DrupalCon 2026 in Review

Introduction

I haven't been able to attend DrupalCon in two years. I had a baby, which has a way of reshuffling your priorities. So getting back to Chicago this year felt really good.

And it reminded me why I keep coming back. Drupal's best feature isn't a module or a release. It's the people. The community shows up, works through hard things together, and genuinely cares about getting it right. That came through in almost every conversation I had this week.

Anya at DrupalCon. 

The conference itself was thoughtfully put together. Sessions covered the things that actually matter to organizations right now: AI, the new Canvas experience, Single Directory Components, content strategy for government, and more. Dries Buytaert, the founder of Drupal, gave a keynote that stood out for me. He was excited about where Drupal is heading, but he was also honest about the challenges: 

AI is lowering the barrier to contribute to Open Source projects like Drupal. On paper, that sounds great. More contributors, more patches, more momentum. But it can also be a real challenge... 

If you're using AI to contribute, you are responsible for what you submit: don't submit code you don't understand. Our quality standards matter, and we will uphold them.”

That balance felt right for where we are.

If you are evaluating Drupal for your organization, or wondering whether the platform you have invested in is keeping up, this post covers what stood out from the Driesnote, the AI security keynote, the Government Summit, and a few key sessions on modern development. I will also share my take on one question that kept coming up all week: in a world where AI can produce a lot very quickly, does deep expertise still matter? I think it does.

What is DrupalCon?

DrupalCon is the annual gathering of the global Drupal community. Developers, designers, strategists, agency leaders, and the organizations that use Drupal all show up in one place to share what they are working on, what is breaking, and where things are heading. This year, the conference was held in Chicago, with over 1,300 attendees.

The challenges that agencies bring to the table, the problems that government and nonprofit teams are running into in the real world, and the new tools being demoed on stage, all of it feeds into the direction of the platform. 

This year held extra significance: Drupal turned 25, which prompted some genuine reflection about what has made the platform last this long in an industry where things go obsolete fast. And the fact that the community is surfacing opportunities and challenges openly gives me confidence in Drupal's direction.

The Driesnote

Dries opened by acknowledging what this year meant. Drupal turned 25, and rather than just celebrating, he used it as a moment to be direct about where things stand. The platform is evolving fast, AI is changing everything around it, and the community needs to decide how it responds to that.

Driesnote at DrupalCon. 

The announcements were significant. Drupal CMS 2.1 launched at the conference, built on Drupal Core 11.3. We also saw a beta release of the Context Control Center (CCC), a system that stores your organization's brand guidelines, content strategies, and editorial rules inside Drupal so that AI tools can draw on them when building or editing pages. Kalamuna is proud to be part of the Drupal AI initiative, and our team contributed to building out CCC features. Seeing it reach beta at DrupalCon was a meaningful moment for us. Canvas AI lets you describe what you want and generates pages from your own component library rather than starting from scratch. AI agents can now monitor published content in the background, flag underperformance, and suggest changes based on updated organizational goals. These are not concepts on a slide anymore. They are shipping.

But the part of the keynote I keep thinking about is not the product demos.

Dries brought Aidan Foster on screen. Aidan has been running a Drupal agency for 17 years. When AI started accelerating, he did not panic, and he did not pretend that nothing was changing. He took time to understand what was actually happening, made thoughtful decisions, and figured out how to use AI to amplify what his team was already doing well. His story is what balanced, responsible leadership looks like in a moment when a lot of people are making rash calls in either direction. He is protecting his people while helping them grow. That distinction matters. And honestly, it is what we are trying to do at Kalamuna, too. We are not pretending AI is not changing our work. It is. But we are approaching it the same way Aidan did, thoughtfully, with our people at the center, using it to amplify what our team is already great at rather than treating it as a shortcut around their expertise.

There is a real human cost to the AI hype that does not get talked about enough. Experienced professionals are being pushed out. Families are being disrupted. Life-long expertise is being dismissed as replaceable. What Aidan's story shows is that it does not have to work that way. AI is a tool. The knowledge and judgment it draws on come from people. If the people stop existing in this industry, the quality of AI output will follow.

Dries made a related point that I think every organization using open source software should hear. He warned that AI-generated contributions are landing in the Drupal issue queues, and the quality is dropping. His message was direct: never submit code you do not understand. CAN-tribute does not mean contribute. This is not just a Drupal problem. It is a signal about what happens when we confuse the tool with the expertise. Having an iPhone does not make you a photographer. Running a prompt does not make you an engineer. The output might look right. That is not the same as being right.

