February 2026: Umbraco's AI answer is a governance layer, not a feature

· JD + AI · Umbraco

February 2026: Umbraco's AI answer is a governance layer, not a feature

February 2026 is the month Umbraco answered the AI question, and the answer is a configuration layer rather than a set of buttons in the backoffice. Two products landed: Umbraco.AI, open source and maintained by HQ, and Umbraco Compose, a commercial SaaS data orchestration platform. Only one of them got any scrutiny from outside the company.

If you run Umbraco, the decision in front of you this quarter is narrow. Either the AI calls in your solution move behind Umbraco.AI's profiles and audit log, or they stay where they are now, spread across your own services with your own key handling and no usage accounting. Everything below is evidence for that decision.

Umbraco.AI: the interesting part is the plumbing

Introducing Umbraco AI — Matt Brailsford Brailsford builds Umbraco.AI at Umbraco HQ, so this is the author writing about his own product. Read it as the design document it is, not as an assessment. It is also the only place the architecture is written down at any depth, and the architecture is the reason to care.

The package sits on Microsoft.Extensions.AI and exposes the M.E.AI types directly — IChatClient, ChatMessage, ChatResponse — rather than wrapping them in Umbraco-specific abstractions. Providers arrive as NuGet packages and register themselves on install: OpenAI, Anthropic, Google, Amazon Bedrock and Microsoft AI Foundry ship today, and the provider contract is public so you can write your own. Above that sit Connections (credentials), Profiles (a model plus temperature, token ceiling and system prompt, addressed from code by alias) and Contexts (injected knowledge that composes across profile, content node, prompt and agent).

One operational detail is worth more than the feature list. A connection value prefixed with $ resolves from application configuration instead of being stored in the database, so $OpenAI:ApiKey reads from appsettings or an environment variable. That is the difference between an AI configuration you can commit and one your security review will send back. The rest of the enterprise surface is audit logging of every request and response, token accounting per request rolled up daily, and version history on every AI entity.

Brailsford also lists what is coming: automations, a tool permissions system, an evaluation framework, richer RAG, and Umbraco Deploy integration for AI configuration. That is a roadmap on a personal blog rather than in vendor documentation. Treat it as intent and confirm with HQ before you plan a delivery date around any of it.

AI, intentionally — Bolette Kern, Umbraco Umbraco writing about Umbraco, and the closest thing to an official statement of position. It confirms the things that need a vendor source: Umbraco.AI is HQ-owned and open source, it ships with five provider connections, and an MCP base implementation will be "released as a beta soon" with no date attached. The summary line is "Umbraco stays stable. AI stays flexible. You stay in control." There is a commercial argument underneath it aimed at the partner channel, that partners can "retain the role of the expert, not just the installer" by building on the foundation rather than reselling the same default features. That argument happens to be correct, but it is a sales argument and it should be read as one.

AI in Umbraco 17: Flexible CMS Strategy — Dave Jonker The independent restatement of the same strategy, with the compliance and data-residency angle that HQ underplays. No new information, but it is the version to send to the client who will not read a vendor blog post.

The post that actually cost someone an evening

How I used Umbraco.AI for free — Owain Williams, writing as Owain.Codes Three failures, all reproducible, all encountered while preparing a meetup demo. The AI section does not appear in the backoffice until you add AI to your user group's permitted sections. Google's free Gemini tier still requires card details before a request succeeds. And the Google provider's model dropdown offered Gemini 2, which the free tier no longer serves, so Williams patched GoogleChatCapability.cs in his local copy to add gemini-3-flash-preview and opened a pull request, still open when he published on 27 February. If you are evaluating Umbraco.AI on someone else's budget, this is the one to read first.

Compose launched, and nobody outside HQ wrote about it

Introducing Umbraco Compose — Filip Bech-Larsen, Umbraco A vendor launch post for a new commercial product: a managed ingestion API, a GraphQL delivery API, and a content picker that presents Compose-connected data in the backoffice as though it were stored in Umbraco. Compose is technology agnostic by design, which means Umbraco is now selling infrastructure to projects that do not run Umbraco CMS at all.

Two things the post does not contain: pricing, which lives on the product page, and a self-service path, since onboarding starts with "let's talk" and an architectural onboarding session. That is an enterprise sales motion, and it tells you which projects this is for. The consequence for the rest of us is that Compose competes with the backend-for-frontend layer your team has probably already written and is already maintaining. In fifteen Umbraco items harvested this month, not one came from outside HQ examining it. A commercial launch that draws no independent write-up in four weeks is itself a data point.

