What Drupal's AI Contribution Policy Requires from Contributors

Contributors may use AI tools on Drupal.org only when a real person stands behind the submission, can explain every change and discloses significant tool use in the issue or merge request. The Policy on the use of AI when contributing to Drupal, published on 25 March 2026 and updated on 20 October 2026, covers code and text drafted with AI tools, such as documentation, issue summaries, tests or review comments. It states: "Saying 'the AI wrote it' is grounds for immediately closing the contribution."

Enforcement ranges from contributor education to temporary or permanent Drupal.org account bans. Alongside the site-wide policy, Drupal core's main (12.x) branch has carried a 54-line core/AGENTS.md instruction file for AI coding tools since 27 June 2026, under a three-month trial whose evaluation is pending.

This is the second instalment of a technical article series by Vimal Joseph and Emily Mathew.

The site-wide policy arrived nine days after Drupal founder Dries Buytaert published "Never submit code you don't understand" on 16 March 2026, covered by The DropTimes in Dries Buytaert Calls for Responsible AI Code Contributions in Drupal. Dries wrote that "Code you don't understand becomes someone else's problem", often the maintainer reviewing the patch.

A Person Must Stand Behind Every AI-Assisted Change

The policy's requirements fall into three groups:

• Listen and collaborate, or risk an account ban for drive-by submissions. Contributors must collaborate with the maintainer, original reporter and other participants. Verbose AI-generated issue summaries and comments burden maintainers. Contributors must not copy-paste AI output verbatim, should write concisely in their own words, and may attach full output only when helpful. The policy states that repeatedly posting low-effort contributions and immediately abandoning them "will get your account banned". It calls this a "drive-by contribution": the contributor does not follow up on feedback or ignores previous discussion on the issue.
• Understand and explain every submitted change. The policy states: "If a reviewer asks you to explain a decision or a piece of logic, you must be able to answer." Contributors must verify all dependencies, logic and security implications before submitting. The policy warns that models can hallucinate nonexistent packages, which risks supply-chain attacks, and that they can introduce security flaws or add unhelpful refactors.
• Verify third-party copyright and GPL compatibility. Drupal is licensed under the GNU General Public License, version 2 or later (GPLv2+). The policy also warns that, because models occasionally output verbatim code or text from other copyrighted projects, contributors are solely responsible for ensuring submissions do not infringe third-party copyrights and remain "fully compatible with the Drupal project's GPL license". "Ignorance of the code's origin is not an excuse for licensing violations," the policy states.

Eight Patterns That Shift the Work to Maintainers and Reviewers

Under "Examples of contributions that do not meet this standard", Drupal.org lists eight patterns that create unnecessary work for maintainers and reviewers, grouped here into four:

• Dumping code or a large AI-generated patch into an issue without reading the thread, respecting prior architectural conclusions, or staying to answer human feedback.
• Posting a merge request where automated checks fail and leaving it for others to fix, or adding AI-generated code to someone else's merge request without their knowledge and disclosure.
• Proposing a full module rewrite based on an AI review without first engaging the existing maintainers.
• Posting unreviewed AI output in issue comments, merge request descriptions or forum posts, or using AI to summarise a thread without independently verified technical insights simply to gain contribution credits.

Significant AI Use Must Be Disclosed, However Thoroughly It Was Reviewed

The policy states: "If you use an AI tool to generate a significant portion of the code or text you are submitting, you must disclose it. You must disclose this use regardless of how thoroughly you reviewed the output."

It defines significant assistance as generating entire functions, classes, architectural scaffolding or extensive documentation blocks. Minor uses, such as single-line autocomplete suggestions or basic syntax fixes, do not require disclosure.

Contributors must place disclosures in the issue or merge request on Drupal.org or GitLab, using the template's AI disclosure section where available or appending a clear statement to the end of the issue summary, comment or merge request description. The policy does not mention commit trailers.

It gives two example disclosures: "AI-Generated: Yes (Used GitHub Copilot to help generate the boilerplate for this feature)." and "AI was used in the drafting of this policy, to help review for clarity, clean up language, and check grammar."

For Google Summer of Code (GSoC) contributors, the policy's FAQ strongly recommends not using AI tools at all so students learn the foundations they need. Any GSoC participant who uses AI for learning or drafting must still follow the policy's rules on disclosure, verification and personal responsibility.

