{"id":43212,"date":"2026-01-20T08:30:31","date_gmt":"2026-01-20T06:30:31","guid":{"rendered":"https:\/\/2b-advice.com\/?p=43212"},"modified":"2026-04-14T14:41:58","modified_gmt":"2026-04-14T12:41:58","slug":"ki-update-new-ki-functions-in-existing-software-as-a-governance-risk","status":"publish","type":"post","link":"https:\/\/2b-advice.com\/en\/2026\/01\/20\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\/","title":{"rendered":"AI update: New AI functions in existing software as a governance risk"},"content":{"rendered":"<div data-elementor-type=\"wp-post\" data-elementor-id=\"43212\" class=\"elementor elementor-43212\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-c7b2801 e-flex e-con-boxed e-con e-parent\" data-id=\"c7b2801\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-050b0fd e-con-full e-flex e-con e-child\" data-id=\"050b0fd\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e9b82df elementor-author-box--align-left elementor-widget elementor-widget-author-box\" data-id=\"e9b82df\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"author-box.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-author-box\">\n\t\t\t\t\t\t\t<a href=\"http:\/\/2b-advice.com\/en\/marcus-belke\/\" class=\"elementor-author-box__avatar\">\n\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/2b-advice.com\/wp-content\/uploads\/2024\/04\/Marcus_B-300x300.png\" alt=\"Picture of Marcus Belke\" loading=\"lazy\">\n\t\t\t\t<\/a>\n\t\t\t\n\t\t\t<div class=\"elementor-author-box__text\">\n\t\t\t\t\t\t\t\t\t<a href=\"http:\/\/2b-advice.com\/en\/marcus-belke\/\">\n\t\t\t\t\t\t<h4 class=\"elementor-author-box__name\">\n\t\t\t\t\t\t\tMarcus Belke\t\t\t\t\t\t<\/h4>\n\t\t\t\t\t<\/a>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-author-box__bio\">\n\t\t\t\t\t\t<p>CEO of 2B Advice GmbH, driving innovation in privacy compliance and risk management and leading the development of Ailance, the next-generation compliance platform.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-83080ab elementor-widget elementor-widget-text-editor\" data-id=\"83080ab\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Artificial intelligence is quietly finding its way into software as an update, as part of regular version updates. For data protection and compliance experts, this means that something fundamental is happening without the established approval processes taking effect. SMEs and large corporations alike are therefore feeling uneasy: what new data flows and risks does this AI update entail? Do the original governance processes for releasing the software still apply? These questions mark a blind spot in many organizations, as AI often comes in through the back door. What companies should look out for with AI updates.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-49b2a6f elementor-widget elementor-widget-heading\" data-id=\"49b2a6f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Governance blindspot: AI update without approval <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b3ffb5e elementor-widget elementor-widget-text-editor\" data-id=\"b3ffb5e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The introduction of software usually involves extensive checks: Data protection impact assessments, IT security audits, approvals by committees. But what happens when software that has been in use for years suddenly receives new AI functions via an update? The original checks do not cover these subsequent changes. The original purpose and data flows can change without anyone realizing that the original release no longer matches the current range of functions. This creates a governance blindspot: the system is running productively and is considered \u201eapproved\u201c internally, while the new AI components are completely out of sight of those responsible.<\/p><p>This blind spot is dangerous. An AI function that was never originally approved suddenly changes the nature of the application. Risk profiles shift, but because there is no new project, there is no impetus for a new review. This means that changes in purpose can go unnoticed and with them potential violations of <a href=\"https:\/\/2b-advice.com\/en\/marcus-belke\/\">Data protection<\/a> or compliance that have never been consciously weighed up. Without transparency and updated documentation, AI literally remains invisible in running systems.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f9f2ec0 elementor-widget elementor-widget-heading\" data-id=\"f9f2ec0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What the new AI features will actually change<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9ce5f65 elementor-widget elementor-widget-text-editor\" data-id=\"9ce5f65\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>New AI features in existing tools - that often sounds harmless. It could be an assistance mode, automatic analyses or smart recommendations. However, they actually bring about very specific changes:<\/p><ul><li><strong>Automated analyses instead of manual processes:<\/strong> Suddenly, the software interprets data independently. A CRM system could, for example, automatically analyze customer sentiment or make \u201esmart\u201c predictions where previously only data was recorded. Decisions are thus partially automated, with all the advantages and disadvantages.