When an AI feature changes the data flow: what it costs to be wrong
An AI feature that reroutes, aggregates, or exposes data to a new processor changes a data flow you have already documented and defended. Miss that change, and you inherit governance gaps under Regulation (EU) 2024/1689 (AI Act), security duties under Directive (EU) 2022/2555 (NIS2), and database extraction risk under Directive 96/9/EC — usually before the feature reaches production, and usually before anyone signed off on the new shape of the flow.
What actually changes
A data flow diagram is a promise: this data goes here, for this purpose, under this control. An AI feature breaks that promise the moment it reads a new field, calls a new model endpoint, or sends output to a vendor you have not assessed. The diagram is now wrong, and every document built on it — the record of processing, the risk assessment, the security policy — is wrong by the same margin.
The trigger is rarely dramatic. A support tool starts summarising tickets that contain customer identifiers. A search feature starts indexing a database you licensed under specific terms. A model call now runs on a third-party host instead of inside your own infrastructure. Each of these is a small engineering decision with a legal consequence attached, and the consequence does not wait for the paperwork to catch up.
This matters because the obligations attached to your system attach the moment the flow changes, not the moment someone updates the diagram.
The legal basis
Three instruments set the frame for a change of this kind. None of them asks whether you meant to change the flow, and none of them cares that the change felt small at the time.
| Instrument | What it governs | Why it matters here |
|---|---|---|
| Regulation (EU) 2024/1689 (AI Act) | Risk classification and data-governance duties for AI systems | A new feature can move the system into a higher risk tier without anyone deciding that on purpose |
| Directive (EU) 2022/2555 (NIS2) | Cybersecurity risk-management and incident-reporting duties for essential and important entities | Rerouting data through a new AI component changes the network and information system already in scope |
| Directive 96/9/EC | Sui generis protection for the extraction and reuse of database contents | An AI feature that pulls from a protected database changes who carries extraction risk |
Regulation (EU) 2024/1689 (AI Act) reaches full application on 2 August 2026 (position as at 10 January 2025); some duties for higher-risk systems apply earlier than that date. Directive (EU) 2022/2555 (NIS2) has applied since 18 October 2024, so entities already in scope carry live reporting duties, not future ones. Directive 96/9/EC has applied for decades, which is exactly why teams stop checking it — and exactly why an AI feature that quietly extracts from a licensed database is easy to miss.
What it costs to get this wrong
The cost is rarely a single fine. It is a chain: the wrong risk classification leads to a missing governance step, the missing step surfaces during an audit or a security incident, and the fix then happens under scrutiny instead of in private. A security incident that touches an unmapped AI component takes longer to contain, because the incident team is working from a diagram that no longer matches reality.
Getting it right early costs a mapping exercise and a short sign-off cycle. Getting it wrong later costs that same exercise, plus the audit, plus a remediation plan written on someone else's deadline, plus the reputational cost of explaining a gap you could have closed months earlier.
What to do, in order
- Map the change. Ask engineering to document which data categories the new AI feature reads, writes, or forwards, and to which processor, before anything ships further.
- Reclassify the system. Have your data protection contact assess whether the change moves the system between risk tiers under Regulation (EU) 2024/1689 (AI Act).
- Check the security boundary. Ask your security lead to confirm whether the new component sits inside the network and information system already registered under Directive (EU) 2022/2555 (NIS2).
- Trace the data source. Have legal confirm whether any dataset feeding the feature is a protected database under Directive 96/9/EC, and whether extraction and reuse were cleared.
- Freeze rollout until sign-off. Instruct product not to ship the feature to production before the three checks above are closed and recorded.
- Log the decision. Record who approved the change, on what evidence, and when — this record is what an auditor or a regulator asks for first.
Who decides, and on what evidence
Internally, the decision sits with whoever owns data protection and security sign-off, working from the mapping record produced in step one. That record — not the original diagram — is the evidence a decision-maker relies on, and it is the evidence anyone outside the organisation will ask to see.
Externally, three different bodies can ask questions, and each asks about a different instrument, on a different clock. A national market surveillance authority asks about classification and conformity under the AI Act. A national competent authority asks about incident handling and risk management under the NIS2 transposition. A civil court asks about extraction and reuse under the national act implementing Directive 96/9/EC. None of the three coordinates with the others, so a single change can open three separate conversations at once.
If your situation is different
The four checks above cover the core case. Several adjacent situations change the order of priority.
If the data behind the feature comes from licensed third-party content rather than data you generated, check royalty reporting before you check anything else — When royalties are underreported explained.
If the method behind the AI feature resembles a technique someone else has already patented, treat any contact from that side as urgent, not administrative — A warning letter arrives from a patent holder patent.
If the delivery pipeline bundles open-source components alongside the AI feature, that is a separate check with its own timeline — When open source is found in the delivery explained.
If the feature also feeds a tokenised product, redemption risk runs on a parallel track — When holders demand redemption and its limits.
What this page does not solve
This page does not classify your specific system, and it does not draft the mapping record for you. It does not name the national authority responsible in your jurisdiction, because that depends on where the entity is registered and how it is designated under each transposition. It does not cover a dispute that has already reached a regulator or a court — at that stage the facts of the file, not a general order of steps, decide the outcome.
Related situations
A similar cost curve applies when the pressure comes from a client rather than a regulator — When a customer demands an audit: what it costs.
Verified
Checked: 10 January 2025. Sources: Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act); Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2); Directive 96/9/EC on the legal protection of databases.
FAQ
What is the first step when an AI feature changes the data flow?
Map the change before anything else. Identify which data categories the feature reads, writes, or forwards, and to which processor, before touching classification or security documents.
Which deadline is already running?
Directive (EU) 2022/2555 (NIS2) has applied since 18 October 2024, so in-scope entities already carry incident-reporting duties. Regulation (EU) 2024/1689 (AI Act) reaches full application on 2 August 2026 (position as at 10 January 2025), with some higher-risk duties starting earlier.
Who decides, and on what evidence?
Internally, your data protection and security functions decide, based on the mapping record from the first step. Externally, a market surveillance authority, a competent authority under the NIS2 transposition, or a court applying the national act implementing Directive 96/9/EC may each ask, depending on which instrument is at issue.