Universal AI Provider Beta 2 Adds Provenance and Disclosure Tools

Site teams can test new AI-origin and disclosure tooling through the Universal AI Provider 1.0.0-beta2 release, published 15 July 2026 for Drupal 11.1 and Drupal 12. Leonardo Fishman, a developer at Quebracho.Digital and the project maintainer, highlighted the release in a LinkedIn post about applying AI transparency requirements within Drupal editorial workflows. The release notes describe a new Content Governance submodule, scheduled content reviews, and recipes for disclosure fields and review profiles. The project remains in beta and is not covered by Drupal’s security advisory policy.

Article 50 of the European Union’s AI Act began applying on 2 August 2026, shortly after the beta was released. European Commission guidance distinguishes obligations placed on AI-system providers from those applying to deployers. Providers of generative AI systems must support machine-readable marking and detection of generated or manipulated outputs, while deployers have separate duties covering deepfakes and certain AI-generated or manipulated text published on matters of public interest. Public-interest text that has undergone substantive human review or editorial control and carries editorial responsibility may qualify for an exemption, so adding a disclosure field or metadata tag cannot by itself establish compliance.

The Content Governance submodule records provenance events showing when content passed through an AI process. It can render a visible reader label and a machine-readable <meta name="ai-origin"> tag from Drupal fields. Guardrail plugins can add disclosure suffixes, origin markers, fact-checking, or AI-likelihood checks. Scheduled scan profiles can enqueue content reviews when nodes are saved and process them through cron or Drupal queues, with optional events for ECA or Workflow integrations.

The bundled ai_content_governance_starter recipe applies disclosure configuration, enables governance and fact-check functionality, and installs an editorial_light scan profile. The profile checks published articles and can emit an event when configured thresholds are reached. The release notes state that provenance emission and automatic attachment of the default guardrail set remain disabled until administrators configure them. The recipe also does not install ECA or Workflow, meaning it prepares the governance structure without activating every disclosure and automation path.

Beta 2 also changes how the provider integrates with the wider Drupal AI ecosystem. The release replaces beta 1’s double-underscore model identifiers with dot-separated server.model values. This allows Drupal AI settings and AI Search to resolve Universal models without the provider-specific patches previously recommended. The project page lists ten supported local and hosted backends, along with multi-server configuration, routing, usage limits, fact-checking, plagiarism detection, and AI-content review. Sites upgrading from beta 1 must run database updates because the change renames model entities and rewrites stored references in provider defaults, routes, Search API embedding configurations, and usage counters.

Drupal.org currently reports two sites using Universal AI Provider, providing limited public evidence of production deployment. The project requires PHP 8.3, Drupal AI 1.3, and the Key module. Its project page warns that projects outside security advisory coverage may have publicly disclosed vulnerabilities. Teams assessing the beta will need to verify its generated metadata, disclosure presentation, scheduled-review behaviour, upgrade path, and relevance to their legal and editorial responsibilities. The European Commission’s Article 50 questions and answers provide further detail on the duties, exceptions, and limited grace period.