Two Drupal Contributors to Speak on AI Governance and Provenance at AI Week 2026

Two Drupal contributors will speak about AI governance and content provenance at Digital Leaders' AI Week 2026, an online event running from 12 to 23 October. Will Huggins, founder of Zoocha, will speak on 16 October about AI management systems, while Emma Horrell, UX research lead for Drupal, will present research on provenance information for AI-generated content on 15 October. Both sessions were promoted in a Drupal AI Initiative blog post written by Will and published on 12 October.

The talks approach trust in AI from two directions. Will's session concerns the organisational processes needed to oversee AI use, while Emma's examines what information people need to judge an AI-generated answer. Both draw on work connected to Drupal, although the certification behind Will's talk applies to Zoocha as an organisation rather than to Drupal software.

Will's session, The Technology Is Ready. Is Your Organisation? Why AIMS Will Define the AI Leaders, argues that governance rather than access to technology has become the main constraint on AI adoption. According to the session description, organisations with mature Artificial Intelligence Management Systems (AIMS) will gain the most value from AI. The listing names ownership and accountability, visibility of AI systems, risk and impact assessment, human oversight, lifecycle controls, data governance, training, incident management and continual improvement as components of an effective AIMS.

The talk draws on Zoocha's experience establishing an AIMS aligned with ISO/IEC 42001:2023. The international standard specifies requirements for establishing, implementing, maintaining and continually improving an AI management system within an organisation. As a management system standard, it addresses how an organisation governs AI-related risks and opportunities rather than assessing individual AI applications.

Zoocha announced its ISO/IEC 42001 certification on 24 August 2026 in a post by co-founder David Pratt, which describes nearly 12 months of implementation work. The agency says it integrated the standard into its existing business management system rather than creating a separate compliance programme. Controls introduced or formalised include an AI inventory, impact assessments for each AI system, supplier risk assessments, a deployment approval process and incident management procedures.

The announcement also explains how those controls apply to Zoocha's Drupal work. AI-generated code is treated as untrusted input and must meet the same coding standards, security controls, peer review, automated checks and quality assurance gates as other code. Public-facing AI-generated content requires human review and editor approval before publication by default, enforced through the Drupal content workflow. These are Zoocha's organisational and delivery controls, and the certification does not extend to Drupal itself.

Emma's session, Tell Me It's AI By Actually Telling Me It's AI: Designing Provenance Data Users Actually Trust, describes adapting a provenance standard built primarily for images so that it can carry credential data for AI-generated text. According to the session description, she will share results from testing her designs with users, including the finding that the sparkle icon commonly used to mark AI content no longer draws attention. The listing also says the right level of detail depends on context and on who is asking.

The work builds on a prototype AI searchbot at the University of Edinburgh, built with Drupal AI on a demonstration University website. Emma's research account, published on 5 February 2026, describes the design task as part of a study led by DECaDE, the UKRI Next Stage Centre for the Decentralised Digital Economy. She adapted the standard published by the Coalition for Content Provenance and Authenticity (C2PA), which defines Content Credentials: records attached to content showing where it came from, how it was created and how it was modified.

Emma's design grouped the searchbot's provenance data into three categories. Content certification data identified the University as the party vouching for each response and recorded when it was created. Digital source data listed the source pages and the AI model used, while transformation processing data summarised the search mechanisms and included the prompt that shaped the response. Each category could be expanded progressively, following the C2PA disclosure levels, so that users could choose how much detail to see.

The February account named user testing as a next step and raised concern that the volume of provenance text could overwhelm users in a narrow searchbot window. The test results described in the AI Week listing have not yet been published in detail.

Both talks connect to Drupal's AI tooling. Will's blog post cites the contributed Context Control Center module as an example of governance, saying it keeps AI-generated content grounded in human-authored brand rules. The module, an official AI Initiative project led by Salsa Digital, manages context items with moderation, revisions and permissions, and lets administrators choose which AI agents receive them. Emma is one of its maintainers, and the University of Edinburgh is listed as a supporting organisation. Its first release candidate appeared on 25 September 2026, and the project has no supported stable release yet.

Tools of this kind can support oversight of AI-assisted content, but they do not by themselves establish regulatory compliance or organisational certification. Showing where an AI-generated answer came from also does not prove that the answer is accurate. Decisions about responsibility, risk assessment and disclosure remain with the organisations deploying AI.

Both talks are free to attend. Digital Leaders lists more than 240 speakers and over 200 talks for AI Week, with sessions streamed online and available as recordings afterwards.