Enforcement Starts with Education and Can End in an Account Ban

Drupal Association staff and Drupal.org site moderators enforce the policy. When contributors show good intent and respond constructively, moderators focus on education. Repeatedly submitting unexplained, untested or disruptive AI output can bring a temporary ban, which lasts until the guidance is read and understood. Clear disregard for the policy or disrespect toward maintainers can result in a permanent Drupal.org account ban. The policy notes that staff and moderators have limited capacity to keep up with the volume of AI-assisted submissions.

The contribution policy can be updated through community governance, while the Drupal.org Terms of Service is a legal framework maintained by the Drupal Association. The policy says the intent is to establish community norms first and reinforce them in the Terms of Service: "One area the TOS will need to address more explicitly is the use of automated agents acting on behalf of contributors. As AI tools become more capable, clearer rules in this area will be necessary."

Drupal Core's Instruction File for AI Coding Tools Awaits Evaluation

Drupal core's own file, core/AGENTS.md, is titled "Operator Rules for LLM Tools". A one-line core/CLAUDE.md file points to it with @AGENTS.md.

Core committer Théodore Biadala (nod_) first proposed adding AGENTS.md files on 22 January 2026, in issue #3568936, "Embrace the chaos, add a couple of AGENTS.md file to core". Core committer Nathaniel Catchpole (catch) and other maintainers debated whether context files would curb or encourage large AI merge requests. Théodore closed the issue on 28 January 2026 as "Closed (works as designed)", adding the next day: "I'm not advocating for a ban on LLMs".

On 20 April 2026, Théodore opened issue #3585894, "LLM harm reduction in Drupal core contribution, AGENTS.md guidelines", for a three-month harm-reduction trial. He wrote that "shaming people into changing their behavior doesn't work" and added to Dries's rule: "never submit code you don't understand and I would add, never submit text you didn't review."

Core committer godotislate committed the file to the main (12.x) branch only on 27 June 2026, in commit eb59ce6b, because a later revert would raise questions for older security-only branches. Théodore tested the file against seven models: Sonnet, Qwen3 8B, Qwen3.6 35B-a3b, Granite 4 h-small, Mistral Nemo 12B, GPT-OSS 20B and Gemma 4 31B.

The 54-line file sets five rules for AI coding tools:

The file provides an exception for translating or editing someone else's text, instructing AI tools to preserve the original author's voice. The disclosure and writing-style rules in sections 1 and 2 do not apply to those tasks. These instructions are separate from the site-wide Drupal.org contribution policy.

Théodore's evaluation ticket, issue #3606814, still listed "Agree on metrics" as its remaining task when checked on 23 October 2026, after its 30 September 2026 postponement date. core/AGENTS.md remained in main and 12.0.x and ships in the Drupal 12 pre-releases up to 12.0.0-beta2, but not in Drupal 10 or 11 releases.

Linux, curl, LLVM and WordPress Also Ask for Disclosure

Other open-source projects adopted their own policies in 2025 and 2026:

In a 30 June 2026 post, "The privilege of AI in Open Source", Dries argued that open-source projects should make lower-cost AI models practical for contribution work and build AI know-how into the contributor experience. He warned that AI "can make it cheaper to contribute without making it cheaper to review". The DropTimes covered the post in Dries Buytaert Calls for Shared AI Infrastructure in Open Source.

Four Checks Before Posting AI-Assisted Work to Drupal.org

Contributors using an AI assistant on a Drupal issue or merge request can use the following practical checklist to meet the policy's expectations. The specific local testing commands are recommended development practices rather than mandatory commands prescribed by the site-wide contribution policy.

1. Read the full issue thread and prior architectural discussions, and reproduce the bug or verify the feature request locally before asking an agent to write code.
2. Run relevant checks such as phpcs, phpstan and phpunit locally in DDEV, where applicable, and read the full git diff by hand before uploading changes.
3. Confirm that every line and dependency is compatible with Drupal's GPL licence (GPLv2+) and can be explained to a reviewer without consulting the model.
4. Disclose significant AI assistance in the issue summary, comment or merge request description and follow up on reviewer feedback.

Two parts of the framework remain open: Terms of Service rules for automated agents acting on behalf of contributors, and the evaluation of the core AGENTS.md trial.