Governing Before Rules. Shadow AI among Legislative Advisors in Mexico City
TL;DR
It is demonstrated that while informal safeguards help manage short-term cybersecurity and accountability risks, they remain fundamentally fragile until codified through formal training, secure infrastructure, and documentation procedures.
Abstract
Generative AI enters legislative advisory work before parliaments adopt formal rules. This article examines this "adoption-rules gap" through an exploratory case study of the Mexico City Congress. Combining a diagnostic survey (N=42) and a co-design workshop, we investigate how frontline advisors manage "shadow AI" without stable institutional oversight. Findings reveal that while adoption is evenly divided, half of the surveyed advisors use AI for auxiliary tasks like document synthesis and preparatory drafting. Crucially, they articulate a shared practical boundary against the unsupervised delegation of final normative text and legal reasoning. Using a three-layer heuristic, we frame these informal rules-in-use as enacted internal governance. Ultimately, the study demonstrates that while informal safeguards help manage short-term cybersecurity and accountability risks, they remain fundamentally fragile until codified through formal training, secure infrastructure, and documentation procedures.
