Copilot Code Review Bills the Pull Request Author

Most teams enabled Copilot code review when it was a flat-rate feature and have not looked at the setting since. It is now a per-review charge with a default that quintupled the documented estimate, an attribution rule most reviewers do not know exists, and a hard stop at the budget line. Worth twenty minutes of your attention this week.

The default moved before the controls arrived

The sequence matters, so here it is in order. GitHub announced the new default effort level on 28 August 2026 and it took effect on 28 September. The 2 October changelog restates it flatly: "Balanced is also now the default review effort level", alongside support for requesting a review and setting its effort level through the REST and GraphQL APIs. If you had explicitly selected Lite, that choice "was respected" — the change caught repositories sitting on Default, which is most of them.

On 8 October, GitHub shipped two new administrative controls: a setting that decides whether a licensed member’s reviews are billed to the member or to the organization, and a setting that restricts who can trigger a review at all. In other words, the controls for containing the spend landed ten days after the spend per review went up. If your October invoice looks strange, that gap is why.

What a review costs, in GitHub’s own numbers

GitHub’s billing documentation is unusually direct about this: "Each time Copilot reviews a pull request or reviews code in your IDE, the interaction consumes AI credits." It then publishes estimate bands per effort level.

Effort level	Documented estimate per review	Status
Lite	$0.05 to $1 of AI credits	Must now be selected explicitly
Balanced	$0.25 to $5 of AI credits	The default

Run the arithmetic on those two published bands and both ends are five times higher. GitHub does not describe the change as a price increase and the credits-per-review figure is an estimate, not a tariff, but the only number a finance team can plan against moved by a factor of five with no action on your part.

Two multipliers sit on top. Costs "generally increase with pull request size and repository custom instructions" — so the repository custom instructions your team iterated on all summer are now a line item on every review. And GitHub Actions minutes are billed separately, so an automated review that runs in a workflow is charged twice over, in different units.

The meter runs against the author, not the reviewer

This is the part worth repeating in your team channel. For an automatic review, the docs say "AI credits consumption is attributed to the pull request author." If a human asks for the review manually, "consumption is attributed to that user instead."

So a repository with automatic reviews turned on charges every contributor for the privilege of being reviewed, and a reviewer who clicks the button pays for their own second opinion. Nobody is doing anything wrong; the incentive is simply pointed the wrong way. The first person to notice will be whoever opens the most pull requests, which in a lot of repositories is now an agent rather than a person. Attribution in the usage dashboards is its own problem — we covered the agent undercount in Copilot usage metrics last week — so do not assume the reports will show you cleanly where the spend went.

The 8 October setting, "Choose how members with a Copilot license are billed", lives under organization settings in Copilot > Policies and takes two values:

Value	What it does	Requirement
Member (default)	Reviews draw on the member’s own Copilot entitlement; exhausted quota means the review fails	None
Organization	Billed to the organization that owns the repository; member quotas untouched; budget optional	AI credits paid usage enabled

Note what the setting does not do: GitHub states it changes only who pays, not who has access. And read the two sources together, because they are not phrased the same way. The changelog frames the default as the member; the documentation frames it as the pull request author for automatic reviews and the requester for manual ones. Those coincide right up until the author is not the person who turned the feature on.

At the limit, the review is blocked — not downgraded

There is no automatic fallback from Balanced to Lite when credits run thin. When the user is billed, "code reviews are blocked when the user reaches their budget." When the organization is billed, reviews stop once the relevant organization, cost center or enterprise limit is reached. Code review is blocked alongside the other AI-credit features, so this arrives as a cluster of failures rather than one.

Picture the last week of a sprint that is also the last week of a billing period. Reviews start failing for your most active contributors first, because consumption is attributed to them, so the people whose pull requests still get reviewed are the ones who ship least. A review wired into a required check becomes a merge blocker for exactly the wrong half of the team.

Unlicensed and Free-plan users are a separate case: they get no monthly AI credit allowance for code review, their usage is billed to the organization or enterprise as additional usage, and those credits "are not attributed to any individual user’s budget." Useful if you want outside contributors reviewed; invisible in per-user reporting if you do not.

The other new control is about licences, not money

The second 8 October setting, "Only allow Copilot code review to be triggered by authorized users", restricts review requests to people holding a Copilot licence from your organization or enterprise. Switched on, unauthorized people are not offered Copilot as a reviewer and their API review requests do not start a review; in personal repositories only the owner or a direct collaborator can request one. Organization owners and repository admins can both enable it, and if an owner sets it at the organization level, repository admins cannot turn it off.

One gap deserves naming. Personal automatic-review settings do not run for unauthorized people, but automatic reviews configured through rulesets still run. So the control stops individuals from pulling in a review on their own licence while leaving the organization’s own automation untouched — sensible, but it means enabling this setting is not a spend cap. Pair it with the budget, or it only changes who is allowed to spend.

Four places the effort level can be set

Effort level is configurable at enterprise (AI controls > Agents > Copilot code review), organization (Copilot > Code review), repository (Copilot > Code review) and personal level, and GitHub’s rule is one sentence: "Each level can override the one above it." Read that carefully — the most specific scope wins, so an enterprise standard of Lite is a default, not a ceiling, and any repository admin can opt back up to Balanced.

With API-level effort selection now available, a workflow can choose the expensive tier per request. That is the right design for a reviewer and an awkward one for a budget owner.

What to do this week

Four concrete steps, in order. Check which effort level your busiest repositories are actually on, since Default now means Balanced. Decide deliberately between member and organization billing, and if you choose organization, set the optional budget at the same time rather than later. Look at your repository custom instructions as a cost input, not just a quality one. And if automatic reviews gate a required check, confirm what that check does when a review is blocked for lack of credits.

The broader pattern is the one to internalise: AI review is now metered infrastructure with a per-event price, and it is landing in the same quarter as metered sandboxes and metered agents. We have written about the adjacent cases in local Copilot sandboxing and local models that still phone home. If you are shopping for alternatives, the AI tools and platforms category and our 2026 AI tools roundup are the places to start, and the method in how to compare developer tools applies directly: price the unit, not the subscription.

FAQ

Did Copilot code review get more expensive on 28 September?

The default effort level became Balanced on that date, and GitHub’s documented estimate for a Balanced review is $0.25 to $5 of AI credits against $0.05 to $1 for Lite. GitHub has not called this a price change, and the figures are published as estimates that vary with pull request size. But if your repositories were on Default, the expected cost per review went up without any action from you.

Who pays for an automatic review?

By default the pull request author, per GitHub’s billing docs. A manually requested review is attributed to the person who requested it. An organization owner can switch licensed members over to organization billing, which requires AI credits paid usage to be enabled for that organization.

Does a review fall back to Lite when my credits run out?

No. The documented behaviour is that code review is blocked when the applicable budget is reached, and it is blocked together with the other AI-credit features. Plan for a hard stop, not a degraded review.

Will restricting triggers to authorized users cap my spend?

Only partly. It stops people using an outside licence, such as a personal one, to request reviews, and it blocks their API requests and personal automatic-review settings. Automatic reviews configured through rulesets still run, so the organization’s own automation keeps spending. Use a budget for the cap.

Can I force Lite across an enterprise?

You can set it at the enterprise level, but GitHub states that each level can override the one above it, so organizations, repositories and individuals can move back up. Treat an enterprise setting as the default everyone inherits until they change it, and audit the repositories that matter.

---

A code review that fails because the author ran out of credits is not a review process. Pick the billing mode on purpose.