<br \/><br \/><\/li><li><strong>New data flows into the cloud:<\/strong> AI functions often only work with the help of external computing power or models. As a result, data that previously remained internal now migrates to the provider's servers or the cloud for processing. A current example is Microsoft's Outlook app, which sends all emails to central Microsoft servers for AI analysis after an update. Sensitive content leaves the user's control unnoticed to be \u201eenchanted\u201c by the AI. In many systems, such cloud uploads happen in the background without users or admins noticing immediately. The black box effects are pre-programmed.<br \/><br \/><\/li><li><strong>Changed purpose of data processing:<\/strong> New AI functions often use existing data for a different purpose than originally intended. For example, a tool that was primarily used to store documents could now also use AI to carry out content analyses or sentiment evaluations. This changes the purpose of the data processing, which is highly relevant in terms of data protection law (keyword: change of purpose).<br \/><br \/><\/li><li><strong>Lack of transparency for users:<\/strong> These features are often active by default or are at least offered prominently without clearly communicating where data flows to or how the AI works. Users see the added value (\u201efinally summaries of long emails\u201c), but have little insight into what happens to their data in the background. Complex opt-out settings overwhelm many users and the default settings encourage maximum data sharing.<\/li><\/ul><p><br \/>New AI functions are changing the rules of the game. Local applications are becoming distributed, cloud-based systems. Data that previously remained in-house is suddenly leaving the secure castle. And static tools are becoming learning systems that harbor completely different risks than the original software.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-64418c0 elementor-widget elementor-widget-heading\" data-id=\"64418c0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Why traditional governance processes fail with AI updates<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0f36b3e elementor-widget elementor-widget-text-editor\" data-id=\"0f36b3e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>In companies, traditional governance and compliance processes are usually project-oriented: they come into play when new software is procured or a major upgrade is set up as a project. However, an update is not formally a new project. It is either provided by the manufacturer as an auto-update or installed as a routine patch by the IT department. No concept is written for version 3.5.1 and no steering committee meets for a new menu button.<\/p><p>As a result, AI changes via updates often fall through the cracks. The procurement department is not involved, as nothing new is purchased, and IT governance, such as change advisory boards, treats them as a technical patch with no strategic significance. Data protection and compliance often only find out about it when something goes wrong. The existing approval processes are blind to incremental changes.<\/p><p>Another aspect is that even if the IT department reads the update notes, technicians do not always recognize the compliance implications. A changelog announcing \u201eAI-powered insights\u201d may trigger technical delight in IT. But who translates this into data protection risks? There is often no clear assignment of who should sound the alarm when new functions are introduced. This creates a gap between technical maintenance and organizational governance.<\/p><p>In addition, software providers are increasingly relying on SaaS models where updates are continuously installed. Companies often receive new features automatically, whether they want them or not. If governance processes are not agile enough, they lag behind the changes. Outdated review cycles such as an annual review do not capture this dynamic. For example, the World Economic Forum recently showed that the greatest operational risks of AI do not arise when it is first implemented, but at a later point in time. When systems change or interact with others. Rigid governance cycles can hardly capture these shifts.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4083985 elementor-widget elementor-widget-heading\" data-id=\"4083985\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Data protection and AI governance risks<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4050441 elementor-widget elementor-widget-text-editor\" data-id=\"4050441\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Unnoticed AI updates harbor tangible risks in terms of data protection and compliance:<\/p><ul><li><strong>Change of purpose and lack of legal basis:<\/strong> If personal data is suddenly used for a new AI purpose, the question of the legal basis arises. The original consent or contractual agreement may not cover the new use. For example, the service was purchased for X, but is now also doing Y with the data. This could be a change of purpose that requires examination in accordance with Art. 6 para. 4 GDPR. Without new legitimation, processing is on thin ice.