Drupal AI has stopped being a scatter of provider-specific contributed modules that whoever needed them bolted on separately. It is now one coordinated project with an abstraction layer underneath it, a security-team-covered release cycle, and a packaged product in Drupal CMS that offers to switch parts of it on during installation. The question worth asking has moved on from whether Drupal can do AI to which parts of it are worth turning on, and what each one costs once four editors use it every working day.

Most write-ups stop at the demo. Somebody types a prompt, a page appears, a chatbot creates a content type while you watch. The demo is real. What it does not tell you is what leaves your infrastructure when an editor clicks that button, which of the modules on the list have never shipped a stable release, and which budget line actually grows.

What does Drupal AI give a business? A provider abstraction in the AI module that routes chat, embeddings, translation and image calls to any configured vendor or to a model on your own hardware, plus submodules for alt text, translation, editorial assistance, semantic search and site-building agents. The narrow features are production ready and cost very little to run. Semantic search and agents are still alpha or immature and need real engineering built around them.

What Drupal AI Actually Is in 2026

The spine of it is a single contributed project. The AI (Artificial Intelligence) module reports 17,818 sites in use, works with Drupal 10.5 and above or 11.2 and above, and carries stable releases at 1.4.7 and 1.3.12 with a 1.5.0 release candidate published on 27 August 2026. Stable branches are covered by the Drupal Security Team, which matters more than the feature list when you are deciding whether to run something on a client site. A 2.0.x branch is in active development.

For context on the platform underneath it, the current recommended Drupal core release is 11.4.5, published on 6 August 2026, with 10.6.15 kept available for sites that have not upgraded yet. If you are still deciding whether Drupal is the right platform at all, our 2026 guide to Drupal web development covers that question separately.

The provider abstraction is the part that matters

The developer documentation states the design plainly: AI providers are services Drupal can call, and those calls have been abstracted into operation types. The named types include chat in basic and streaming forms, text to image, text to speech, speech to text, embeddings, moderation, audio to audio, speech to speech, image classification, translate text and image to image.

The consequence is commercial rather than technical. A module written against the chat operation works with whichever provider is configured, so changing vendor is a configuration change rather than a rewrite. Drupal’s own providers page lists 48 integrations, including OpenAI, Anthropic, Google Gemini and Vertex, AWS Bedrock, Azure, Mistral, Groq, Hugging Face, DeepL, Deepgram, ElevenLabs, LiteLLM, LM Studio, Ollama and amazee.ai.

That portability has a limit worth stating early. The interface is portable; the prompts are not. A prompt tuned against one model frequently produces worse output against another, so a provider switch is cheap in code and costs a round of prompt testing.

What ships in the box

The AI project bundles a core layer plus submodules for automators, an API explorer used for debugging, observability and logging, a chatbot, CKEditor integration, and an assistants and agents API. Several capabilities that started inside it have since moved out to their own contributed projects, which is why the ecosystem looks scattered when you first search for it. AI Search, AI Content Suggestions, AI Translate, AI Validations, AI ECA and Field Widget Actions now have separate release cycles and very different maturity levels.

How Drupal CMS Packages It

Drupal CMS is a separate product rather than a version of core, aimed at marketers and content teams rather than developers. Drupal CMS 2.0 shipped on 28 January 2026, built on Drupal core 11.3, and the release line has kept moving since: 2.1.4 was published on 1 September 2026.

The AI capability it packages is deliberately narrow. It generates complete pages from text prompts using the available Canvas components, runs an admin chatbot for site-building tasks such as creating content types, defining taxonomy terms and adding fields, generates alt text with human review in the loop, and provides a dashboard showing which features are on and which providers are configured. The setup flow offers amazee.ai, OpenAI and Anthropic.

The word in the release announcement that should shape your risk assessment is “optional”. Nothing in a Drupal CMS install calls a model until somebody configures a provider and supplies credentials, so a fresh install is not by itself a data protection question. It becomes one the moment an administrator pastes an API key into the provider form, which is usually done by whoever is fastest rather than whoever is accountable.

The Applications That Earn Their Keep

Alt text and media metadata

The AI Image Alt Text module reports 10,467 sites and released 1.0.2 on 5 December 2025 for Drupal 10.2 and 11. It puts a Generate button on every image field widget, supports multilingual content and custom prompts, and ships a bulk submodule for regenerating alt text across images already on the site.

This is the clearest win in the whole set, because it targets work that never gets done otherwise. A library of six thousand images represents weeks of manual writing that no organisation funds, so the alt attributes stay empty and the accessibility audit keeps failing on the same line every year. Generation plus review turns that into a few days, provided the review actually happens.

