A lot of 2027 digital budgets are being closed in these weeks, and almost all of them are missing the same line. It doesn’t appear on any spreadsheet and yet many organisations are going to pay it. It’s called “doing nothing” with the website. Nobody is going to invoice you for leaving your website as it is. You pay later, all at once, and almost always at the worst possible moment. So a budget that puts maintenance down as an optional line, the kind that falls in the second round of cuts, hasn’t saved anything: it has decided to pay later, without choosing when.
For those of you reading without a technical background, the thing that explains it best is what happens with your car. You have one that runs well, that you’re happy with, with immaculate bodywork. Nobody disputes that it’s a good car. The question is what state the engine is in, what happens at its services and what happens with the rules of the city it drives in. Those three things are what usually affect our budget, and none of them depends on whether the car “works”.
The mechanic’s service, or what it costs to have no surprises
The first thing is to forget about the annual service. In software it doesn’t exist. Security advisories for modules of the Drupal CMS come out every Wednesday, and core advisories have their window on the third Wednesday of each month; any serious platform keeps a similar cadence. Maintaining a website means reading those advisories, deciding which ones affect you, applying the patch, checking that nothing has broken and having a backup that can really be restored, not one that exists in theory and nobody has tested. It’s a rhythm. Like an oil change, or checking the brakes and the tyres: it costs little each time (as a rule, if there isn’t much wear) and you don’t notice it when it’s done well.
And that’s the trap, of course. Precisely because you don’t notice it, it’s the first candidate for cuts. Stopping doing it isn’t noticeable either. Until it is.
A budget that puts maintenance down as an optional line, the kind that falls in the second round of cuts, hasn't saved anything: it has decided to pay later, without choosing when.
The manufacturer stops repairing the engine (and publishes the defects, too)
This is where the analogy falls short, and it’s worth knowing exactly where. An old engine wears out: it makes noises, uses more fuel, and one day it leaves you stranded on the ring road or wherever you spend your memorable moments of morning traffic. Software doesn’t wear out. Drupal 10 reaches its end of life on 9 December 2026, the same week Drupal 12 comes out, and a website on Drupal 10 will work on 10 December exactly as it did on the 8th. PHP 8.2, the language that Drupal and a good part of the web run on, stops receiving security patches on 31 December. You won’t notice anything on 1 January either; it will keep working.
What changes is something else. From those dates on, every security flaw that appears is fixed in the new versions and published. Security advisories are public by design: when the Drupal security team publishes a fix for Drupal 11, anyone can read it and deduce that a website on Drupal 10 has the same flaw, unfixed. And so on every Wednesday. Back to the car: the manufacturer hasn’t stopped making your engine; it has stopped sending you the part that prevents it from being started without a key, and every week it publishes a list of the different ways to do it. Oops.
That’s why the cost of doing nothing doesn’t grow in a straight line. For months nothing happens and it seems free. Then each advisory adds to the previous one, and to the one before that, until an incident, an audit or a formal request forces you to do in three weeks, in a hurry and with no room to negotiate, what could have been planned over six or twelve months. The final bill adds up the update that was postponed, the incident that triggered it and the hours of everyone who had to drop what they were doing to put out the fire. That’s the line that wasn’t on the spreadsheet.
Changing the engine without changing the car (we’re still talking about websites)
The good news is that nobody is forcing you to change cars. Moving from Drupal 10 to Drupal 11 means changing the engine and keeping everything else: design, content, structure, integrations and your editors’ work. The car is still yours.
What you do need to budget for is the adaptations, because the new engine brings parts the old car didn’t know. Modules that need their compatible version, custom code that used functions that have since been removed, a more recent version of PHP, some front-end piece that needs adjusting. That’s what it costs to fit a 2026 engine into 2022 bodywork, and the garage didn’t make it up. In return, there’s an advantage that almost nobody weighs up when choosing a platform: Drupal releases a major version every two years and a minor one every six months, with dates known years in advance, and each major version lives for around four years on average. Drupal 10 came out in December 2022 and retires in December 2026: throughout that time the engine gets serviced, not replaced. A predictable calendar is what lets you budget instead of react.
If your website is on Drupal 10, this is your job before 9 December. Changing versions isn’t rebuilding the website, but it isn’t a click either: count on a review of modules and custom code, a testing window and a deployment with a rollback ready. If they sell it to you as a redesign, they’re selling you a car you don’t need. If they sell it to you as an afternoon’s work, they haven’t opened the bonnet.
