DrupalCon Chicago 2026

How the conference responded. The sessions behind each announcement delivered on it, with more candour than the stage. The marketplace panel and Drupal Association board confirmed there is no commerce yet and the economics are unproven (Marketplace launch, Board meeting). The Context Control Center team reported one excellent result in about five runs of the keynote demo (Context is Everything (39:31–40:39)), and Acquia's Scott Falconer said the Lovable rebuild took about five rounds of improving its instructions (Agent Experience). The sharpest pushback came from outside: WordPress.com's product lead argued for AI-first repositories and agent-facing primitives in core, the opposite of Dries's scope rule (Stop building AI features (18:50–21:02)), and Pantheon's Josh Koenig showed the flat install base behind "adoption is not there yet" (Escape from Drupal Island! (12:42–15:19)).

Drupal CMS Spotlights

Drupal Association staff with template makers, Acquia and the Drupal AI Initiative · Watch

The second keynote turned the Driesnote's bets into demos. Template makers argued that a template getting a client 80–90% of the way makes sub-$50k Drupal projects viable, well below Drupal's traditional floor (templates open smaller projects (12:54–15:38)), and Dripyard listed Canvas's gaps from the stage: no multilingual, no visibility rules, only basic prop types. On AI, the message was "agents draft, humans publish": bulk agent changes route through moderation with a record of who asked, who drafted and who approved (agent authority and attribution (26:23–28:43)). The Canvas team closed with the local React component workflow and the new Workbench preview tool (Canvas Workbench (41:09–42:34)).

Alexandra Bell: The Security Implications of AI

President and CEO, Bulletin of the Atomic Scientists · Watch

A policy keynote from outside the web world: AI amplifies every human-made existential risk, and outcomes depend on choices made now. Two points landed for a CMS audience. She described the Bulletin losing readers as LLMs scrape and summarise its expert articles (scraping erodes the link to original content (14:10–15:42)), the same problem the AI-crawler session tackled technically. And her account of the 1983 Petrov false alarm argued for keeping humans in the loop where judgement matters (why a person had to decide (8:42–11:45)).

The tone the keynotes set. Honest and urgent rather than celebratory. The project lead named the weaknesses himself, framed AI as both the storm and the way through it, and asked agencies, developers and contributors to commit before Rotterdam, which he called a readiness milestone. Across the week, the recurring answer to "what is Drupal for now?" was the same: be the governed system of record that AI works inside.

Winning the first hour: Drupal CMS, site templates and the marketplace

The Driesnote's most concrete bet was that Drupal loses deals in the first hour, not the fiftieth: it is hard to start with, and its page building has trailed WordPress. Drupal CMS is the response, and site templates are its sharpest edge. The product owner and designer explained the shift: generic content types felt "awkwardly opinionated", so CMS 2 ships templates that know what the site is for (what Drupal CMS is (7:49–8:58)), plus one-click recommended add-ons such as Mailchimp (the Mailchimp add-on (28:21–29:55)). Their target is agencies that left Drupal for WordPress, not do-it-yourself users (not a threat to agencies (29:55–32:35)).

The mechanics are simpler than many expected. A site template is a recipe for a roughly 90% finished site, applied once and never updated (what a template is (2:16–4:24)), so authors carry none of a distribution's maintenance burden. The recipes maintainer filled in the hard edges: recipes leave no record and cannot update or uninstall, and their strings are not yet translatable, the biggest open problem for multilingual sites (recipes and translation (42:08–44:22)). Not everyone is convinced: the YMCA's Open Y team, still pushing features to sites launched six years ago, doubt one-and-done fits a federated platform (Open Y).

The marketplace launched with about a dozen Canvas-based templates, free and paid, including Morpht's Convivial Gov (who the marketplace is for (1:17–4:24)). Makers' top lesson was that polished, audience-specific demo content matters as much as code. The Drupal Association board was frank that the economics are unproven: the first audience is people evaluating Drupal, and commerce and a revenue share are undecided (a $400 template as a lead (13:00–17:25)). Koenig's counterpoint frames the stakes (specialise around outcomes (15:19–18:23)): templates are how Drupal tries to grow the market, and specialisation is how agencies survive if it doesn't.

So what: Drupal is becoming credible for smaller budgets and faster launches. Building a vertical template is now cheap enough to be both a product and a marketing asset.