<br \/><br \/><\/li><li><strong>Automated decisions:<\/strong> New AI functions can penetrate areas that fall under Art. 22 GDPR (Automated Decisions). For example, an update could introduce automated scoring that influences certain user decisions (such as automatic applicant pre-selection in HR software). However, such automated influences require special care, transparency and, if necessary, options to object. All of this may not have been an issue when it was originally introduced, but it certainly is now.<br \/><br \/><\/li><li><strong>Data outflow and cloud processing:<\/strong> AI features harbor the risk of unwanted data export. Personal data can flow to third countries (e.g. cloud in the USA), which makes additional requirements under the GDPR (e.g. transfer impact assessments, standard contractual clauses) necessary. If nobody knows about this, such requirements are of course not met. Confidential data (trade secrets, confidential customer data) could end up on foreign servers - a nightmare for data protection officers.<br \/><br \/><\/li><li><strong>Bias and misanalysis:<\/strong> AI functions harbor new content-related risks, such as bias or incorrect results. What if the automated analysis shows discriminatory tendencies or makes gross errors? Initially, the software may have been \u201ejust a tool\u201c, but now it makes preliminary decisions. The consequence: the company is responsible for this. Without a reassessment of the risks, you run the risk of unknowingly violating equal treatment principles or due diligence obligations.<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5530c2a elementor-widget elementor-widget-heading\" data-id=\"5530c2a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">AI regulation and the consequences<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6c52c6f elementor-widget elementor-widget-text-editor\" data-id=\"6c52c6f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The AI Regulation (EU AI Act) brings new obligations into play. It classifies AI systems according to risk and requires strict measures such as risk management, documentation or human supervision for high-risk AI. Whether a system is classified as \u201ehigh-risk\u201c depends on its intended use.<\/p><p>An existing tool could suddenly slip into a higher risk class as a result of an AI update. An example of this would be a personnel management tool that pre-sorts CVs using AI after an AI update. This would fall under the category of \u201euse of AI in personnel decisions\u201c. This would actually require compliance measures under the AI Regulation, but no one has noticed this yet.<\/p><p>The AI regulation also provides for severe penalties in the event of violations: up to 35 million euros or seven percent of global turnover.<strong>s<\/strong> for violations. These figures illustrate how critical untested AI features can become.<\/p><p>Reading tip: <a href=\"https:\/\/2b-advice.com\/en\/ailance-ki-governance-ai-act-compliance\/\" target=\"_blank\" rel=\"noopener\">Getting to grips with AI regulation with Ailance AI Governance\u00a0<\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-646ba8b elementor-widget elementor-widget-heading\" data-id=\"646ba8b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Shadow AI: unclear responsibility during operation<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4b16f68 elementor-widget elementor-widget-text-editor\" data-id=\"4b16f68\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Why do such AI updates go unnoticed at all? A key problem is the lack of clear responsibility during ongoing operations. Once software has been introduced and released, no one often feels explicitly responsible for fundamental reassessments.<\/p><p>Although there is typically an application owner or process owner for the system, their focus is often on functionality and benefits in the specialist area and less on compliance. The IT department keeps the system running technically and maintains updates, but does not see itself as a data protection officer. Data protection officers and compliance teams, on the other hand, usually focus on new projects and major changes as their resources are limited. So it's no wonder that no one has a seemingly small feature update on their radar.<\/p><p>The result is a kind of vacuum of responsibility: an AI assistant goes live, but who should have assessed it? The specialist department? The IT department? Data protection? Everyone unconsciously thought that someone else was already keeping an eye on it. No one is formally tasked with checking changes for risks after implementation. There is no chain of responsibility for operations. While clear responsibilities are appointed for new purchases, there is often no similarly clear regulation on who has to raise the alarm for feature X in version Y.<\/p><p>This is exactly what supervisory authorities such as BaFin have long been demanding for the financial sector: responsibilities must be clearly assigned and AI risks must be managed on an ongoing basis. However, many companies have not yet established internal roles such as an \u201eAI officer per system\u201c. Without such a governance owner, AI quickly remains ownerless in operations and risks remain unmanaged.