Translation across a multilingual site

AI Translate reached stable 1.4.0 on 27 August 2026, reports 886 sites and works with Drupal 10.4 and above or 11. It adds one-click translation to Drupal’s own content translation system, working from the Translate tab, handling multiple field types and referenced entities.

The important design point is that it fills Drupal’s existing translation workflow rather than replacing it. Revisions, moderation states and permissions stay exactly where they were, and a human can edit the result through the normal interface. That is the difference between a translation feature you can put in front of a regulated client and a bolt-on that bypasses your editorial controls.

Editorial assistance and taxonomy

The AI project ships CKEditor integration, and the AI Content Suggestions module moved out to contrib to cover summarisation, readability scoring, moderation, tone adjustment, title generation and taxonomy tag suggestion inside the authoring experience. This is the busiest and least settled corner of the ecosystem, and the modules here change shape between releases more than the rest.

Before planning around any of them, read the reported install count on the project page. Alt text sits above ten thousand sites; several of the editorial modules sit in the hundreds. That is not a judgement on the code, it is a measure of how much production shaking-out it has had, and it should decide how much testing time you budget.

Semantic Search Is the Feature Most Likely to Disappoint

AI Search is the module people ask for by name and the one least ready to be switched on. As of 2 September 2026 it has no supported stable release: the 1.x branch sits at 1.3.0-alpha4 from 12 July 2026 and the 2.x branch at 2.0.0-alpha2 from 24 June 2026, with 703 reported installs.

It also brings infrastructure with it. It runs as a backend for the Search API module and requires a vector database, with support for Milvus, Pinecone, Qdrant, PostgreSQL, MariaDB, OpenSearch, Azure and SQLite. The honest description is alpha software plus a datastore your team now operates, monitors and backs up. That is a project, not a checkbox.

The deeper problem is upstream of the module. Semantic retrieval is only as good as the chunks you feed it, and a content set written as long pages covering six loosely related topics embeds into vectors that mean nothing in particular. Sites that get good results from vector search almost always restructured their content first, and that restructuring is the actual work.

Agent-Style Site Building

The AI Agents module is a framework for text-to-action agents, at stable 1.3.4 since 13 August 2026, with 9,677 reported installs and support for Drupal 10.3 and 11 or higher. It ships three agents out of the box, covering fields, content types and taxonomy, and integrates with the chatbot and the AI Assistants API.

Used well, this is genuinely useful for the tedious middle of a build. Creating thirty fields across six content types by hand is an afternoon of clicking that produces no design value, and an agent does it in minutes from a description. What it does not do is decide what those content types should be, which is the part that determines whether the site still works in two years.

One operational rule separates a time saver from an incident. Run configuration agents against a development environment with configuration export enabled, never against production, so every change arrives as a reviewable diff in version control. Our guide to AI agents in business, their costs and failure modes covers why unreviewed agent actions are the most expensive category of AI failure.

Hosted API or a Model You Run Yourself

The abstraction gives you three shapes, and the choice moves cost, latency and data handling in different directions.

A hosted vendor API is the default. It is cheapest to start, needs no infrastructure and gives access to the strongest models. It also means content leaves your network on every call, and your running cost is a variable bill you do not control.

A private or managed endpoint from a provider that contracts on data residency sits in the middle. You still pay per token, but you can point at a region and get contractual terms about processing. It is what most UK and EU clients end up choosing.

A model on your own hardware, served through Ollama or LM Studio and configured as a provider, is the only version where content never leaves your infrastructure. The cost shape inverts: instead of a per-token bill with no floor, you pay a fixed monthly cost for the machine whether you make ten calls or ten million.

Latency matters less than people expect for editorial work, because an editor waiting a few seconds for generated alt text does not care where the model runs. It matters when a model sits in the request path of a public search or chatbot, which is exactly the case where self-hosting is hardest to size.

Quality is the honest trade. Open-weight models have closed most of the gap on constrained tasks such as alt text and translation, where the instruction is simple and the output is short. They remain behind on long-context summarisation and on the multi-step instruction following that agentic configuration changes require.

What Drupal AI Costs to Run

Token pricing is published per million tokens and quoted in US dollars. OpenAI’s pricing page currently lists gpt-5.6-luna at $0.20 input and $1.20 output, gpt-5.6-terra at $2.00 and $12.00, and gpt-5.6-sol at $4.00 and $20.00 on short context. Cached input is roughly ten times cheaper than fresh input on each tier, which matters a great deal for retrieval workloads that resend the same context.

