On Windows it's handled in Windows Update, and maybe there's a way to disable loading the new microcode. On Linux, it's explicitly provided to the kernel by whatever userspace you have. On Arch, for example, it's in a separate package called intel-ucode.

Some board firmware loads updated microcode when it's updated. It has to be loaded at each boot by software in order to change.