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cbbc9fc elementor-widget elementor-widget-heading\" data-id=\"cbbc9fc\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Necessary change of perspective: governance must include AI updates<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a5d1ba4 elementor-widget elementor-widget-text-editor\" data-id=\"a5d1ba4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>In view of these developments, companies need a change of perspective with regard to their governance. It is no longer enough to apply governance only to major projects or acquisitions. The focus must also be on the ongoing use and further development of tools that have already been introduced.<\/p><p>What does that mean in concrete terms? \u201eGovernance by design\u201c must not end on the day production starts. Rather, there must be mechanisms that continuously or at least regularly check whether a system is still running in the green zone. Updates - regardless of whether they are small patches or major version jumps - should trigger a defined process. For example, a quick check should be carried out to determine whether new functions are relevant to data protection or security. If so, they must be incorporated into the existing compliance processes (e.g. addendum to the DPIA, update of documentation, etc.).<\/p><p>Companies must proactively manage their tool landscape. This includes keeping an eye on the software providers' roadmaps: Are AI features planned on the product roadmap? Are there any beta programs that should be evaluated? This makes it possible to assess at an early stage which changes are imminent. Ideally, governance teams should remain in dialog with the manufacturers and obtain information about planned AI functions at an early stage.<\/p><p>Awareness is also required internally: specialist departments and IT must be sensitized to not simply dismiss AI changes as nice extra functions. Instead, it should be clear: Every major new function is an opportunity to pause for a moment and ask: \u201eAre there any new risks or obligations here?\u201c<\/p><p>Dieser Wandel hin zu einer dynamischen, kontinuierlichen Governance erfordert sicher neue Prozesse oder Tools. Er ist jedoch notwendig, um mit der rasanten Technologie-Entwicklung Schritt zu halten. Agile Methoden gibt es nicht nur in der Softwareentwicklung, sondern wir brauchen sie auch in der <a href=\"https:\/\/2b-advice.com\/en\/2026\/11\/11\/ailance-modellkarten-ki-governance\/\">AI governance<\/a>: weg von punktuellen Audits, hin zu laufender \u00dcberwachung und Anpassung. Nur so lassen sich die gr\u00f6\u00dften Risiken abfangen.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-880c87c elementor-widget elementor-widget-heading\" data-id=\"880c87c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Specific recommendations for AI updates<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b95c2f2 elementor-widget elementor-widget-text-editor\" data-id=\"b95c2f2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>How can the risks described above be managed in practice? We conclude with some specific recommendations that every company - whether medium-sized or large - should implement:<\/p><ul><li><strong>Define responsibilities per system:<\/strong> Appoint an owner for each important IT system who is not only responsible for the technology, but also explicitly for governance aspects. This person or committee is responsible for keeping an eye on changes, initiating risk assessments and acting as a link between business, IT and compliance. Clear roles prevent a vacuum of responsibility.<br \/><br \/><\/li><li><strong>Introduce a process for monitoring updates:<\/strong> Establish a process that regularly checks for updates, e.g. a quarterly check of the release notes of important software or a subscription to manufacturer news. It is crucial that you briefly evaluate each upcoming update according to \u201erelevant for data protection\/governance - yes\/no?\u201c. Suspicious keywords such as AI, AI, machine learning, cloud service, analytics, etc. should automatically trigger a notification to the governance team.<br \/><br \/><\/li><li><strong>Define criteria for reassessment:<\/strong> Legen Sie unternehmensweit fest, wann ein Update eine Neubewertung erfordert. Etwa: \u201eVerarbeitet das Update neu personenbezogene Daten? Gibt es Daten\u00fcbertragungen an neue Empf\u00e4nger? Entsteht ein neuer Zweck der Verarbeitung? Werden automatisierte Entscheidungen eingef\u00fchrt?\u201c Sobald eines dieser Kriterien erf\u00fcllt ist, muss der Datenschutzbeauftragte informiert und gegebenenfalls eine <a href=\"https:\/\/2b-advice.com\/en\/2026\/11\/12\/dsfa-ailance-ropa-assessment\/\">Data protection impact assessment<\/a> be updated. This list of criteria should be known and easy to apply.