AI Act

AI Act helps Drupal sites meet the EU AI Act: it logs every AI operation, pauses AI agents until a person approves their actions, and keeps an audit trail of each decision.

More and more Drupal sites use AI: to write and translate content, to tag media, or to run AI agents that change the site on their own, for example by publishing an article. The EU AI Act (Regulation (EU) 2024/1689) asks organizations that use AI to keep records of what the AI did and to let people supervise it, stop it and overrule it.

The goal of this project is to become the place where Drupal sites find the tools they need for AI Act compliance. The module will grow over time, one obligation at a time. The first release focuses on the two that matter most for a site running AI agents: record-keeping (article 12) and human oversight (article 14). See AI Act coverage below for what is covered today and what is planned.

Important: installing a module does not make a site compliant. AI Act gives you technical measures. Compliance also needs decisions, documents and training that only your organization can provide. This project is not legal advice.

Features

• Audit log. Every call to an AI provider and every agent run is recorded as an operation: who started it, which provider and model, tokens used, the tools the agent called, errors, and the policy that applied. The log cannot be edited or deleted from Drupal.
• Human approval before agents act. You choose which agent tools need a person's approval. When an agent wants to use one, it pauses before anything happens. A reviewer sees what the agent wants to do, on which content and for whom, then approves or rejects it with a reason. The agent then continues: it runs the action, or it is told why not.
• Separation of duties. By default, the person who started an agent cannot approve its actions.
• Policies. Rules, exportable with your configuration, that decide before anything runs: require approval for an agent's tool, reject it, or allow it; deny a request to an AI provider altogether. Rules can target specific agents, tools, user roles and providers.
• Provenance. For each piece of content an agent worked on, you can see which run, which model and which decisions produced it.
• Privacy settings. Store prompts and AI answers in full, only as a fingerprint (hash), or not at all.
• Housekeeping. Pending approvals expire after a set time, and runs that stopped halfway are closed.
• Drush commands for reviewers: list, approve and reject pending actions from the command line.
• AI Act Automators (included submodule): runs a supervised AI agent automatically when content is saved.

Use cases

• A newsroom where an AI agent reviews drafts and proposes to publish them, but only an editor-in-chief can let an article go live. Under article 50(4), a text on matters of public interest reviewed this way does not need an "AI-generated" label: the module records who reviewed it, when, and why.
• A shop or a membership site where an agent can change prices, send emails or edit user data, and every such action must be checked first.
• Any site that must be able to show, months later, what its AI did and who was responsible.

AI Act coverage

Status of the current release. Many obligations of the AI Act concern high-risk AI systems: for a site that uses AI for content, several of them are good practice rather than legal duties. Article 50 on transparency applies to everyone, since 2 August 2026.

Covered

• Article 12, record-keeping: automatic, append-only log of every AI operation and of every step of it, with actor and time.
• Article 14, human oversight: people can understand what an agent is about to do, stop it, and overrule it, before it acts. Fully covered for AI agents; for other uses of AI, see the limits below.
• Article 26(2), oversight by competent people: a dedicated reviewer permission, separation of duties, and every decision recorded under a person's name. Training reviewers remains up to you.
• Article 50(4), AI-generated text published on matters of public interest: documented human review and editorial responsibility, the condition that exempts a text from the AI label.

Partially covered

• Articles 19 and 26(6), keeping logs for at least six months: the log is never deleted, so the minimum is met; a configurable retention period is planned.
• Article 26(5), monitoring: list of operations, failed and denied runs, closing of interrupted runs; no alerts yet.
• Article 9, risk management: policies turn the measures you choose into rules the site enforces.
• Article 13, transparency towards users of the system: details and provenance of each operation.
• Article 50(2), machine-readable marking of AI-generated content: provenance is recorded; marking inside the content is planned.

Planned

• Article 50(1): telling people they are interacting with an AI system.
• Configurable log retention, AI-generated content marking, more policy conditions, and better support for AI uses beyond agents.

Out of scope (organizational duties, or duties of the AI provider): prohibited practices (article 5), AI literacy (article 4), fundamental rights impact assessment (article 27), technical documentation and CE marking, and the procedure for notifying serious incidents (article 73). For incidents, the log provides the evidence.

Limits. The pause for approval works for AI agents, including agents started by AI Act Automators. Other uses of AI, such as AI in CKEditor or other automator types, are recorded and can be denied by a policy, but cannot wait for a person. Agents started from the Drupal AI chatbot pause, but the chatbot cannot show the request or resume yet.

Post-Installation

1. Open Reports → Status report and check that the row AI Act: tool approval in AI Agents says Available (see Additional Requirements).
2. Go to Configuration → AI → Safety & Compliance → AI Act (/admin/config/ai/ai-act) and choose how much of prompts and answers to store, whether a person may approve their own requests, and when approvals expire.
3. Edit your AI agents (/admin/config/ai/tools-automation/agents). Each tool now has an Approval mode: Pre-approved (default), Approve once per run or Always needs approval. Choose Always needs approval for tools that change your site.
4. Optionally add policies under the Policies tab (/admin/config/ai/ai-act/policies).
5. Give your reviewers the permissions Review AI operations and View the AI governance log. Keep Administer AI governance for site administrators.
6. Reviewers work from AI approvals (/admin/ai-act/approvals). Everything that happened is under Reports → AI operations (/admin/ai-act/operations).

Uninstalling the module deletes the log. Export what you need to keep first.

Additional Requirements

• Drupal 11.2 or later.
• AI 1.4 or later, with at least one AI provider configured.
• AI Agents 1.4.x with the patch from issue #3586020 (merge request !363). The patch lets an agent pause and wait for a person. It is not part of an AI Agents release yet; the README explains how to apply it with cweagans/composer-patches. Without it the module cannot be installed.

Recommended modules/libraries

• AI Automators (part of the AI module), together with the included AI Act Automators submodule, to run supervised agents automatically when content is saved.
• An AI provider module of your choice: AI Act does not depend on any specific provider.

Similar projects

• AI Logging and AI Observability (submodules of AI) log AI requests and responses for debugging and monitoring. AI Act adds human approval, policies and an accountability trail of who decided what.
• AI Governance correlates Drupal's AI tool-call authorizations with the audit reports of an external MCP gateway. AI Act works inside Drupal, without an external gateway, and pauses agents for human review.
• AI Content Governance uses AI to review content and suggest improvements. AI Act does the opposite: people review what the AI does.

Supporting this Module

The most useful support right now is feedback on the AI Agents merge request !363, and reports from sites that try the module. Issues and ideas for the next AI Act articles are welcome in the issue queue.

Community Documentation

• README: installation, configuration, permissions and Drush commands.

Project status

Under active development. Releases stay alpha until the AI Agents patch is merged and released, because its API may still change during review.