A worked estimate for editorial features

These are estimates, and they are built from assumptions you should replace with your own measurements. Take a 900-word page. Source text plus a system prompt lands near 1,500 input tokens, and a translation of it near 1,600 output tokens, because most target languages expand.

On the mid tier, that is about $0.003 of input and $0.019 of output, so roughly $0.022 per page per language. Translating a back catalogue of 500 pages into eight languages is 4,000 calls and about $88, once. Keeping up with 40 new pages a month across the same eight languages is about $7 a month.

That number usually surprises people in the wrong direction. They have budgeted for a large AI bill and the editorial features cost less than the coffee. Alt text and taxonomy suggestion are smaller still, because the outputs are a few dozen tokens each.

The number that does bite

Retrieval is different, because every query resends the retrieved passages to the model as input. Ten passages of 500 tokens is 5,000 input tokens plus a question, with maybe 300 tokens of answer.

On the cheapest tier that is about $0.0014 per query, so 50,000 queries a month costs about $70. On the mid tier the same traffic costs about $680. Model choice moves that bill by a factor of ten, and prompt caching moves it again.

This is also the one feature whose cost tracks visitor traffic rather than editorial volume. Everything else scales with how much your team publishes, which is predictable. A public AI search or chatbot scales with how many people visit, which is not, and it is the feature that produces the alarming invoice.

What the estimates leave out

Vector database hosting is a separate line, whether that is a managed service or a server your team runs. Embedding the corpus once is cheap; re-embedding on every content save is not, and nobody models it. Failed and retried calls are billed. And the review step is labour rather than tokens, which is why it is almost always the largest number on the page.

Data Protection Is Where UK and EU Projects Stall

When an editor clicks Generate, the field content and your prompt go to the configured provider. Under a hosted API that is a transfer of data to a third party, and it happens on every call, silently, from an interface that looks like the rest of the CMS.

The specific risk in a content management system is that people underestimate what it holds. Articles are the safe part. Comments, user profiles, webform submissions, editorial notes and unpublished drafts about named individuals are all personal data sitting in the same database, and an automator configured a little too broadly will happily send them.

Controller and processor

You do not transfer responsibility by using a vendor. The ICO’s guidance on accountability and governance in AI is explicit that overall accountability for data protection compliance lies with the controller, meaning your organisation, and that identifying controller and processor relationships is part of the exercise rather than a formality.

The same guidance sets a clear expectation on impact assessments. It states that in the vast majority of cases, the use of AI will involve processing likely to result in a high risk to individuals’ rights and freedoms and will therefore trigger the legal requirement to undertake a DPIA. Where you assess that a particular use is not high risk, you still have to document how you reached that conclusion. Note that the guidance is currently under review following the Data (Use and Access) Act, so recheck it before relying on the detail.

The EU AI Act transparency obligations

If you serve EU users, Article 50 of Regulation (EU) 2024/1689 applies. Article 113 sets the general application date as 2 August 2026, which has passed, so these are live obligations rather than future ones.

Three parts touch a CMS directly. Article 50(1) requires that systems intended to interact directly with people are built so those people are informed they are dealing with an AI system, unless it is obvious. That is your site chatbot. Article 50(2) puts a marking obligation on providers of systems generating synthetic content, with an exemption where the system performs an assistive function for standard editing or does not substantially alter the input.

Article 50(4) is the one that changes how you staff a project. Deployers who generate or manipulate text published to inform the public on matters of public interest must disclose that it was artificially generated, and the obligation does not apply where the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility for it. The review step you were tempted to cut is the same step that discharges the disclosure duty.

Where It Fails

Metadata nobody reads

Alt text generated in bulk and published unread is the most common failure, because the feature makes it so easy. A vision model describes what is in the frame, not what the image is doing on the page, so a product photograph becomes “a person holding a bottle” rather than the product name. For a screen reader user that is worse than an empty attribute, because the page now looks remediated and nobody will revisit it.

The same applies to generated summaries and meta descriptions. They read fluently, which is precisely why reviewers skim them, and a fluent wrong summary survives review far longer than an awkward right one.

Search that is worse than the search it replaced

Two failure modes stack. The first is structural: badly chunked content produces retrieval that returns approximately relevant passages instead of the right one. The second is a regression nobody anticipates, which is the loss of exact matching. A user typing a part number, an invoice reference or a surname wants that exact string, and pure vector search returns documents that are semantically about part numbers.

The fix is hybrid retrieval, running keyword and vector search together and merging the results. That is standard practice, and with AI Search sitting at alpha it is usually something you build rather than configure.

