At Digital Excellence 2026, which the Umbraco team attended with Cantarus, I had the opportunity to demonstrate how membership organisations can use Umbraco to scale content production without losing their brand voice or data security. It’s a challenge many organisations are facing: the pressure to produce more content, at greater speed, without additional resource.
This post explores the thinking behind that demo. I’m sharing how we’ve approached building a governance layer for AI, giving organisations the ability to define clear boundaries, choose their own models, and keep sensitive data protected behind a "glass wall."
If you missed the session, consider this your blueprint for moving beyond the AI hype and towards a strategy that works on your terms.
AI is often introduced as a shortcut: more content, more insights, more efficiency. But for many organisations, especially those responsible for digital platforms, the initial excitement is quickly followed by unease.
Who controls the output? What happens to sensitive data? And how do you ensure automation doesn’t quietly erode quality, tone, or accountability?
The challenge is no longer whether AI is powerful – the real challenge is whether it can be introduced without forcing organisations to surrender control in exchange for convenience.
Many platforms have responded to the rise of AI by embedding predefined features directly into their products. Buttons appear, suggestions are generated, and workflows change overnight. While this can be impressive, it also removes an important layer of decision-making.
When treated as a finished feature rather than a capability, AI tends to dictate behaviour rather than support it. Editorial teams may find themselves adapting to the tool rather than the other way around. Over time, this can lead to a diluted brand voice, unclear accountability, and a wider gap between human intent and automated output.
We need to stop asking what AI can do and start considering how we want it to behave. That’s the only way to build an AI strategy that is sustainable and scalable in the long term.
Umbraco’s approach to AI begins with restraint. Rather than embedding AI directly into the CMS, the core system is intentionally kept free of AI features. This isn't an omission, but a deliberate design choice.
AI is introduced through a separate governance layer that defines rules, boundaries, and behaviour before any output is generated.
Which models are allowed? How should tone and audience be interpreted? What data must never leave the system?
These decisions are made upfront, not retrofitted later. This is what we call AI in Umbraco – a framework where you define the boundaries and the AI simply does the work.
Rather than shipping one large AI feature, Umbraco.AI acts as the plumbing for AI in Umbraco.
It gives teams central control over:
In other words, this is not where AI acts – it’s where AI is defined.
Talking about “AI on your terms” is easy in theory. In practice, it only becomes meaningful once there is a concrete foundation that allows organisations to decide where, how, and to what extent AI is involved.
By separating governance from functionality, AI becomes something that is configured deliberately rather than enabled blindly.
When AI operates within clearly defined boundaries, its role changes. Instead of acting as an autonomous decision-maker, it becomes an assistant – one that works in context and under supervision.
This means AI can help with repetitive or time-consuming tasks, offer suggestions based on existing content, or surface insights that would otherwise require significant manual effort. But the final responsibility remains human.
Editors still decide what is published. Strategists still define intent. AI supports the work; it does not replace the judgment behind it.
This shift from automation to assistance may seem subtle, but it's crucial. What follows is not a single feature, but a set of practical outcomes built on that foundation.
With a governance layer in place, AI can be exposed through modular packages that solve specific problems rather than attempting to “be intelligent” everywhere.
One practical example is prompt‑based functionality. Instead of asking editors to write prompts manually or rely on generic chat tools, repeatable tasks such as generating summaries, refining copy, or suggesting metadata can be formalised. These prompts inherit tone, audience context, and guardrails from the governance layer.
Tasks that previously varied in quality depending on time, experience, or workload can now be supported in a predictable way, without removing editorial ownership.
Beyond isolated tasks, AI becomes even more valuable when it understands the environment it is operating within.
A prompt can analyse the current page alongside surrounding content and use that context when generating something like a meta description. Instead of producing generic outputs, it understands what the metadata should reflect and how it fits into the wider site experience.
This is also where agents and copilots come into play.
Rather than producing content in isolation, these tools can analyse page structure, related content, and the broader site ecosystem. Editors can ask for suggestions, improvements, or guidance and receive responses grounded in the reality of the platform rather than generic advice.
Importantly, this interaction remains conversational and assistive. The AI can propose changes, but it does not publish, restructure, or override decisions independently. Responsibility remains clearly human.
The most tangible shift happens when AI is allowed to work with actual user behaviour.
By integrating analytics and engagement data, such as from Umbraco Engage, AI can move from speculative suggestions to evidence‑based recommendations.
This is where the Model Context Protocol (MCP) comes in. MCP is a secure connector that allows external AI tools to interact with Umbraco.
This enables scenarios such as identifying meaningful audience segments, interpreting performance trends, or suggesting experiments based on observed behaviour. Instead of asking what might work, teams can explore what the data suggests could work better.
Without embedding any tools directly into the CMS. Without breaking governance.
With the MCP Server, AI can:
… all based on actual data from your CMS and visitor database.
Crucially, this data remains first-party and governed.
Think of it as inviting AI to view your data through a glass wall. It can reason over what it sees, but it can never extract or externalise it. By using the Guardrail feature, organisations decide what remains visible, ensuring sensitive information is anonymised or blocked from AI access entirely.
When insight and assistance are combined, AI’s role shifts again. It starts helping with the heavy lifting that would usually require significant manual effort.
This could include proposing alternative content, outlining A/B tests, or highlighting where users get stuck in their journey.
What it does not do is act unilaterally. Each step still requires human approval, refinement, and intent. The system is designed to reduce effort, not responsibility. This distinction matters. Automation without accountability creates risk. Assistance with oversight creates leverage.
This approach points toward a more mature way of handling AI – one where intelligence is introduced gradually, governed explicitly, and evaluated continuously, rather than simply turned on and left to its own devices.
Rather than promising transformation through automation alone, the focus shifts towards enabling better decisions, faster iteration, and more informed experimentation, without forcing organisations to compromise on ownership, tone, or trust.
In that sense, “AI on your terms” is not a slogan. It is the outcome of designing systems in which control comes first and capability follows.
Even here, the principle remains the same. Learning from your data shouldn't mean losing control of it. Data stays owned. Decisions stay accountable. AI operates as a collaborator that reasons within defined constraints, not as an opaque engine pulling unseen levers.
The future of AI in digital platforms is unlikely to be defined by the loudest features or the most aggressive automation. It will be defined by trust, clarity, and the ability to adopt new capabilities without destabilising existing practices.
By treating AI as infrastructure rather than spectacle, Umbraco points toward a quieter but more durable future. A future where organisations can benefit from intelligence at scale without giving up control over who they are, how they speak, or why they publish.
This approach turns AI into something modular and observable. A tool that is governed and extendable by design. But most importantly, it makes AI optional.
In the end, AI is most powerful not when it takes over, but when it works on your terms.
Guest blog by Jeppe Birkebæk Truelsen, Technical Enablement Specialist at Umbraco
We help organisations deliver flexible, future-ready digital platforms with Umbraco.