GitHub announced on 6 November 2026 that Copilot code review can now be managed through its REST and GraphQL APIs, from enterprise policy down to individual repositories. The same update shows how much effort, and how many AI credits, each AI review used.
What the changelog says
- Settings by API. Enterprise admins can switch code review on or off for every organisation, or leave the choice to organisation admins. Organisation admins set the default review effort. Repository admins set effort and whether reviews use custom instructions and MCP tools.
- Attribution. Reviews and comments carry explicit fields saying they came from Copilot, and show the review effort used, plus the skills, MCP servers and custom instructions Copilot reported as sources for a comment.
- Cost visibility. Code review agent sessions now show the AI credits a review consumed.
- Plans. Copilot Pro, Pro+, Max, