GitHub is changing when Copilot seats are charged, how long chat data can remain, and which code-review setting becomes the default. The model prices are not changing. The operating contract is.
GitHub’s August 28 notice bundles billing, retention and product-default changes into one calendar. New Copilot Business and Enterprise customers who pay by card or PayPal face the first change on September 1, 2026. Existing card and PayPal customers move to upfront seat billing on October 1. A separate set of product and policy changes begins September 28.
Three dates belong on the admin calendar
| Date | Who is affected | What changes |
|---|---|---|
| September 1 | New Business and Enterprise customers paying by card or PayPal | New seats are paid before access; self-service signup reopens. |
| September 28 | Organizations using Copilot policies and code review | Unified agent/chat policy is enabled by default; Balanced becomes the review default unless Lite is explicitly set. |
| October 1 | Existing Business and Enterprise customers paying by card or PayPal | Seat charges move to upfront billing. |
GitHub says Copilot prices are unchanged. The cash-flow timing is not. It also says a revoked seat will not receive a refund for the remaining period. That makes offboarding speed and seat reconciliation financially meaningful, even when the price per seat stays flat.
Upfront billing makes stale seats a direct cost
Under a pay-before-access model, an admin should not wait for the monthly invoice to discover abandoned seats. Reconcile the identity provider, GitHub organization membership and Copilot seat list before the billing date. Define who can assign a paid seat, who removes it, and how quickly a departure reaches GitHub.
- Export the current seat roster before the applicable change date.
- Match each seat to an active worker, team and cost center.
- Set an approval path for new assignments.
- Test the offboarding flow from the identity provider to Copilot.
- Record the billing term because a revoked seat is not refunded.
Enterprise agreement and invoiced customers should verify their own contract rather than assuming the card and PayPal schedule applies. GitHub’s announcement is specific about the affected payment route.
Chat retention moves from 28 days to account life
The more consequential governance change is retention. GitHub says Copilot Chat conversations will be retained for the life of the user’s account instead of the current 28-day window. The company says administrators will have ways to review and manage the data.
Longer retention can improve continuity and investigation, but it expands the period during which pasted secrets, customer data, proprietary code or sensitive incident details may exist. A 28-day assumption embedded in a data inventory, risk assessment or employee notice will become wrong.
Before September 28, ask which conversations admins can inspect, which users can delete, what happens after account closure, how legal holds interact with deletion, and whether regional or contractual restrictions alter the default. Do not describe the new policy to staff as ordinary editor history.
The unified policy widens an existing permission
GitHub previously announced that separate agent and chat controls would become a unified policy. The August 28 notice says that policy will be enabled by default for current Business and Enterprise customers on September 28, unless an administrator disables it.
A unified switch is easier to administer, but it can also authorize more than a team expected if its old review only considered chat. Inventory where Copilot can act, which repositories contain regulated or confidential material, and whether repository rules, branch protection and human approval still enforce the intended boundary. Our Copilot review-effort guide explains why an AI setting belongs in the risk record rather than being treated as a quality badge.
Balanced is a default, not an approval
GitHub says Copilot code review will default to Balanced on September 28 unless an organization explicitly selects Lite. Balanced uses a higher-reasoning model. That may improve review depth, but it does not certify a change or replace tests, code scanning and a reviewer who understands the repository.
Choose Lite for ordinary, familiar changes where speed and cost matter. Use Balanced where the failure radius is larger: authentication, authorization, migrations, shared libraries, infrastructure and security boundaries. Then measure accepted findings, false positives, latency and premium-request consumption on your own pull requests.
