What happened

GitHub announced three separate changes to Copilot’s policies and billing, all landing between September 1 and October 1, 2026.

The one worth reading closely first: no earlier than September 28, GitHub is replacing several separate Copilot policies with a single unified policy covering Copilot Chat on github.com, GitHub Mobile, and Cloud Agent (Copilot’s own version that runs coding tasks on GitHub’s servers instead of your machine). Under that policy, chat conversation history moves from being automatically deleted after 28 days to being kept for the lifetime of your GitHub account. The new policy turns on by default once it ships. GitHub says you can opt out, but opting out also turns off Copilot Chat entirely on github.com and GitHub Mobile.

Second, starting September 1, GitHub is reopening Copilot Business and Copilot Enterprise signups for customers who pay by credit card or PayPal, but with a catch: every new seat now requires payment upfront before the assigned person gets access. Starting October 1, that upfront-per-seat charge also applies to existing Business and Enterprise customers, billed at the start of each cycle. Listed prices aren’t changing, but revoking a seat still doesn’t get you a prorated refund (a partial refund adjusted for the time left in the billing period), and mid-cycle seat additions are still prorated the way they are today.

Third, also effective September 28, GitHub is changing the default effort level for its automated pull request review from “Lite” to “Balanced,” for every existing and new repository and organization. A pull request is a proposed code change waiting for review before it merges into the main codebase, and Copilot’s review agent can read and comment on that change automatically.

Why it matters

The retention change is the one that affects the most people, regardless of team size. Copilot Chat conversations routinely include real code, error messages, and sometimes secrets pasted in while debugging, like a stray API key or database password copied into a message to ask “why isn’t this working.” Today, that content clears out on its own after 28 days. Once the unified policy ships, it won’t clear out at all unless you actively delete it, and it will sit there for as long as your GitHub account exists.

GitHub does give you a way out, but it isn’t a simple checkbox. Opting out of the new retention policy also means losing Copilot Chat access on github.com and GitHub Mobile. That’s a real trade-off: keep indefinite retention of your chat history, or lose part of the product. There’s no announced middle option to keep the shorter deletion window while keeping Chat access on those surfaces.

The billing change matters if you’re the one managing seats on a Business or Enterprise plan. Paying upfront per seat, rather than at the next natural billing cycle, changes when money leaves your account, and because revoked seats aren’t refunded, assigning a seat to a short-term contractor and removing them a week later still costs you the full cycle.

The code review default matters if you lean on Copilot’s automated review to catch problems in pull requests before a human looks. “Balanced” reads more thoroughly than “Lite” by design, which likely means it surfaces more, but also takes longer and uses more of your usage allowance per review than the fast, shallow pass you’re getting today.

Who should care

Anyone who has ever pasted real code, an error message, or credentials into Copilot Chat on github.com or the mobile app should read the retention change carefully, independent of whether they manage a team plan. People who assign or remove Copilot Business or Enterprise seats need to plan around the new upfront charge before October 1. Teams that rely on Copilot’s default pull request review settings should expect reviews to behave differently after September 28.

What builders should do next

None of these three changes have shipped yet, so there’s no toggle to flip today. What you can do now: stop pasting real secrets, like API keys or passwords, into Copilot Chat messages, since anything you send after the unified policy ships will be retained indefinitely instead of clearing out in a month. When GitHub’s own settings page for the new policy appears, that’s the moment to actually weigh the retention-versus-access trade-off rather than accepting the default.

If you manage Copilot Business or Enterprise seats, audit your current seat assignments before October 1 and revoke anyone who no longer needs one. Trimming unused seats before the new upfront-per-cycle charge takes effect avoids paying for seats you’d otherwise let lapse unnoticed.

If your team depends on fast turnaround from Copilot’s automated pull request review, check your repository or organization’s Copilot code review effort setting before September 28 to confirm whether it’s about to move from “Lite” to “Balanced” by default, and decide deliberately whether that’s the trade-off you want between review depth and speed.

End of article