do the wave-specific resolution work within the relational frame. Workflow rationalization addresses the Wave 1 spreadsheet base. Perimeter governance addresses Wave 2 BYOD touchpoints. SaaS rationalization addresses Wave 3 sprawl. AI usage policy addresses Wave 4 individual AI use. Each operates within the adaptive contractual envelope SRS RBM® establishes.

All of these tiers produce governance instruments that are operationalized in the execution layer. Phase 0™ produces the exposure map. SRS RBM® produces the adaptive Relationship Charter. The four operational disciplines produce wave-specific remediation specifications. None of these instruments do their own work. They are operated by humans — and increasingly by agentic AI acting under delegated authority the Charter specifies — who execute against the instruments to produce the resolution outcome. The execution layer is where the framework’s governance becomes operational reality.

The diagnostic-plus-relational pairing of Phase 0™ + SRS RBM® is the load-bearing core of the architecture. The four operational disciplines are the wave-specific resolution work that the load-bearing core enables. The execution layer is where humans and their delegated agents apply that work to produce the resolution. None of the operational disciplines, alone or in combination, resolves the Compounding Technology Shadow Wave™ without the relational layer providing the contractual frame they operate within. The combined architecture is the structural answer to a multi-wave problem the rest of the market is still trying to solve one wave at a time.

The contemporaneous archive

The pattern visible in the 2026 data did not become visible in 2026. It was being documented in real time, with corroborating evidence, in this archive for nineteen years. The 2008 piece on SAP procurement failures. The 2010 piece on SaaS sprawl and the snakes-out-of-the-playpen argument. The 2018 transformation question. The May 2025 spreadsheet decline analysis. The December 2025 humans-at-the-wheel argument. The May 2026 Bolt-Ons IKEA-box piece. The May 8 Wave Four post. Each was contemporaneous. Each named a piece of the pattern as it emerged, with the language available at the time.

The Compounding Technology Shadow Wave™ is the synthesis these pieces have been moving toward. The Real-World Condition Substrate™ is what makes the synthesis defensible against the question “how do you know?” The answer is: because it was on the page when nobody else was incentivized to write it down.

What the senior buyer should actually ask

The question is not how do we govern AI?

It is: what is the cumulative shadow exposure our AI deployment will inherit, and which combination of disciplines is going to address each layer of it?

That question changes the scope of work, the sequence of engagements, and the criteria for evaluating success. It also rules out almost every off-the-shelf “AI readiness” or “shadow IT remediation” offering currently on the market, because none of them are scoped to the multi-wave reality.

The Compounding Technology Shadow Wave™ is the structural condition. Phase 0™ surfaces it. SRS RBM® plus the multi-discipline handoff architecture resolves it. The archive documents that the pattern has been forming for thirty-five years and predicts what comes next.

What changes in 2026 is the cadence. What does not change is the underlying structure.

—30—


Compounding Technology Shadow Wave™ · Phase 0™ · Hansen Fit Score™ (HFS™) · RAM 2025™ · Real-World Condition Substrate™ · Strand Commonality™ Hansen Models™ · Founder: Jon W. Hansen · hansenprocurement.com

Posted in: Commentary