<br \/><br \/><\/li><li><strong>Feed new functions into the data protection, security and governance processes:<\/strong> Make sure that no feature goes live without first undergoing a compliance check. In practice, this could mean, for example, that IT notifies the data protection department of new feature toggles or modules before they are activated. Or the specialist department may only use a new AI function once the compliance teams have given their OK. This can be implemented in processes or technically (e.g. by deactivating default settings). It is important that data protection and security are automatically at the table when new features are introduced.<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1211bc4 elementor-widget elementor-widget-heading\" data-id=\"1211bc4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Automate the AI update process with Ailance AI Governance <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-96430a7 elementor-widget elementor-widget-text-editor\" data-id=\"96430a7\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Consider using a governance platform such as \u201eAilance AI Governance\u201c to effectively manage all of the above measures. Such tools offer, for example, model maps, automated workflows for risk assessments and approvals as well as integration into existing data protection processes.<\/p><p>Reading tip: <a href=\"https:\/\/2b-advice.com\/en\/2025\/09\/16\/model-cards-thats-why-model-cards-are-so-important-for-ki-documentation\/\">Why model maps are so important for documentation<\/a><br \/><br \/>Ailance AI Governance makes it possible to register any AI processing, assign responsible parties and automatically trigger data protection checks as soon as personal data is involved. Workflows enforce that no approval is given without complete information, and reminders ensure that regular re-audits take place. Such a platform can create transparency and eliminate the blind spot by making updates, risks and evidence centrally visible and controllable.<\/p><p>Ensure that AI is useful without losing control. Because in the end, AI should create value in the company and not represent an uncontrolled risk.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-440eea2 e-con-full e-flex e-con e-child\" data-id=\"440eea2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-934d46e elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"934d46e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1cafd39 elementor-widget elementor-widget-text-editor\" data-id=\"1cafd39\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><i>Marcus Belke is CEO of 2B Advice as well as a lawyer and IT expert for data protection and digital compliance. He regularly writes about AI governance, GDPR compliance and risk management. You can find out more about him on his <\/i><a id=\"menur29hm\" class=\"fui-Link ___1q1shib f2hkw1w f3rmtva f1ewtqcl fyind8e f1k6fduh f1w7gpdv fk6fouc fjoy568 figsok6 f1s184ao f1mk8lai fnbmjn9 f1o700av f13mvf36 f1cmlufx f9n3di6 f1ids18y f1tx3yz7 f1deo86v f1eh06m1 f1iescvh fhgqx19 f1olyrje f1p93eir f1nev41a f1h8hb77 f1lqvz6u f10aw75t fsle3fq f17ae5zn\" title=\"https:\/\/2b-advice.com\/en\/marcus-belke\/\" href=\"https:\/\/2b-advice.com\/en\/marcus-belke\/\" rel=\"noreferrer noopener\" aria-label=\"Link author profile page\"><i><strong>Author profile page<\/strong><\/i><\/a><i>.<\/i><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>Artificial intelligence is quietly finding its way into software as an update, as part of regular version updates. For the governance of the company, this means that something fundamental is happening without the established release processes taking effect. What companies should pay attention to now.<\/p>","protected":false},"author":2,"featured_media":43235,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[440,468],"tags":[63,473,137,294,429,278],"class_list":["post-43212","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-marcus-belke","category-ki-regulierung","tag-ai-act","tag-ai-governance","tag-ki-verordnung-ki-vo","tag-ki-compliance","tag-ki-governance","tag-ki-vo"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>KI-Update: Neue KI-Funktionen in bestehender Software als Governance-Risiko - Ailance<\/title>\n<meta name=\"description\" content=\"KI-Update mit Folgen: Warum neue KI-Funktionen in bestehender Software ein hohes Governance-Risiko darstellen.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/2b-advice.com\/en\/2026\/01\/20\/ki-update-new-ki-functions-in-existing-software-as-a-governance-risk\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"KI-Update: Neue KI-Funktionen in bestehender Software als Governance-Risiko - Ailance\" \/>\n<meta property=\"og:description\" content=\"KI-Update mit Folgen: Warum neue KI-Funktionen in bestehender Software ein hohes Governance-Risiko darstellen.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/2b-advice.com\/en\/2026\/01\/20\/ki-update-new-ki-functions-in-existing-software-as-a-governance-risk\/\" \/>\n<meta property=\"og:site_name\" content=\"Ailance\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-20T06:30:31+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-04-14T12:41:58+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/2b-advice.com\/wp-content\/uploads\/2026\/01\/KI_Update_Governance.