September 1 update: six Copilot model choices are leaving
GitHub’s scheduled September 1 deprecations have now reached their operational deadline. Across Copilot experiences, GitHub is removing Gemini 3.1 Pro, Claude Opus 4.5, Claude Opus 4.6, Claude Sonnet 4.5, Claude Sonnet 4.6, and Raptor Mini. GitHub lists an exception for Claude Sonnet 4.6 for individual annual subscribers.
| Deprecated model | Suggested alternative | Admin check |
|---|---|---|
| Gemini 3.1 Pro | Gemini 3.7 Pro | Enable the replacement model policy before team migration |
| Claude Opus 4.5 or 4.6 | Claude Opus 5 | Confirm cost and task routing for high-reasoning work |
| Claude Sonnet 4.5 or 4.6 | Claude Sonnet 5 | Retest repository instructions, tools, and review behavior |
| Raptor Mini | A currently supported lightweight model | Choose by task, latency, and policy rather than name similarity |
Do not treat the replacement list as a drop-in guarantee. Run a small regression set covering code completion, pull-request review, repository instructions, tool calls, secrets handling, and refusal behavior. Save the selected model and result with each test so a future removal does not erase the baseline.
- Export current organization and repository model policies.
- Enable only the replacement models teams are permitted to use.
- Rerun five representative tasks per model and repository type.
- Compare output quality, latency, premium-request use, and human correction time.
- Update internal documentation and remove deprecated model names from templates.
Read GitHub’s official deprecation notice. For a deeper review of model assignment and effort levels, see our Copilot review-effort and agent-usage guide.
September 3 update: content exclusions reach the Copilot app and CLI
GitHub says the Copilot app and Copilot CLI now respect content-exclusion policies configured by enterprise, organization, and repository administrators. The change became generally available on September 2 for Copilot Business and Enterprise customers.
The practical gain is wider policy coverage. An excluded file should not be used as context in these agentic surfaces. That is not the same as removing read permission, encrypting the file, or preventing every GitHub feature and third-party tool from seeing it. Treat content exclusion as a context-use rule inside supported Copilot experiences.
- Create a harmless canary file under an excluded path.
- Ask the Copilot app and CLI for details that only appear in that file.
- Repeat from a repository, organization, and enterprise policy scope.
- Confirm the denial in each supported surface and record the date.
- Keep repository permissions and secret scanning as separate controls.
Read GitHub’s content-exclusion release notice and pair the policy check with the Copilot model migration checklist.
My verdict: treat this as a control migration
After the change, capture screenshots or exports showing the organization policy, repository overrides, retention setting and seat roster. Re-run the same review-effort test on a known pull request and confirm that deprovisioning removes access without leaving an unexpected paid assignment. That evidence turns a one-day settings change into a repeatable control.
Include finance in the verification. Compare the expected seat count with the first invoice under the new timing, investigate every mismatch, and keep the account-specific contract beside the public announcement. A documented reconciliation will matter more than remembering that GitHub said prices were unchanged.
The headline is not a price increase. It is a shift in payment timing, refund exposure, data duration and default permissions. Assign one owner across procurement, security and engineering. Capture the before state, make explicit choices before the dates arrive, and verify the result after the rollout.
The same lesson appears in our AI agent containment review: written intent is weak when infrastructure and defaults enforce something else.
Read the primary notice
- Read GitHub’s Copilot policies and billing announcement.
- Review GitHub’s linked documentation for your plan and payment route before changing contracts or retention notices.
Checked August 29, 2026. Dates, retention language, default-policy behavior, billing timing and refund treatment come from GitHub. Operational recommendations are Musthave.ai analysis.
September 13 update: VS Code Agents gets dedicated usage metrics
GitHub added generally available VS Code Agents fields to Copilot usage reports on September 11, 2026. One-day and 28-day aggregate reports can now include daily_active_vscode_agent_users plus totals_by_vscode_agent values for session count and total user messages. User-level reports can include used_vscode_agent and the same per-user totals.
The fields cover only the dedicated VS Code Agents window. They exclude editor-window Agent Mode and remain separate from generic usage rollups. Missing optional data can appear as absent or null. GitHub says access requires the metrics policy plus an owner, billing manager or custom role with permission to view Copilot metrics. For the product-side change, read our analysis of Copilot code review running builds and tests.
