GitHub is changing when it charges for Copilot seats, how long chat data can remain, and which code-review setting becomes the default. The model prices are not changing. The operating contract is.
GitHub’s August 28 notice bundles billing, retention, and product-default changes into one calendar. New Copilot Business and Enterprise customers who pay by card or PayPal face the first change on September 1, 2026. Existing card and PayPal customers move to upfront seat billing on October 1. A separate set of product and policy changes begins September 28.
Three dates belong on the admin calendar
| Date | Who is affected | What changes |
|---|---|---|
| September 1 | New Business and Enterprise customers paying by card or PayPal | New seats are paid before access; self-service signup reopens. |
| September 28 | Organizations using Copilot policies and code review | Unified agent/chat policy is enabled by default; Balanced becomes the review default unless Lite is explicitly set. |
| October 1 | Existing Business and Enterprise customers paying by card or PayPal | Seat charges move to upfront billing. |
GitHub says Copilot prices are unchanged. The cash-flow timing is not. It also says a revoked seat will not receive a refund for the remaining period. That makes offboarding speed and seat reconciliation financially meaningful, even when the per-seat price stays flat.
Upfront billing makes stale seats a direct cost.
Under a pay-before-access model, an admin should not wait for the monthly invoice to discover abandoned seats. Reconcile the identity provider, GitHub organization membership, and Copilot seat list before the billing date. Define who can assign a paid seat, who removes it, and how quickly departures reach GitHub.
- Export the current seat roster before the applicable change date.
- Match each seat to an active worker, team, and cost center.
- Set an approval path for new assignments.
- Test the offboarding flow from the identity provider to Copilot.
- Record the billing term because a revoked seat is not refunded.
Enterprise agreement and invoiced customers should verify their own contract rather than assuming the card and PayPal schedule applies. GitHub’s announcement is specific about the affected payment route.
Chat retention moves from 28 days to the life of the account.
The more consequential governance change is retention. GitHub says Copilot Chat conversations will be retained for the life of the user’s account instead of the current 28-day window. The company says administrators will have ways to review and manage the data.
Longer retention can improve continuity and investigation, but it expands the period during which pasted secrets, customer data, proprietary code, or sensitive incident details may exist. A 28-day assumption embedded in a data inventory, risk assessment, or employee notice will become wrong.
Before September 28, ask which conversations admins can inspect, which users can delete, what happens after account closure, how legal holds interact with deletion, and whether regional or contractual restrictions alter the default. Do not describe the new policy to staff as ordinary editor history.
The unified policy widens an existing permission.
GitHub previously announced that separate agent and chat controls would become a unified policy. The August 28 notice says that policy will be enabled by default for current Business and Enterprise customers on September 28, unless an administrator turns it off.
A unified switch is easier to administer, but it can also authorize more than a team expected if its old review only considered chat. Inventory where Copilot can act, which repositories contain regulated or confidential material, and whether repository rules, branch protection, and human approval still enforce the intended boundary. Our Copilot review-effort guide explains why an AI setting belongs in the risk record rather than being treated as a quality badge.
Balanced is a default, not an approval
GitHub says Copilot code review will default to Balanced on September 28 unless an organization explicitly selects Lite. Balanced uses a higher-reasoning model. That may improve review depth, but it doesn’t certify a change or replace tests, code scanning, or a reviewer who understands the repository.
Choose Lite for ordinary, familiar changes where speed and cost matter. Use Balanced where the failure radius is larger: authentication, authorization, migrations, shared libraries, infrastructure and security boundaries. Then measure accepted findings, false positives, latency, and premium-request consumption on your own pull requests.
September 1 update: six Copilot model choices are leaving
GitHub’s scheduled September 1 deprecations have now reached their operational deadline. Across Copilot experiences, GitHub is removing Gemini 3.1 Pro, Claude Opus 4.5, Claude Opus 4.6, Claude Sonnet 4.5, Claude Sonnet 4.6, and Raptor Mini. GitHub lists an exception for Claude Sonnet 4.6 for individual annual subscribers.
| Deprecated model | Suggested alternative | Admin check |
|---|---|---|
| Gemini 3.1 Pro | Gemini 3.7 Pro | Enable the replacement model policy before team migration |
| Claude Opus 4.5 or 4.6 | Claude Opus 5 | Confirm cost and task routing for high-reasoning work |
| Claude Sonnet 4.5 or 4.6 | Claude Sonnet 5 | Retest repository instructions, tools, and review behavior |
| Raptor Mini | A currently supported lightweight model | Choose by task, latency, and policy rather than name similarity |
Do not treat the replacement list as a drop-in guarantee. Run a small regression set covering code completion, pull-request review, repository instructions, tool calls, secrets handling, and refusal behavior. Save the selected model and results with each test so a future removal doesn’t erase the baseline.
- Export current organization and repository model policies.
- Enable only the replacement models teams can use.
- Rerun five representative tasks per model and repository type.
- Compare output quality, latency, premium-request use, and human correction time.
- Update internal documentation and remove deprecated model names from templates.
Read GitHub’s official deprecation notice. For a deeper review of model assignment and effort levels, see our Copilot review-effort and agent-usage guide.
September 3 update: content exclusions reach the Copilot app and CLI
GitHub says the Copilot app and Copilot CLI now respect content-exclusion policies configured by enterprise, organization, and repository administrators. The change became generally available on September 2 for Copilot Business and Enterprise customers.
The practical gain is wider policy coverage. Do not use an excluded file as context in these agentic surfaces. That is not the same as removing read permission, encrypting the file, or preventing every GitHub feature and third-party tool from seeing it. Treat content exclusion as a context-use rule inside supported Copilot experiences.
- Create a harmless canary file under an excluded path.
- Ask the Copilot app and CLI for details that only appear in that file.
- Repeat for a repository, organization, and enterprise policy scope.
- Confirm the denial in each supported surface and record the date.
- Keep repository permissions and secret scanning as separate controls.
Read GitHub’s content-exclusion release notice and pair the policy check with the Copilot model migration checklist.
My verdict: treat this as a control migration
After the change, capture screenshots or exports showing the organization policy, repository overrides, retention setting, and seat roster. Re-run the review-effort test on a known pull request and confirm that deprovisioning removes access without leaving an unexpected paid assignment. That evidence turns a one-day settings change into a repeatable control.
Include finance in the verification. Compare the expected seat count with the first invoice under the new timing, investigate every mismatch, and keep the account-specific contract beside the public announcement. A documented reconciliation will matter more than remembering that GitHub said prices were unchanged.
The headline is not a price increase. It is a shift in payment timing, refund exposure, data duration, and default permissions. Assign one owner across procurement, security, and engineering. Capture the before state, make explicit choices before the dates arrive, and verify the result after the rollout.
The same lesson appears in our AI agent containment review: written intent is weak when infrastructure and defaults enforce something else.
Read the primary notice.
- Read GitHub’s Copilot policies and billing announcement.
- Review GitHub’s linked documentation for your plan and payment route before changing contracts or retention notices.
Checked August 29, 2026. GitHub provides dates, retention language, default-policy behavior, billing timing, and refund treatment. Operational recommendations are Musthave.ai analysis.
September 13 update: VS Code Agents gets dedicated usage metrics
GitHub added generally available VS Code Agents fields to Copilot usage reports on September 11, 2026. One-day and 28-day aggregate reports can now include daily_active_vscode_agent_users plus totals_by_vscode_agent values for session count and total user messages. User-level reports can include used_vscode_agent and the same per-user totals.
The fields cover only the dedicated VS Code Agents window. They exclude editor-window Agent Mode and remain separate from generic usage rollups. Missing optional data can appear as absent or null. GitHub says access requires the metrics policy plus an owner, billing manager, or custom role with permission to view Copilot metrics. For the product-side change, read our analysis of Copilot code review running builds and tests.
September 25 update: the October 22 feature-default deadline
GitHub has announced a separate default-availability policy for Copilot Business and Enterprise features. Administrators can configure the policy now. On October 22, generally available features without an explicit organization or enterprise decision will become enabled by default when the global policy is on. An admin’s explicit allow or block choice remains in force, and preview features still require an opt-in. This is about feature availability; it is not the already-active default-model policy discussed above.
The settings review should cover Features & clients, Copilot Code Review, and MCP servers in Copilot. Inventory the current explicit decisions first, then assign an owner to any feature left unconfigured. Teams that need a controlled rollout should choose their settings before October 22 rather than assuming silence means disabled. GitHub’s default-availability documentation explains the inheritance and override rules; check the live organization and enterprise settings against it before changing access.
September 29 update: Sonnet 5.5 model policy
GitHub added Claude Sonnet 5.5 to paid Copilot plans on September 28. The model-picker rollout is gradual, and Business and Enterprise administrators can manage access through Copilot model policy. GitHub lists the model under usage-based, per-token pricing. Verify the model policy and credits for your organization before asking teams to switch; this model rollout is separate from the seat-billing, retention and feature-default changes above. Our Sonnet 5.5 and Copilot guide covers the availability and cost checks.