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1536\" \/>\n\t<meta property=\"og:image:height\" content=\"1024\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Aristotelis\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Aristotelis\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/2026\\\/01\\\/20\\\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/2026\\\/01\\\/20\\\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\\\/\"},\"author\":{\"name\":\"Aristotelis\",\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/#\\\/schema\\\/person\\\/dec1524f23a48487067598ae938bc8eb\"},\"headline\":\"KI-Update: Neue KI-Funktionen in bestehender Software als Governance-Risiko\",\"datePublished\":\"2026-01-20T06:30:31+00:00\",\"dateModified\":\"2026-04-14T12:41:58+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/2026\\\/01\\\/20\\\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\\\/\"},\"wordCount\":2410,\"publisher\":{\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/2026\\\/01\\\/20\\\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/2b-advice.com\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/KI_Update_Governance.jpg\",\"keywords\":[\"AI Act\",\"AI Governance\",\"KI Verordnung\",\"KI-Compliance\",\"KI-Governance\",\"KI-VO\"],\"articleSection\":[\"Artikel von Marcus Belke\",\"KI-Regulierung\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/2026\\\/01\\\/20\\\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\\\/\",\"url\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/2026\\\/01\\\/20\\\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\\\/\",\"name\":\"KI-Update: Neue KI-Funktionen in bestehender Software als Governance-Risiko - Ailance\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/2026\\\/01\\\/20\\\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/2026\\\/01\\\/20\\\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/2b-advice.com\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/KI_Update_Governance.jpg\",\"datePublished\":\"2026-01-20T06:30:31+00:00\",\"dateModified\":\"2026-04-14T12:41:58+00:00\",\"description\":\"KI-Update mit Folgen: Warum neue KI-Funktionen in bestehender Software ein hohes Governance-Risiko darstellen.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/2026\\\/01\\\/20\\\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/2b-advice.com\\\/en\\\/2026\\\/01\\\/20\\\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/2026\\\/01\\\/20\\\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\\\/#primaryimage\",\"url\":\"https:\\\/\\\/2b-advice.com\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/KI_Update_Governance.jpg\",\"contentUrl\":\"https:\\\/\\\/2b-advice.com\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/KI_Update_Governance.jpg\",\"width\":1536,\"height\":1024,\"caption\":\"KI-Update mit Folgen: Warum neue KI-Funktionen in bestehender Software ein hohes Governance-Risiko darstellen.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/2026\\\/01\\\/20\\\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/2b-advice.com\\\/de\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"KI-Update: Neue KI-Funktionen in bestehender Software als Governance-Risiko\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/\",\"name\":\"2B Advice\",\"description\":\"By 2B Advice\",\"publisher\":{\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/#organization\",\"name\":\"2B Advice GmbH\",\"url\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/2b-advice.com\\\/wp-content\\\/uploads\\\/2024\\\/02\\\/Ailance_Logo_Yellow_White_large_RGB.png\",\"contentUrl\":\"https:\\\/\\\/2b-advice.com\\\/wp-content\\\/uploads\\\/2024\\\/02\\\/Ailance_Logo_Yellow_White_large_RGB.png\",\"width\":287,\"height\":401,\"caption\":\"2B Advice GmbH\"},\"image\":{\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/2b-advice-group\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/2b-advice.com\\\/en\\\/#\\\/schema\\\/person\\\/dec1524f23a48487067598ae938bc8eb\",\"name\":\"Aristotelis\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"AI update: New AI functions in existing software as a governance risk - Ailance","description":"AI update with consequences: Why new AI features in existing software pose a high governance risk.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/2b-advice.com\/en\/2026\/01\/20\/ki-update-new-ki-functions-in-existing-software-as-a-governance-risk\/","og_locale":"en_US","og_type":"article","og_title":"KI-Update: Neue KI-Funktionen in bestehender Software als Governance-Risiko - Ailance","og_description":"KI-Update mit Folgen: Warum neue KI-Funktionen in bestehender Software ein hohes Governance-Risiko darstellen.","og_url":"https:\/\/2b-advice.com\/en\/2026\/01\/20\/ki-update-new-ki-functions-in-existing-software-as-a-governance-risk\/","og_site_name":"Ailance","article_published_time":"2026-01-20T06:30:31+00:00","article_modified_time":"2026-04-14T12:41:58+00:00","og_image":[{"width":1536,"height":1024,"url":"https:\/\/2b-advice.com\/wp-content\/uploads\/2026\/01\/KI_Update_Governance.jpg","type":"image\/jpeg"}],"author":"Aristotelis","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Aristotelis","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/2b-advice.com\/en\/2026\/01\/20\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\/#article","isPartOf":{"@id":"https:\/\/2b-advice.com\/en\/2026\/01\/20\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\/"},"author":{"name":"Aristotelis","@id":"https:\/\/2b-advice.com\/en\/#\/schema\/person\/dec1524f23a48487067598ae938bc8eb"},"headline":"KI-Update: Neue KI-Funktionen in bestehender Software als Governance-Risiko","datePublished":"2026-01-20T06:30:31+00:00","dateModified":"2026-04-14T12:41:58+00:00","mainEntityOfPage":{"@id":"https:\/\/2b-advice.com\/en\/2026\/01\/20\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\/"},"wordCount":2410,"publisher":{"@id":"https:\/\/2b-advice.com\/en\/#organization"},"image":{"@id":"https:\/\/2b-advice.com\/en\/2026\/01\/20\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\/#primaryimage"},"thumbnailUrl":"https:\/\/2b-advice.com\/wp-content\/uploads\/2026\/01\/KI_Update_Governance.jpg","keywords":["AI Act","AI Governance","KI Verordnung","KI-Compliance","KI-Governance","KI-VO"],"articleSection":["Artikel von Marcus Belke","KI-Regulierung"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/2b-advice.com\/en\/2026\/01\/20\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\/","url":"https:\/\/2b-advice.com\/en\/2026\/01\/20\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\/","name":"AI update: New AI functions in existing software as a governance risk - Ailance","isPartOf":{"@id":"https:\/\/2b-advice.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/2b-advice.com\/en\/2026\/01\/20\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\/#primaryimage"},"image":{"@id":"https:\/\/2b-advice.com\/en\/2026\/01\/20\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\/#primaryimage"},"thumbnailUrl":"https:\/\/2b-advice.com\/wp-content\/uploads\/2026\/01\/KI_Update_Governance.jpg","datePublished":"2026-01-20T06:30:31+00:00","dateModified":"2026-04-14T12:41:58+00:00","description":"AI update with consequences: Why new AI features in existing software pose a high governance risk.","breadcrumb":{"@id":"https:\/\/2b-advice.com\/en\/2026\/01\/20\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/2b-advice.com\/en\/2026\/01\/20\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/2b-advice.com\/en\/2026\/01\/20\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\/#primaryimage","url":"https:\/\/2b-advice.com\/wp-content\/uploads\/2026\/01\/KI_Update_Governance.jpg","contentUrl":"https:\/\/2b-advice.com\/wp-content\/uploads\/2026\/01\/KI_Update_Governance.jpg","width":1536,"height":1024,"caption":"KI-Update mit Folgen: Warum neue KI-Funktionen in bestehender Software ein hohes Governance-Risiko darstellen."},{"@type":"BreadcrumbList","@id":"https:\/\/2b-advice.com\/en\/2026\/01\/20\/ki-update-neue-ki-funktionen-in-bestehender-software-als-governance-risiko\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/2b-advice.com\/de\/"},{"@type":"ListItem","position":2,"name":"KI-Update: Neue KI-Funktionen in bestehender Software als Governance-Risiko"}]},{"@type":"WebSite","@id":"https:\/\/2b-advice.com\/en\/#website","url":"https:\/\/2b-advice.com\/en\/","name":"2B Advice","description":"By 2B Advice","publisher":{"@id":"https:\/\/2b-advice.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/2b-advice.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/2b-advice.com\/en\/#organization","name":"2B Advice GmbH","url":"https:\/\/2b-advice.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/2b-advice.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/2b-advice.com\/wp-content\/uploads\/2024\/02\/Ailance_Logo_Yellow_White_large_RGB.png","contentUrl":"https:\/\/2b-advice.com\/wp-content\/uploads\/2024\/02\/Ailance_Logo_Yellow_White_large_RGB.png","width":287,"height":401,"caption":"2B Advice GmbH"},"image":{"@id":"https:\/\/2b-advice.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/2b-advice-group\/"]},{"@type":"Person","@id":"https:\/\/2b-advice.com\/en\/#\/schema\/person\/dec1524f23a48487067598ae938bc8eb","name":"Aristotle"}]}},"permalink_manager":null,"_links":{"self":[{"href":"https:\/\/2b-advice.com\/en\/wp-json\/wp\/v2\/posts\/43212","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/2b-advice.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2b-advice.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2b-advice.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/2b-advice.com\/en\/wp-json\/wp\/v2\/comments?post=43212"}],"version-history":[{"count":22,"href":"https:\/\/2b-advice.com\/en\/wp-json\/wp\/v2\/posts\/43212\/revisions"}],"predecessor-version":[{"id":43234,"href":"https:\/\/2b-advice.com\/en\/wp-json\/wp\/v2\/posts\/43212\/revisions\/43234"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/2b-advice.com\/en\/wp-json\/wp\/v2\/media\/43235"}],"wp:attachment":[{"href":"https:\/\/2b-advice.com\/en\/wp-json\/wp\/v2\/media?parent=43212"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2b-advice.com\/en\/wp-json\/wp\/v2\/categories?post=43212"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2b-advice.com\/en\/wp-json\/wp\/v2\/tags?post=43212"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}