Where we’re going, we do need roads (yes, this is still about websites)
The second reason the car falls short is that it puts all the weight on the mechanics, and half of the 2027 bill doesn’t come from the engine but from the environment. Anyone who lives in Barcelona or Madrid gets it without explanation: a car can run perfectly, pass its roadworthiness test and show off immaculate bodywork and, if it doesn’t have an environmental label, it can’t enter the Low Emission Zone from Monday to Friday, 7 am to 8 pm. Nothing has broken. The rules about where it can drive have changed, and the garage didn’t decide the rules.
The same happens with your website, and the calendar is packed. The European Accessibility Act has applied since 28 June 2025, and what it requires isn’t complied with once: every new version of the website can break what the previous one did well, so accessibility has to be checked with every release. Since 11 September 2026, the Cyber Resilience Act has required actively exploited vulnerabilities in products with digital elements to be reported within 24 hours, so “who finds out and who reports it” becomes a question that must have an answer. The NIS2 directive has still not been transposed in Spain, to the point that the European Commission referred the country to the EU Court of Justice on 8 July 2026; liability for an incident, on the other hand, exists even if the national law doesn’t. And on 12 January 2027 the Data Act bans cloud providers from charging for switching provider. A line that goes down, for a change, and one worth noting before renewing a three-year hosting contract.
None of those dates asks whether your website works. They ask where it can drive.
When it’s worth changing cars (yes, websites!)
And now what an agency that handles maintenance has an obligation to say, because maintaining isn’t always the answer. There are usually three signs that rebuilding works out cheaper than carrying on:
- The first is that the chassis won’t take the new engine: the website is on a version with no upgrade path, like those still on Drupal 7 almost two years after its end of life, and every patch is handcraft.
- The second is that you’ve already changed three engines. Each update has cost more than the last because the accumulated debt (undocumented custom code, abandoned modules, patches on top of patches) turns any change into an excavation.
- The third isn’t technical: the organisation has changed and what the website needs to do is no longer what it does.
In all three cases, carrying on maintaining is paying to keep something that no longer serves its purpose, and the right decision is the one that whoever charges for the maintenance likes least. Us included.
The model in six lines (for your websites’ sake)
If you have to defend the 2027 digital budget in front of whoever signs it off, these are the lines that should appear, each with its control question.
The six lines of a website that can't fail
Each line has a known cost; the missing one is the one you pay without choosing.
Security patches, dependencies, testing and restorable backups, on a weekly or monthly rhythm. Who reads the advisories and how quickly are they applied?
One every four years in Drupal if done soon after the new version comes out, on a known date. When is the next one due and what adaptations does it bring?
What each update costs extra because the previous one wasn't done properly. How much of the custom code is documented and which modules are abandoned?
Accessibility verified in every version, a change log, who reports an incident and how quickly. Which new rule affects us in 2027, and on what date?
The dates when the manufacturer stops fixing things: platform, language, database, server. Which is the nearest, and what is the plan for it?
What it costs to change provider, hosting or platform if needed. Do we have the code, the data, the access and the documentation to leave tomorrow?
If all six lines have a figure and a name next to them, you have a grown-up budget. If any of them is blank, the “doing nothing” line is already in there and, well, good luck with that.
Sources
- Drupal Association, Drupal core release schedule, drupal.org, 2026 — Drupal 10.0.0 released on 15 December 2022 and end of life on 9 December 2026, Drupal 12 in the week of 7 December, release cadence and security windows.
- The PHP Group, Supported versions, php.net, 2026 — end of security support for PHP 8.2 on 31 December 2026.
- European Union, Directive (EU) 2019/882 (European Accessibility Act), 2019 — applicable since 28 June 2025.
- European Union, Regulation (EU) 2024/2847 (Cyber Resilience Act), 2024 — Article 14 reporting obligations from 11 September 2026.
- European Commission, referral of Spain to the Court of Justice of the EU for failing to transpose the NIS2 directive, 8 July 2026.
- European Union, Regulation (EU) 2023/2854 (Data Act), Article 29 — ban on cloud switching charges from 12 January 2027.
- Barcelona City Council, regulations for the Rondes de Barcelona Low Emission Zone — restriction on vehicles without an environmental label from Monday to Friday, 7 am to 8 pm, in force since 2020.