Canvas: a front end for people who don't know Drupal

Templates need a page builder worth selling, and that is Canvas. Its product lead stated the problem bluntly: theming Drupal demands knowledge of Twig, the render pipeline and cache tags, skills that transfer to no other stack (the triple-Drupaler problem (7:54–9:04)). Canvas lets any React and Tailwind developer build components, mixed with Twig single-directory components (SDCs) on the same page. The most important news was architectural: Canvas will reference Drupal's entity model instead of duplicating it, so pages inherit translations, workflow and permissions (the entity-reference pivot (46:02–49:05)).

The developer workflow is maturing fast. A local toolchain (CLI push and pull, the Workbench preview tool, agent skills) lets teams build plain React components and sync them to Drupal (a decoupled workflow, not a decoupled architecture (33:30–36:20)). The same talk made the AI case for React: models write idiomatic React well, so good developer experience doubles as good agent experience (DX for agents (1:35–4:13)). Under the hood, components are generated config entities and pages are stored as flat rows (how Canvas stores pages (9:19–16:11)).

The limits were stated as clearly. JavaScript components render only in the browser, with no server-side rendering or caching, so SEO-critical content should stay in SDCs (caching and SSR limits (50:04–51:06)). For existing platforms, the advice is incremental: content templates and global regions first, new landing pages next, paragraphs migration later if at all (a gradual adoption sequence (19:13–22:00)). Syracuse University already runs 35 Canvas sites (Advanced Site Building with Canvas). Not everyone thinks the answer is React: core now ships HTMX as the replacement for the Ajax API (deprecating Ajax commands (46:16–47:18)), and Four Kitchens showed native browser features covering much of what teams used to go headless for (view transitions on plain Drupal (22:41–25:37)).

So what: Canvas is ready for small sites and new landing pages, not yet for multilingual or cache-heavy enterprise builds. Plan around the multilingual and entity-reference milestones, and keep SDCs as the portable foundation.

AI: from features to an agent-ready platform

The Driesnote drew the line between developer AI (outside Drupal) and content AI (inside), and the AI Initiative, now 31 agencies and 51 contributors, filled in the middle: Drupal as the best substrate for agents, with structured content, permissions and revisions that let any agent work safely (core stays lean; agents will drive (47:22–50:08)). WordPress's product lead agreed from a different angle: ship primitives any agent can call, not features (laying an Abilities API early (28:22–31:11)).

The building blocks now have names. Tool API gives ECA, Drush, agents and MCP one plugin type for actions (what an agent actually is (9:05–12:49)). MCP lets external clients such as Claude read and act on a site; intent-based tools with explained output beat generic "create entity" primitives (intent-based tools (42:03–44:45)). Jamie Abrahams went furthest: expose Drupal tools through a CLI so coding agents drive Drupal through tools rather than the database, and prefer skills over always-loaded MCP tools (skills versus MCP bloat (24:29–27:17)).

If tools are the hands, context is the judgement. The Context Control Center stores brand and editorial guidance as revisioned, translatable content (how context is selected (14:53–17:34)). Acquia's Scott Falconer calls the discipline "agent experience": design the action, governance and context surfaces for any actor, and test a site by giving an agent an untrusted role to see where Drupal stops it (probing with an untrusted agent (9:21–11:35)).

Governance is where the threads converged. Prompt injection is not solvable, so never mix fetched content with powerful tools (mitigations (46:06–50:24)). Approving every agent step won't scale, so let agents work freely in a Workspace and gate publishing (human out of the loop (53:14–56:04); the AI sandbox (28:22–31:04)). The security team's version: filtering AI output is the new filtering user input (filter AI output (20:35–21:40)). For data sovereignty, amazee.ai runs a stack per country and logs only token counts, never prompts (no prompt logging (25:01–28:40)). What ships today is modest but real: field automators, alt text, SEO helpers and assistants with tools, configured without code (automators (20:48–25:01)).

So what: ask of any AI proposal what tools, context and permissions the agent gets, and where a person signs off. Workspaces plus content moderation is the pattern to adopt now.

The web's new audience: bots, AI search and chat

If agents are becoming editors, they are already readers, and not polite ones. Forum One's incident data showed AI scrapers behaving like a denial-of-service attack, rotating huge pools of residential IPs and crawling faceted search pages that bypass every cache (how scrapers evade detection (6:18–9:22)). A cheap 403 served before Drupal boots stopped one live attack (the live fix (38:05–41:10)). The twist for the public sector: many government clients want LLMs to cite them, so rules must be selective (block or be cited (46:30–47:49)).

