Summary

  • Organisations can enable Copilot code review for members without a licence. Their AI credits are billed directly to the organisation or enterprise as additional paid usage, outside individual budgets.
  • Rules can require reviews of new pushes and drafts regardless of a user's personal preferences. Setting that cadence also sets a recurring pattern of purchases.

The purchasing department can decline to issue a Copilot seat and still receive the bill for that person's code review. GitHub permits organisations to open the service to members without licences and pay their consumption directly. For an occasional contributor, that is useful hospitality. For the organisation, the guest list has outgrown the subscription count.

The purchase may also have happened long before anyone pressed a review button. A repository rule can ask Copilot to examine every new push. As a change is revised and resubmitted, the rule keeps commissioning work. What engineering records as a standard of care becomes a sequence of resource purchases. The machine is diligent. Its employer needs to know what diligence orders.

The company has a tab of its own

GitHub's product documentation requires two policies for members without licences: paid AI credits usage, followed by permission for those members to use code review. The second policy is off by default. Once enabled, their manual and automatic reviews are additional paid usage billed to the organisation or enterprise. They have no personal monthly allowance for this feature, and that consumption is not attributed to an individual budget.

Paid licence holders follow another route by default: their own entitlement. An organisation or enterprise owner can instead select organisation billing. Paid usage must be enabled; a budget is optional. Changing the payer does not itself grant access.

Access, payment and limitation therefore require separate decisions. A neat table of modest personal consumption can coexist with a busy organisational account. Each table is telling a different part of the story. Locking every employee's wallet does little to close the company's tab.

Default attribution also follows the request. An automatic review attributes AI consumption to the pull-request author. A different user who manually requests a review takes the attribution instead. For a pull request written by Copilot cloud agent, GitHub first looks to the associated human co-author, then bills the organisation if that person cannot be billed. Other bot authors and bot review requests lead directly to organisation billing.

A change can thus keep its purpose while changing its accounting address. A colleague asks for another look; a team hands a task to a bot. A ranking of prolific developers will not explain those purchases. The decision that summoned the reviewer matters as much as the name on the code.

“Every time” is a procurement instruction

The configuration guide provides options for reviewing new pushes and draft pull requests. Personal settings and repository or organisation rules are evaluated independently. Several configurations applying to the same event still produce one review. But a user's preference cannot turn off push or draft reviews imposed by a ruleset.

The repetition comes as work progresses: amend, push, revise, push again. A policy can commission another examination at each qualifying step. One pull request consequently tells the buyer little about how many reviews occurred inside it. The volume lives in the repeated work, not merely in the number of changes awaiting acceptance.

An early review may catch a defect before a colleague spends time on it. Rechecking every small adjustment may also buy reassurance with little fresh information. The person selecting the cadence is making that economic choice. Demanding greater care is especially easy when care sends its invoice to another meeting.

Depth has its own controls. An organisation can choose a default review effort that repositories may adjust, and a maximum they cannot exceed. The default expresses a habit; the maximum restricts the available order. A recommended menu is a curious substitute for a spending boundary.

The selected payer also determines which applicable budget can interrupt the service. With user billing, exhaustion of the user's budget blocks reviews. With organisation billing, the relevant organisation, cost-centre or enterprise limit applies. Moving the bill can therefore move the point at which a financial constraint becomes a work stoppage.

Collective payment can improve the arrangement. A prolific contributor need not exhaust a personal allowance merely to satisfy a company requirement. But a shared service needs someone to explain its demand: which changes deserve another examination, who may widen the requirement, and what should keep receiving resources when the budget tightens.

The model needs a workshop

GitHub's 27 April 2026 announcement set 1 June as the start of consumption through both AI credits and GitHub Actions minutes. Model interaction is one component; execution for agentic context gathering and tool use is another. For private repositories using standard hosted execution, included compute usage and additional usage must be considered separately.

The runner documentation explains that disabling GitHub-hosted runners removes those agentic capabilities and produces a more limited review. Organisations can operate their own runners. The officially supported self-hosting route uses ARC-managed Ubuntu x64 runners and requires network controls.

Self-hosting consumes no Actions minutes, but gives the customer an operating job. A line removed from the supplier's invoice may reappear as machines, networking and maintenance elsewhere. A review that continues posting comments can also be working with less context. Price comparison needs an account of the service actually delivered.

The public documents contain no particular customer's run history, reconciled charges and useful findings; putting those records together would establish the value of its extra reviews. There is a simpler decision available already: show the complete consumption to the people who prescribe the cadence. They have the authority to commission the work. They should be able to recognise the order when it arrives in the accounts.