Webinar

From Running Projects to Growing Portfolios

Register Now →
Book a discovery call
Book a discovery call

AI Functionality in Umbraco Products

A Transparency & Compliance Overview for Customers

Our Principle: You Choose Your AI

Umbraco builds AI-powered capabilities as optional building blocks within our products - not as something we impose on you, your editors, or your website's visitors. We believe artificial intelligence can meaningfully improve how content is created, managed, and found, but only when its use is transparent, controllable, and firmly under the direction of the organization running the site.

No AI provider is bundled, pre-configured, or enabled by default in Umbraco CMS, Umbraco Forms, or Umbraco Commerce. Where AI functionality exists, it is opt-in: your organization decides whether to install it, which AI provider to connect (for example OpenAI, Anthropic, Google, or others), and exactly what it is allowed to access.

This document is a companion to Umbraco's product page at umbraco.com/products/ai, but with a different purpose. Rather than describing what our AI features can do for your business, it explains - for compliance, security, and procurement teams - how these features work, what data may flow where, who is responsible for what, and how we currently understand applicable regulation, including the GDPR and the EU AI Act.

Because almost all of the software referenced in this document is open source, every statement below can be independently verified by inspecting the public source code linked throughout.

Our Approach to AI in Our Products

We use AI as an assistive layer - not as a replacement for the judgment of your editors, developers, or

support staff. Where enabled, AI features may help your organization to:

  • Draft, refine, or summarize content within the Umbraco back office

  • Search and retrieve content semantically, beyond exact keyword matches

  • Answer natural-language questions about your own Umbraco content and configuration through a chat or agent interface

  • Carry out back-office tasks - creating document types, managing forms, reviewing commerce orders -

  • from natural-language instructions given to an AI coding or agent tool

  • Support developers building, testing, and extending Umbraco solutions

None of this happens unless your organization explicitly installs the relevant package and supplies credentials for an AI provider of your choosing. Out of the box, Umbraco ships with no AI connection active.

What This Document Does Not Cover

This document covers AI functionality that ships within, or is designed to operate against, Umbraco's own products (Umbraco CMS, Umbraco Forms, and Umbraco Commerce). It does not cover:

  • AI tools Umbraco A/S uses internally to run its own Customer Experience / support operations (Umboto, and internal use of tools such as Claude or Gemini) - that usage is described in the separate “AI Usage in Umbraco Support” disclosure.

  • Sales and marketing claims about AI features - see umbraco.com/products/ai/ for that perspective.

  • Third-party Umbraco Marketplace packages built by community members or partners, which are outside Umbraco A/S's direct control.

AI Capabilities Across Our Products

As of the date of this document, two families of open-source AI functionality exist across Umbraco's public repositories: Umbraco.AI, an in-product AI integration layer, and a set of Model Context Protocol (MCP) servers that connect Umbraco to external AI agents during development and operation.

Umbraco.AI - In-Product AI Integration Layer

Umbraco.AI (github.com/umbraco/Umbraco.AI) is an open-source AI integration layer for Umbraco CMS, built on Microsoft's Extensions.AI framework. It is structured as a set of independent packages an implementer can choose to install:

  • Core - the base integration layer that other AI packages depend on

  • Agent and Agent.UI / Agent.Copilot - an in-editor chat/agent experience

  • Prompt - reusable, editor-managed prompt templates

  • Search - AI-powered semantic (vector) search across content (currently in beta)

  • Automate - integration with Umbraco Automate for AI-driven workflows (currently in alpha)

  • Deploy - support for including AI configuration in Umbraco Deploy workflows

None of these packages ship with a connection to any AI vendor. A separate provider package must be installed and configured with the implementer's own account and credentials before any AI request can be made. Supported provider packages currently include:

  • OpenAI, Anthropic, Amazon Bedrock, Google Gemini, Microsoft AI Foundry, Mistral, DeepSeek, 

  • Hugging Face, Fireworks AI, and Together AI

Because provider packages are interchangeable, your organization retains the choice of vendor - and can switch, remove, or decline to install one at any time.

Model Context Protocol (MCP) Servers - Agent & Developer Tooling

Separately, Umbraco publishes a family of MCP servers. The Model Context Protocol is an open standard that lets AI assistants (such as Claude, GitHub Copilot, or Cursor) call a defined set of tools against a system - in this case, an Umbraco instance - instead of operating on raw, unrestricted access.

  • Umbraco CMS Developer MCP (github.com/umbraco/Umbraco-CMS-MCP-Dev) - exposes the Umbraco back-office Management API (documents, media, document types, data types) so an AI agent can carry out back-office tasks through natural conversation

  • Umbraco Forms MCP (github.com/umbraco/Umbraco-Forms-MCP-Dev) - exposes form design, data

  • sources, and form submissions, and can chain into the CMS MCP server for combined access

  • Umbraco Commerce MCP (github.com/umbraco/Umbraco.Commerce.MCP) - exposes order management, discounts, and analytics for Umbraco Commerce; currently published as a proof of concept and requires a valid Umbraco Commerce license

  • Umbraco MCP Server SDK (github.com/umbraco/Umbraco-MCP-Base) - a developer toolkit for 

    building custom MCP servers against Umbraco or third-party APIs; not itself a customer-facing 

    feature

How Data Flows When These Features Are Used

Because Umbraco's AI features are “bring your own AI” (BYOK) by design, the data flow is intentionally simple and direct:

  • When an AI feature is enabled and a request is made (for example, asking Umbraco.AI to refine a content field, or asking an AI agent connected via MCP to create a document type), the relevant content or instruction is sent directly from your Umbraco instance to the AI provider you configured, using the API credentials your organization owns.

  • Umbraco A/S is not an intermediary in that specific request for self-hosted / on-premises deployments, and does not receive, log, or store the contents of those AI requests or responses.

