Gartner predicts that 40% of enterprise applications will use AI agents to assist with specific tasks, up from less than 5% in 2025. These changes raise many questions. How will approaches to development on enterprise CMSs like Drupal change? What will be the new standards for teamwork and workflows through human-AI interaction? How can AI be integrated into processes without losing control and security?
Attico’s CTO, Andrey Eroftiev, answers pressing questions that arise when discussing Drupal and AI and shares his vision for the future of this technology.
Low-code usually makes the interface easier for content managers. But how can AI make the work easier for developers who build modules and integrations?
Previously, developers analyzed the task themselves, planned the architecture, broke the task down into submodules, modules, or smaller code chunks, and then they started writing the code. Now, AI works as a developer assistant, for example, in coding. Artificial intelligence can get confused at scale, so it works best when writing small sections of code for a particular task.
The developer still owns the overall architecture. In other words, they break the task down into subtasks, think about how to organize everything, and where to write the code. Here, an iterative development approach works best when the developer assigns the task and the AI writes the code. Then the developer reviews and tests it, provides feedback, and the AI corrects it. This allows specialists to run a few loops of this process and obtain a high-quality result.
Beyond pure coding, AI can serve as an advisor. It can suggest architectural ideas, demonstrate how similar problems are solved in the industry, and perform initial code reviews. Here, it’s crucial to match the developer’s level of expertise. If it’s a senior task, a senior developer should oversee the process, for a middle task — a middle developer. The developer must be capable of completing the task themselves and remember that everything the AI suggests must be critically evaluated, because it can make mistakes or “hallucinate” and invent non-existent facts. AI takes on some of the routine or repetitive work, helps with coding and architecture, saves time, but doesn’t completely replace the developer.
How will the role of a Drupal developer change if some tasks move to low-code and AI agents?
The role of a Drupal developer is gradually changing. Currently, they are more like a “technical manager” orchestrating processes than a person who simply writes code. The developer delegates tasks to AI and always checks the results.
Drupal already functions as a low-code platform in many ways — content and fields can be created, and ready-made modules can be plugged in without writing code. But when the solution should be carefully tailored to the client’s needs, the developer still writes code, while AI handles routine work, runs testing, and provides architectural suggestions.
Experiments are currently underway with AI agents — for example, one manages the process and distributes tasks among other AIs, another builds the architecture, and others implement tasks passed to them by an orchestrator. However, such systems are still in their early stages: they can make mistakes, get stuck, or fail to complete tasks.
How is AI already being used inside Drupal today?
Drupal already has various ways to use artificial intelligence. There is a family of contributed AI modules that integrate Drupal with various AI services. For example, you can open a chat with the AI directly in the admin panel and assign tasks to it within the system.
The simplest example is working with content. Previously, an editor would manually add dozens of elements. Now, they can simply send a list, say, of soccer players’ names from Excel, and ask the AI to add them to the “Soccer Players” taxonomy vocabulary. The same applies to meta tags: the AI can generate descriptions and keywords. It’s still not fully clear how beneficial this is for SEO, but there’s definitely potential.
There are also more technical features. AI can create a new content type with the required fields or help with migration. It breaks the task into steps, writes code snippets, and speeds up the process.
There are also accessibility features, such as AI that automatically describes images with alt attributes for people using screen readers.
How might Drupal’s approach to AI integration stand apart from WordPress and headless platforms?
In WordPress, there are a number of separate ready-to-use AI plugins. Just install them, turn them on, and it works. In headless SaaS platforms, AI integrations are often limited to a subset of integrations officially supported by a platform provider. In any case, AI capabilities are usually provided with a separate service that the system communicates with via an API. Drupal keeps the best of these approaches for integrating AI and takes it even further. This approach is part of what makes Drupal development flexible and powerful, allowing AI to be integrated deeply into the platform rather than just added on top.