Alexandra Bell's keynote named the cost of being read without being visited, and WordPress's Ronnie Burt took the long view: sites become smaller, trusted, structured sources of truth (the website of the future (6:13–8:35)). He also admitted their llms.txt experiment showed no measurable LLM use; Drupal's equivalent recipe is cheap and uninstallable (llms.txt and Markdown pages (27:55–30:27)).

On-site, the user research was sobering: people reach for search first, distrust chat because of past bad bots, and lose trust when bots get cute names (chat baggage (10:02–12:29)). Practitioners agree: start with semantic search over your own content only, with a keyword toggle (the safe first pilot (31:58–38:21)). The recurring discovery: AI exposes weak content rather than fixing it. A university pilot stalled when the assistant surfaced conflicting tuition figures (where the demo broke (38:21–42:51)).

So what: structured, governed, current content is now the main search and AI-readiness investment. Fix search, prune stale pages, and decide deliberately which bots to serve.

Delivering at AI speed without breaking things

AI makes code cheaper to write, which moves the bottleneck to testing and review. DORA research cited by Tugboat says AI amplifies whatever process it meets (AI makes weak pipelines worse (15:45–18:07)). Georgia's GovHub, about 93 agency sites, shows the healthy version: a preview environment per pull request and sanitised real data built inside the secure boundary (test with real data, safely (20:44–23:03)).

Testing against the real site recurred. Drupal Test Traits runs tests on an existing database instead of reinstalling; one suite dropped from 29 to 3 minutes, and an NSW Government page-cache assertion caught a contrib regression (the NSW page-cache guard (27:11–30:19)). Evolving Web adds grouped dependency updates and visual regression (Renovate in practice (32:59–39:49)). Oomph goes furthest, dropping config import and re-applying small recipes that describe the site's intent on every deploy (state versus intent (5:57–10:25)), which the recipes maintainer's guidance contradicts.

AI is already doing heavy lifting in delivery, with care. Tag1 migrated a 100,000-node Drupal 7 site to 11 largely with AI agents working from committed plans, concluding "2x with quality, not 10x with chaos" (setting a sustainable pace (39:13–43:41)). Encore Healthcare passed SOC 2 and HITRUST by making the pipeline the evidence (the pipeline as audit trail (32:09–33:41)), and the security team's supply-chain advice was OSV-Scanner before SBOMs (OSV first (36:08–37:14)). ECA 3, shown in the Driesnote, adds test-and-replay debugging (replay debugging (26:47–29:16)).

So what: the safety net is the prerequisite for AI productivity. Preview environments, real sanitised data and automated updates belong in every maintenance contract.

Government, open source and who pays for it

Government remains Drupal's heartland, and this year's public-sector talks were about shared platforms and the economics of contribution. The European Commission's architect argued that using Drupal is not the same as being open source: its 330-site, 24-language platform only saw the benefits after it abandoned a multisite monolith (why multisite broke (5:01–8:10)), and the EU's Interoperable Europe Act now pushes public bodies to share code (the legal baseline (15:06–17:36)).

Shared distributions are spreading: GovCMS in Australia, LocalGov Drupal across 60–70+ UK councils, and ProvusGov in the US, where an analysis of 100+ RFPs found navigation and search the top pain points (what governments ask for (19:43–20:56)). Palantir's Wisconsin project shipped on time and on budget with benchmarked metrics, lifting resource engagement 664% in its first month (baselines and results (35:38–36:55)).

The community's own infrastructure is stretched. Drupal.org runs on about $3M a year, roughly $10 per modern site, with four engineers (the funding picture (3:57–9:32)). The Association board described a federation study as a geopolitical "plan B" and a Certified Partner letter for tender responses that favours contributors (procurement levers (34:16–35:46)).

So what: public buyers should ask suppliers for their upstream contribution record and make contribution a deliverable; it protects their own production.

Editors, content and the people who use it

Beneath the AI talks ran a quieter thread: everything depends on content quality and editor experience. Stanford replaced a 100-hour-a-quarter manual report with an editor dashboard across 130 sites (the problem it solved (5:01–6:30)). Content governance should give every content area an owner by job title, and use analytics to end arguments (35 views in 12 months (17:29–18:39)).

Structure pays twice: one required "format" term can drive menus, URLs and related content (deterministic URLs (38:37–41:22)), and the same structure is what AI depends on later. Accessibility belongs in the build, so editors never choose heading levels (headings by convention (36:38–39:20)). Page weight is an equity issue: a good responsive image set cut a 4.8 MB payload to 45 KB on a low-end phone (the savings (12:54–16:03)). UNICEF's multi-step donation form lifted conversion 75% (test it, though (25:37–27:59)).