Translation that drifts from the source

Machine translation of a page is fine. Machine translation of a page that later changes in English, with the translations left untouched, is a site that quietly contradicts itself in seven languages. Nothing in the module tracks source staleness for you, so somebody has to own re-translation as a process.

Numbers deserve their own check. A translated page that renders a price in the wrong currency symbol, or converts a figure the English never converted, creates a commercial dispute rather than a typo.

The review step nobody budgeted

Every feature here moves work rather than removing it. Generation takes seconds and review takes minutes, so at 500 pages the review is the project. Teams that budget only for implementation discover this in week three and quietly stop using the feature, which is how AI pilots die.

What You Still Have to Build

Governance comes first, because the modules give you capability without policy. You need to decide which roles can use which feature, on which content types and fields, against which provider, and then enforce it in configuration rather than in a wiki page.

Prompts belong in version-controlled configuration, reviewed and deployed like any other change. Prompts typed into a production form by whoever was on shift are untested code with direct cost implications.

Spend control is not included. The observability submodule logs calls, which tells you what happened after it happened. A misconfigured automator looping over a large content set needs a hard cap at the provider, plus an alert.

You also need fallbacks. A provider outage should degrade the authoring experience gracefully, not prevent an editor saving a node. This is ordinary integration engineering, and it is the part that separates a demo from a deployment. If you are also weighing up front-end architecture at the same time, our comparison of headless and traditional CMS approaches is the companion decision.

What an Implementation Costs

Rates first, since everything else derives from them. UK Drupal contract rates run roughly £400 to £550 a day for mid-level and £550 to £750 for senior work, as set out in our guide to hiring a Drupal developer.

A narrow deployment, meaning the AI module, one configured provider, alt text and translation, role-level governance and support for your DPIA, typically lands at £4,000 to £9,000. A full editorial suite adding taxonomy suggestion, CKEditor assistance, prompts held in code and spend monitoring runs £10,000 to £25,000.

Semantic search or a public chatbot over a substantial content set is a different order of work. Hybrid retrieval, a chunking strategy, vector infrastructure and an evaluation harness that tells you whether the new search beats the old one puts that at £25,000 to £60,000. Token spend sits on top of all three and is usually the smallest line in the first year.

Two costs sit outside the development budget. The DPIA and the provider contract review are legal and data protection work, and editorial review capacity is a staffing decision rather than a project line. Scoping both is part of our AI integration services engagement, because a project that ships without them ships a liability.

Getting It Deployed

Mecanik builds these integrations on Drupal as part of our software development work, and the pattern is consistent across clients. The modules install in an afternoon. What takes the time is deciding which features justify their review burden, keeping content out of a third party’s logs where it should not go, and building the governance and monitoring the contributed modules deliberately leave to you. If you want that scoped against your own content set and your own regulatory position, our AI integration services page is the place to start.

Frequently Asked Questions

What does the Drupal AI module actually do? It provides an abstraction layer that turns AI calls into operation types such as chat, embeddings, text to image and translate text, then routes them to whichever provider you configure. Submodules build on that layer to deliver specific features including alt text generation, content translation, taxonomy suggestion, semantic search and site-building agents. The base module does nothing visible on its own until you install a provider, supply credentials and enable the submodules you want.

Is Drupal AI free to use? The modules are free and open source under the same licence as Drupal core, but the model calls are not. Every generation, embedding and retrieval sends tokens to whichever provider you configured, and that provider bills you per million tokens in its own currency. Running a model on your own hardware removes the per-token bill and replaces it with a fixed monthly cost for the machine that serves it, which is cheaper only above a certain volume.

Does Drupal AI send my content to a third party? Under a hosted provider, yes. The field content and your prompt leave your infrastructure on every call, and a content management system holds personal data in comments, user profiles and webform submissions as well as in articles. You remain the controller under UK GDPR, the ICO expects a DPIA in the vast majority of AI deployments, and a self-hosted model is the only configuration where nothing leaves your own servers.

Is Drupal AI Search production ready? Not on its own. The AI Search module had no supported stable release as of 2 September 2026, only alpha builds on both branches, and it requires the Search API module plus a vector database that your team then has to operate. Sites getting good results from it have built hybrid retrieval and a chunking strategy around it, so treat it as one component of a search project rather than a module you switch on.

How much does a Drupal AI implementation cost? A narrow deployment covering the AI module, one provider, alt text and translation, role-level governance and DPIA support usually runs £4,000 to £9,000. A full editorial suite with prompts held in code and spend monitoring runs £10,000 to £25,000. Semantic search or a public chatbot over a large content set, with hybrid retrieval, chunking and evaluation, runs £25,000 to £60,000, and token spend sits on top as the smallest line.