Artifical Intelligence (AI) Security Explored Further

Not every DrupalCon keynote comes from inside the Drupal world, and this one was a reminder of why that matters.

Alexandra Bell, President and CEO of the Bulletin of the Atomic Scientists, took the stage to talk about the security implications of AI. If you are not familiar with the Bulletin, they are the organization behind the Doomsday Clock, the symbolic measure of how close humanity is to a global catastrophe. In January 2026, they moved it to 85 seconds to midnight, the closest it has ever been. AI-driven disinformation was one of the factors cited.

Her message was not subtle. Giving unchecked power to AI systems is dangerous. The technology is evolving faster than our ability to govern it, and the gap between what AI can do and what we actually understand about how it works is growing. Ethical and responsible AI is not a nice-to-have. It is a necessity.

The room was full of developers and agency leaders, and the talk landed. It felt completely relevant, not like a detour from the conference themes but like a wider lens on the same conversation everyone was already having. The question is not just what AI can do for your website. It is what happens when we stop asking who is accountable for the decisions AI is making, and who gets affected when those decisions are wrong.

For our government and public sector clients, this is not abstract. Government websites serve real people trying to access real services. When AI is used to generate content, power search, or automate decisions on those platforms, the stakes are higher than they are for a marketing site. The people using those sites often have no other option. Getting it wrong has consequences. Bell's talk was a useful reminder that responsible AI implementation is not just a technical question. It is an organizational and ethical one, and the organizations that treat it that way will be better positioned for what comes next.

Sessions Worth Knowing About

The Government Summit, Day 1, and Day 2 sessions covered a lot of ground, but a few themes kept surfacing across all of them.

Accessibility is getting more complex. 

The Government Summit had good conversations around WCAG 3.0 and what it means for public sector organizations. Accessibility has always been a baseline requirement for government sites, but WCAG 3.0 raises the bar and introduces new ways of measuring conformance that organizations will need to prepare for. If you are running a government or public-facing site, this is worth paying attention to now rather than scrambling later.

Responsible AI adoption is still a work in progress. 

Across the Government Summit sessions, it was clear that organizations want to use AI but are struggling with how to do it in a way that is actually responsible and produces real results. The enthusiasm is there. The frameworks and guardrails are still catching up. A lot of the challenges being discussed, around translation, content governance, search, and wayfinding, are the same challenges our government clients are navigating every day. It was useful to see the broader community working through them openly.

Agent Experience is the next frontier. 

One of the Day 1 sessions introduced the concept of AX, or Agent Experience, which is the idea of designing Drupal not just for human users and developers but for AI agents that need to navigate, understand, and act within a system. This builds directly on the API-first direction Drupal has been moving toward for years. If Canvas AI and the CCC are about empowering content teams, AX is about making Drupal legible and operable to the AI tools that will work alongside those teams. It is early, but it is the right conversation to be having now.

Single Directory Components are having their moment. 

SDCs have been in Drupal core for a while, but DrupalCon Chicago felt like the point where the community really started building around them in earnest. The Day 2 sessions showed how SDCs are becoming the foundation for more flexible, maintainable front-end work in Drupal. For clients, what this means in practice is cleaner component libraries, better design system integration, and less technical debt over time. It is one of those things that does not make headlines but makes a real difference in the quality and longevity of what gets built.

In Closing

Walking away from DrupalCon Chicago, I felt something I did not fully expect. Not just excitement about the new tools, though there is plenty to be excited about. It was more like reassurance. The community is asking the right questions, having the hard conversations, and building in a direction that makes sense.

Drupal at 25 is not coasting. The platform is more flexible and better suited for the AI era than it has ever been. The structured content foundation, the API-first architecture, the new tooling around Canvas, CCC, and SDCs, all of it positions Drupal well for what is coming. That did not happen by accident. It happened because a global community of people has been investing in it, arguing about it, and improving it for a long time.

And that is really the point. The technology is only as good as the people behind it. AI is changing how we work, and it will keep changing it. But the knowledge, judgment, and care that make digital work actually good still come from people. At Kalamuna, that is how we are approaching it. We are not stepping back from expertise. We are doubling down on it.

Drupal's future is strong. And we are all in it together.

If you are thinking about what AI means for your Drupal site, or wondering whether your platform is set up to take advantage of where things are heading, we would love to talk. Get in touch with the Kalamuna team, and let's figure it out together.