  • If no AI provider package is installed and configured, no data relating to these features is sent anywhere.

For customers hosted on Umbraco Cloud, the general Umbraco Cloud hosting terms and the current Umbraco Cloud Data Processing Agreement govern how the underlying Cloud infrastructure handles data. This document does not modify or restate that agreement, and enabling an AI feature does not, by itself, change your existing Cloud DPA. Please refer to your current Umbraco Cloud contract, or contact your account team, for the authoritative and up-to-date terms.

Because Umbraco.AI, the MCP servers, and the MCP SDK are open source and published under the MIT license (Umbraco Commerce MCP additionally requires a commercial Umbraco Commerce license to operate against a licensed Commerce store), your security or engineering team can review the exact code path for any feature described here before enabling it in production.

Your Responsibilities When Enabling AI Features

Because your organization selects and configures the AI provider, your organization takes on certain responsibilities that Umbraco A/S cannot fulfil on your behalf:

  • Reviewing and agreeing to your chosen AI provider's own terms, data processing agreement, security posture, and data-training policy

  • Configuring a least-privilege Umbraco API user for any MCP or agent integration, matching access to actual need

  • Assessing whether your specific use case - for example, a public-facing AI chat experience for your site's visitors - requires end-user transparency notices, a Data Protection Impact Assessment, or other steps under your applicable law

  • Avoiding sending unnecessary personal data or special category data (Art. 9 GDPR) through AI features

  • Periodically re-reviewing your provider's terms, since these may change independently of Umbraco's own software

Data Protection and GDPR

Where an AI feature processes personal data - for example, content containing names, form submissions, or commerce customer records - standard GDPR roles apply. Your organization is the data controller (Art. 4(7) GDPR) for that content. Once you connect an AI provider, that provider generally acts as your processor or sub-processor (Art. 4(8), Art. 28 GDPR) under the data processing agreement you hold directly with them.

For self-hosted and on-premises deployments, Umbraco A/S is not a party to that specific processing relationship and has no visibility into the content of AI requests made through these features.

Right to Erasure

Where your organization's use of an AI feature involves the personal data of your own end users (for example, a data subject whose details were included in a form submission or content field processed by an AI feature), your organization remains responsible for handling any erasure request under Article 17 GDPR, coordinating as needed with your chosen AI provider's own data retention and deletion capabilities.

Recommended Practices

  • Conduct a Data Protection Impact Assessment (Art. 35 GDPR) where an AI feature is likely to result in high risk to individuals, particularly for public-facing conversational features

  • Confirm your AI provider's cross-border transfer mechanism (Art. 44–49 GDPR) if the provider processes data outside the EU/EEA

  • Maintain or update your Record of Processing Activities (Art. 30 GDPR) to reflect any AI feature you enable

Regulation (EU) 2024/1689 (the “EU AI Act”) distinguishes between providers of general-purpose AI (“GPAI”) models, providers of downstream AI systems built on top of those models, and deployers who put an AI system into use in a specific context.

  • Umbraco A/S does not develop or train the underlying general-purpose AI models used through Umbraco.AI or the MCP servers. Those models (for example, GPT, Claude, or Gemini family models) are developed and placed on the market by the respective third-party providers your organization selects, who carry the GPAI provider obligations under Arts. 53–55.

  • As the developer of the integration layer and MCP servers, Umbraco A/S's role is closer to that of a software provider assembling AI-system building blocks; the AI system that is actually deployed - and the accompanying deployer obligations under Art. 26 - is assembled and put into use by each

    customer, in their own specific context.

  • None of the AI functionality described in this document (content assistance, semantic search,  in-editor agent/chat features, or natural-language back-office and developer tooling) falls within an Annex III high-risk use-case area (biometrics; critical infrastructure; education or vocational training; employment; essential private or public services; law enforcement; migration, asylum, or border control; or the administration of justice and democratic processes) or an Annex I product-safety category, based on their current, general-purpose functionality.

  • Where an AI feature interacts directly with a natural person in conversational form (for example, an in-editor or customer-facing agent/chat experience), the Art. 50(1) transparency obligation is engaged: that person must be informed they are interacting with an AI system, unless this is obvious 

    from the circumstances. Because these features are configured and deployed within each customer's own site and context, responsibility for that specific end-user disclosure sits with the deploying organization, not with Umbraco A/S.

Taken together, Umbraco's current AI functionality is assessed, on a preliminary basis, as minimal-to-limited risk under the EU AI Act's risk tiers, with no identified Annex III or Annex I high-risk classification for the functionality as it exists today. This assessment will be reviewed as the AI Act's phased obligations continue to take effect and as Umbraco's AI functionality evolves.

Product Maturity and Change Notice

Several of the components described in this document are under active development and may change materially:

  • Umbraco.AI.Search (semantic vector search) - currently in beta

  • Umbraco.AI.Automate - currently in alpha

  • Umbraco Commerce MCP - currently published as a proof of concept

This document reflects the state of Umbraco's public repositories at the time of writing and will be reviewed and updated periodically as these products mature. The authoritative, up-to-date source for each component remains its public GitHub repository.

Source Code and Further Reading

Every component described in this document is published as open source and can be reviewed directly:

github.com/umbraco/Umbraco.AI
github.com/umbraco/Umbraco-CMS-MCP-Dev
https://github.com/umbraco/Umbraco-Forms-MCP-Dev
github.com/umbraco/Umbraco.Commerce.Mcp
github.com/umbraco/Umbraco-MCP-Base

[Will be updated continually] - last review August 2026


Questions

If you have questions about this document, or about how AI functionality applies to your specific Umbraco deployment, please contact your Umbraco account team or reach out via the details: Umbraco Compliance team - gdpr@umbraco.com