Windows 11 in 2026 has one change that makes enterprise IT administrators uneasy: the operating system is starting to "evolve silently" the way a cloud service does, and the parts that evolve arrive without release notes.
That is not alarmism. Copilot+ PC owners received two unusual updates this year: KB5124890, which replaces the Phi Silica model on Qualcomm platforms, and KB5124888, which updates the image processing model on AMD platforms. Both carry version 1.2607.840.0. Neither came with release notes. Neither asked for confirmation. Both installed silently, and neither can be uninstalled on its own.
What 26H2 actually brings
Set AI aside and Windows 11 26H2 ships several improvements users have asked for since launch:
| Feature | What it does | Why it matters |
|---|---|---|
| Taskbar position | The taskbar can move to the top of the screen or to either side | Multi-monitor and portrait setups gain the most. Anyone running an ultrawide or a vertical second screen no longer has to work around the layout |
| Natural language search | File Explorer accepts queries like "the quote Zhang sent me last week", processed locally on the NPU | Genuinely useful for document-heavy roles such as sales, admin and legal. It also needs an NPU, so older machines are excluded |
| NPU-native AI | Live captions, call noise reduction, image enhancement and Studio Effects all run on the NPU | Power draw falls sharply. Running these on the NPU instead of the GPU saves 65-80%, which shows up as longer battery life |
| Settings rebuild | More Control Panel items move into the modern Settings app | Simpler for end users, more painful for enterprise scripting and automation, because old paths and Control Panel items disappear |
The improvements themselves are fine. The problem is that they ship bundled with AI models, and the model layer is partly opaque.
The silent update: what ships, and who receives it
The details of KB5124890 and KB5124888:
- Eligibility. Copilot+ PCs only: an NPU rated at 40 TOPS or better, running Windows 11 26H1 or later. Ordinary PCs never receive these packages and cannot install them.
- Contents. The Qualcomm package updates Phi Silica, Microsoft's on-device language model for natural language search, text understanding and summarization. The AMD package updates the image processing model behind Studio Effects, image enhancement and super-resolution.
- Version. 1.2607.840.0. This is an AI component version, tracked separately from the Windows build number.
- Delivery. Pushed silently through Windows Update with no prompt. Nothing appears in the normal update history after installation; you have to open that component's page to see it.
- Rollback. No standalone uninstall. The only exits are a system restore point or rolling back the entire Windows Update.
Why this is a business problem. Three specific risks:
- Change management breaks. A formal IT process requires every system change to be documented, assessed and reversible. A model update with no release notes cannot be assessed for its effect on business software. Take an industry application that depends on OCR or image processing: swap the model and its recognition results may change.
- Behavior changes are unpredictable. A model update means AI output can shift. Search ranking, image enhancement and caption accuracy may all differ after a silent push. For a home user, that is a minor annoyance. For a business process built on those features, it is an incident.
- Audit and compliance get harder. Regulated sectors such as finance, healthcare and government have to show that system state is traceable. A model update with unclear contents and no visible timestamp is hard to explain to an auditor.
Five layers of control for enterprise IT
All of this can be managed, but it has to be configured in advance. Remediation afterwards is reactive.
1. Take over update approval with WSUS or SCCM
This is the foundation. Point every terminal's Windows Update at an internal WSUS server, or use MECM or Intune, so that every update, AI components included, waits for administrator approval before it goes out. The Group Policy path is Computer Configuration, Administrative Templates, Windows Components, Windows Update, Manage updates offered from Windows Update, Specify the location of the intranet Microsoft update service.
One detail matters: check every category under WSUS Products and Classifications. Older builds do not classify these AI component updates cleanly, so WSUS itself may need updating first.
2. Turn specific AI features off with Group Policy
If you do not need the AI features, and plenty of production environments do not, switch them off and remove the risk at the source:
| Policy path | Effect |
|---|---|
| Computer Configuration, Administrative Templates, Windows Components, Windows Copilot, Turn off Windows Copilot | Disables the Copilot sidebar |
| Computer Configuration, Administrative Templates, Windows AI, Turn off automatic AI model updates | Blocks silent model pushes (new in 26H2) |
| User Configuration, Administrative Templates, Start Menu and Taskbar, Turn off search highlights and natural language search | Disables the UI and the background indexing |
| Computer Configuration, Administrative Templates, Windows Components, Camera, Turn off Windows Studio Effects | Disables AI image processing on video calls |
Some of these policies only apply to Pro and Enterprise. Home cannot be controlled by Group Policy at all, which is why every business machine we supply is Pro. The price difference, roughly RMB 300-500 per seat, is not worth saving.
3. Roll out in rings instead of all at once
Split the fleet into three rings: IT's test machines (one or two), a pilot group of five to ten people in non-critical roles, then everyone. Leave two to four weeks between rings and watch whether business software behaves. Applications that lean on system-level OCR, speech or image processing, such as medical imaging, invoice recognition and CAD plug-ins, have to be tested for real.
4. Write an AI usage policy
Technical control needs a policy behind it. Spell out which data may never be typed into an AI feature: customer personal information, quoted costs, unpublished drawings. Ban Recall, which screenshots user activity, on confidential desks. Exclude sensitive folders from the natural language search index. None of this is a technical problem, but IT has to draft it and get it into the handbook.
5. Add NPU capacity to the asset register
From 2026 the terminal asset register needs another column: NPU performance. It decides whether a machine receives AI updates, whether it can use the AI features at all, and whether it needs replacing within three years. Machines without an NPU, which is most of what shipped before 2024, will not get these updates, but they will also lose new Windows support over time. That is a separate budget line.
If it is your own laptop
- On a Copilot+ PC (a 2024-or-later Snapdragon X, Core Ultra 200V or 300, or Ryzen AI 300 machine) the AI features are on by default. Keep what you use and turn off the rest under Settings, Privacy and security.
- Turn off what you do not need, especially Recall and search indexing. Both keep consuming disk and CPU, and both may record things you would rather they did not.
- Older machines without an NPU are unaffected: no updates arrive, and no AI gets installed behind your back.
ACCPC runs enterprise IT outsourcing and operations across Guangzhou: WSUS and domain controller deployment, update policy configuration, bulk Group Policy rollout, terminal asset registers, Windows upgrade assessment and ring-based rollout, and AI compliance design. Service runs monthly or annually, from RMB 1,500-3,000 per month for businesses under 20 people, which includes unlimited remote support and one on-site inspection a month. We also handle Windows 11 Pro volume licensing and brand-name hardware procurement. Call 020-39029800.