So what: owned, structured, accessible, current content is what makes every AI feature work, and AI will expose content that isn't.

Technologies and tools

Sorted by attention received. The signal is a read for a typical Drupal team: adopt now, watch (promising, gaps remain), or hype (claims ahead of evidence).

Tensions and open questions

• Momentum versus market data. The Driesnote projects a readiness milestone at Rotterdam; Pantheon's data shows a flat install base, and DrupalCon attendance is about 1,300, down from roughly 3,000.
• Where AI belongs. Dries keeps developer AI outside Drupal; WordPress argues for AI-first repositories in core; Drupal's own Tool API and CLI work targets coding agents anyway.
• Demo versus delivery. The Lovable rebuild was "two to three hours" on stage and about five rounds of iteration in the session behind it. The Context Control Center demo scored one excellent run in five.
• Human in the loop or out of it. Panellists argue per-step approval cannot scale and only publishing should be gated; security and government voices are more cautious, and agent identity is unsolved.
• Recipes: one-and-done or ongoing? The maintainer says starting points only; Oomph runs a site by re-applying recipes; Open Y doubts one-and-done suits long-lived platforms; nobody can push a fix to sites built from a template.
• React or HTML. Canvas bets on React because models write it well; the HTMX lead and Four Kitchens argue lighter server-rendered approaches cover most needs.
• Block bots or court them. Hosting teams want scrapers stopped; many public bodies want LLMs to cite them; there is no standard for a controlled preview.
• Unverified numbers and thin capacity. The EC's 70% saving, AI migration hours and most ROI claims lack baselines. Drupal CMS is a 2.5-person team and Drupal.org has four engineers; many roadmaps depend on volunteers.

Talk index

Not covered: "Beyond the Drupal bubble" (its transcript was not available in this run) and five sponsor or gala clips with no spoken content.

Key takeaways

Evaluators of Drupal

• New and real: Drupal CMS 2.1 with ready-made site templates, one-click add-ons and the Canvas page builder.
• Still a promise: marketplace payments, multilingual Canvas pages and a stable Context Control Center, all targeted for later in 2026.
• The real strength is governance: permissions, revisions, Workspaces and approval workflows make Drupal a safe place to let AI touch content.
• Ask any vendor: what they contribute upstream, and exactly where a person approves AI-made changes before they go live.

Editors

• Expect AI to draft and you to approve: changes will arrive as revisions or a Workspace to review.
• Your style guide can live inside Drupal as context that AI follows, so keep it current.
• Dashboards and in-editor accessibility checks are bringing compliance into your daily workflow.

Marketers

• Search first, chat second, and never give the bot a cute name.
• Structured, current content is your AI-search strategy; llms.txt is not a strategy yet.
• Templates and Canvas mean landing pages without a developer ticket, once the multilingual gap closes.

Site owners

• Budget for bots: faceted search can be knocked over by AI scrapers, so put a CDN or WAF in front.
• Decide on purpose which crawlers you serve; blocking them all may cost you citations in AI answers.
• Underfunded maintenance is the risk: fund automated updates and preview environments.
• Give every content area an owner and prune stale pages; outdated content is now a liability.

Developers

• Expose tools, not the database: Tool API, intent-based MCP tools and Drush commands for agents.
• Use coding agents with skills to build; least privilege for anything running in production.
• Test against real sanitised data, and aim for 2x with quality, not 10x with chaos.
• Learn HTMX for server-side interactivity and React for Canvas components.

Site builders

• Drush site export turns any Drupal 11.3+ site into a reusable template recipe.
• ECA 3's new modeler and in-form templates make automation usable without diagrams.
• Start Canvas with content templates and global regions; use Views for conditional layouts.

Themers

• Canvas opens Drupal to plain React and Tailwind developers, but use SDCs where SEO and caching matter.
• Code the logic behind the design, not just the tokens; headings and image sizes are accessibility work.
• Reach for native browser features before going headless.

The Drupal community

• Don't submit code you don't understand, and don't present AI review as a quality gate.
• Drupal.org runs on about $10 per modern site a year, and the Drupal CMS team is 2.5 people. Capacity is the constraint.
• Marketing is the weak side of the machine; the Association is asking partners to help build it.
• Rotterdam is the readiness milestone the project lead set. Are you out or are you in?

AI-generated. Sources: the DrupalCon Chicago 2026 session playlist and the Driesnote on YouTube.