Two upgrade potholes worth the two minutes

Upgrading Umbraco 13 to Umbraco 17 issue — Owain Williams, writing as Owain.Codes A clean 13.13.0 site upgrades the database, then a 17.1.0 site pointed at the same database renders the upgrade screen with blank "Current version" and "Upgraded to" fields and a 403 on /umbraco/management/api/v1/upgrade/authorize. The account that had permission to upgrade under 13 did not have it under the Management API introduced since. Changing the user group on the account fixed it. Short post, and it will save you the devtools session.

uSync v17.0.4 — Kevin Jump, credited on the release as KevinJump Check the tag you pin: the release is titled 17.0.4 and its changelog compares v17.0.2 to v17.0.4, while the harvested link resolves to the v17.0.3 tag. The contents are a patch set for Umbraco v17. The one to look at is cleanup of the DocumentUrl tables when a content key changes, which is the explanation for stale URLs surviving a restore. Also included: a new IgnoreStopIfOnceExists setting for write-only deployments, a fix for blank descriptions being written as the literal string null, and enums now serialised as strings everywhere.

AI changed how the work gets done more than what got shipped

Three of Brailsford's four posts this month have nothing to do with Umbraco features and everything to do with running several AI sessions at once. HTTP over named pipes solves the port collision when every git worktree wants to run a demo site, by having Kestrel listen on a named pipe derived from the worktree name so no tool has to discover a port. Keeping Claude Code in the right git worktree is the story of an agent losing track of its working directory after context compression and committing straight to dev, fixed by writing the worktree path into task metadata that survives the compression. Replacing my custom git worktree skill with Claude Code hooks retires that custom tooling for native worktree support while keeping the part the native version lacks: a .worktreeinclude list that copies gitignored files such as appsettings.Development.json and a configured demo site into each new checkout.

This is what building an Umbraco product looks like in 2026, and the interesting admission is that the hard problems were ports, git and memory rather than models.

Defence might actually be your best offence in the agentic era — Dennis Adolfi The best argument published about Umbraco this month is not about Umbraco. Adolfi's case is that agent output scales and human review does not, so throughput plateaus at the reviewer: "Agents can generate code, but they do not, yet, own the consequences." His conclusion, that the defensive layer has to take full responsibility rather than 95% of it before any of this scales, is arguable and worth arguing with. That is more than most opinion pieces manage.

How to solve GitHub Action workflow restriction when configuring CI/CD in Umbraco Cloud — Dennis Adolfi Umbraco Cloud's CI/CD sample needs write access because cloud-sync commits automatic upgrades back to your repository, and the official guide assumes you can grant it globally. If your organisation enforces read-only Actions permissions, the org policy overrides the repository setting and the workflow fails with a 403 on push. The fix is permissions: contents: write in the workflow file itself. Two lines, and the guide does not mention the scenario.

The community posts

Announcing: Umbraco Contributing Partners 2025 — Mats Persson & Emma Burstow, Umbraco names 65 Platinum and Gold partners, 27 of them new and 38 renewed, recognised for documentation, core pull requests, packages and events. uProfile February 2026 — Jenny Bradshaw — Jenny Bradshaw, Umbraco profiles the Managing Director of Moriyama and Umbraco MVP. Both are HQ community posts and neither will teach you anything technical. The partner list has one practical use: it is a filter when you are choosing who to work with.

What February actually decided

Umbraco's bet is that the valuable part of AI in a CMS is governance rather than generation, and that bet looks right. It also moves the cost onto you. Choosing your own provider means owning the provider bill, the model deprecations, the prompt library and the audit trail, which is exactly what Williams ran into within a day of trying it. A platform that hard-codes one model hides all of that until the invoice arrives, and hides it permanently. Umbraco has decided you should see it on day one. Fewer teams will enable AI as a result, and the ones that do will know what they turned on.

One caveat about this month's reading. Eight of the fourteen items here come from Umbraco HQ or from someone employed to build its products: four posts on umbraco.com, and four from Matt Brailsford, who builds Umbraco.AI. February's Umbraco coverage was, to a large extent, Umbraco talking about itself. The independent voices — Williams, Adolfi, Jonker, Jump — carried the parts you can act on, and there were not many of them.

Sources

umbraco · sitecore-search · umbraco-apis · product · community · release · umbraco-backoffice · ai

2026 © Umbracolombia - All rights reserved.