When an AI feature changes the data flow: what to do first
An AI feature that changes how personal data moves through your systems needs assessment before it goes live, not after a complaint arrives. Pause the rollout, map the new flow, and check whether the feature falls within the scope of the AI Act. Only then decide whether the change can proceed as planned.
What the law expects when the flow changes
Two European instruments are directly relevant. If the feature qualifies as an AI system, obligations under Regulation (EU) 2024/1689 (AI Act) attach according to the risk category of the system, with the regulation taking effect from 2 August 2026 (position as at 3 March 2025). If your organisation falls within the scope of network and information security rules, a change that affects the security of your systems may fall under Directive (EU) 2022/2555 (NIS2).
Separately, any change that alters how personal data is collected, combined or shared normally requires a fresh assessment under the applicable data protection framework. That assessment belongs before the change is deployed, not once it is already live.
What changes in practice
A new AI feature rarely changes the stated purpose of a system on paper. It usually changes the practical flow: what data is read, where it is sent, and how long it is kept. That practical shift is what triggers the assessment duty, even where the underlying contract or privacy notice has not been amended yet.
If the vendor behind the feature is also changing ownership at the same time, see When a change of control triggers termination and the licence terms that follow it.
What to do first
- Freeze the rollout until the new flow is mapped end to end.
- List every system, vendor and jurisdiction the data now touches.
- Assign the assessment to the data protection function, not to engineering alone.
- Check whether the feature qualifies as an AI system under Regulation (EU) 2024/1689 (AI Act) and record the risk category.
- Where NIS2 applies to your organisation, confirm whether the change is reportable.
- Document the decision to proceed or to pause, with the date and the approver's name.
| Step | Typical actor | Typical timing |
|---|---|---|
| Freeze the rollout | Product owner | Immediate |
| Map the new flow | Engineering with the data protection function | Within days |
| Classify risk under the AI Act | Data protection officer or legal | Before go-live |
| Check NIS2 reportability | Security team | Before go-live |
| Sign off the decision | Management or board | Before go-live |
Who decides, and on what evidence
The decision to proceed sits with the controller of the data, not with the team that built the feature. In most organisations that means the data protection officer, or the person designated to hold that function where none has been formally appointed. The evidence a decision rests on is the flow map, the risk classification, and the sign-off record, not the marketing description of the feature.
If a regulator later asks why the feature went live, these three documents are what a national supervisory authority in Lithuania or Estonia will expect to see first.
If your situation differs
If the underlying model was built by a former team member who is now named as inventor on a separate filing, see An ex-employee appears as an inventor elsewhere patent in a different jurisdiction can affect who owns the outputs of the training data.
If the feature was assembled using open-source components, see When open source is found in the delivery and the licence terms attach to the feature itself.
If the data flow also feeds a tokenised product, see When holders demand redemption step by step for the separate obligations that apply there.
What this page does not cover
This page does not set out the substantive rules for a specific AI risk category, and it does not calculate whether your particular processing needs a full data protection impact assessment. Those steps depend on the feature and the data involved, and they follow once the flow has been mapped.
Verified
Checked as at 3 March 2025. Sources: Regulation (EU) 2024/1689 (AI Act), entry into force from 2 August 2026; Directive (EU) 2022/2555 (NIS2).
Related situations
For the audit angle specifically, see When a customer demands an audit in detail before you respond to the client's request.
FAQ
What is the first step when an AI feature changes the data flow?
Freeze the rollout and map the new flow before doing anything else. Do not rely on the previous assessment of the system, because the flow, not the label, is what has changed.
Which deadline is already running?
No statutory countdown starts automatically the moment the feature is built. The practical deadline is the go-live date you have already set: the assessment must finish before that date, not after it.
Who decides, and on what evidence?
The controller of the data decides, usually through the data protection officer. The evidence is the flow map, the risk classification under the AI Act where relevant, and a dated sign-off record.