In Drupal, AI is built into the system with a powerful Drupal core and contributed APIs, enabling the developer to configure, check, monitor, and adjust the AI’s actions. With the power of Drupal APIs, AI can take part in various processes inside Drupal, such as helping fill content, set SEO tags, find synonyms, perform semantic search, moderate comments, and convert text to images or audio to text. Drupal’s hooks and events allow contributed and custom modules to interact, alter, and enhance the functionality of other modules, creating versatile ecosystems around specific AI-enabled tasks.
With such deep integration, Drupal can automate not just single tasks but entire processes, and maintain control and transparency. This gives Drupal an advantage over other systems when it comes to working with AI within the platform. I would say Drupal is one of the best open-source systems for integrating artificial intelligence.
When we talk about “intelligent workflows” in Drupal, what do we actually mean? Is it only about making things automatic, or is it more about changing how people, content, and AI work together?
Intelligent workflows in Drupal are about automation, but that’s only the starting point. Everything that we used to do manually – adding content, setting SEO tags, moderating comments, converting media — can now be handled by AI. However, AI still makes quite a lot of mistakes, so people still have to keep an eye on what it does. Full automation will only be possible when AI gets smarter or when better ways to catch and fix its mistakes are found.
The second level is more strategic. When automation becomes routine, we start seeing new opportunities for people, content, and AI to work together. For example, semantic search, where a user types a query and immediately receives a precise, concise result without leaving the site. Or building a quick prototype — before, it used to take a large team and several months of development, but now the prototype can be thrown together on the fly and presented to investors.
What will happen to security and privacy if AI agents start making decisions inside a corporate Drupal?
If AI starts making decisions within enterprise Drupal, there will be serious security and privacy concerns. We’ve already mentioned that AI can “hallucinate” or produce unpredictable results. When generating code, for example, at module interfaces, AI can introduce vulnerabilities, either because it doesn’t know enough or has learned from limited data. One AI can even adopt the bad behavior of another AI, for example, producing malicious code, by using its seemingly harmless output for training.
If users don’t keep this in mind, there’s a risk they’ll end up using a service with low accountability and poor privacy protection. Also, if AI operates through external cloud services, some data could be sent outside, and much depends on the provider’s reliability. Even large companies face the risk of data leaks, and for smaller companies, the risk is even higher. SQ Magazine highlights that small and midsize businesses now represent 41% of breach victims. Therefore, it’s essential to avoid using sensitive data, such as project or client data, with external AI services. And if there is a strong need to share confidential details with AI, protective measures such as data anonymization and scheduled deletion might be used to minimize the impact of a potential leak.
Many people worry that AI in Drupal will “blur” responsibility. Who is guilty if there is a mistake: the system, the agent, or the developer? How can this be solved on the architecture level?
The question of responsibility and architecture is still open, and in my view, it needs a lot of work. But in practice, it’s pretty simple: a developer is responsible for the process and the result. Even if artificial intelligence performs part of the work, it is the human who verifies the correctness, security, and compliance with the business context. For anything to change, AI needs to stop or almost stop making mistakes, and users need to trust it much more than they can nowadays.
At the technical and architectural levels, transparency and traceability are crucial. Every action the AI takes should be logged to track exactly what it did, who gave it the command, who checked the result, and when the change occurred. This creates the chain of control that allows even automated decisions to be verified and approved by humans.
To sum it up
Obviously, it’s not a good idea to put all eggs in one basket. People, content, and AI can work together in smarter ways: routine stuff gets automated, but the human still keeps control and responsibility. Overall, the future of Drupal and AI isn’t just about automation — it’s about smart, platform-level workflows where humans are still in charge, and AI just makes life easier and faster.Attico actively works with Drupal and artificial intelligence, helping clients build efficient and secure solutions. We support projects at every stage — from architecture and low-code integrations to AI configuration for content automation, semantic search, and workflows. If your company requires a mobile component, we also implement Drupal mobile development solutions, ensuring a unified approach to content management across all devices.
Author: Andrey Eroftiev
Andrey Eroftiev is a CTO at Attico, a Drupal development company based in Vilnius, Lithuania. He brings over a decade of experience in software engineering and technical leadership, with deep expertise in backend architecture, Drupal development, and modern web technologies.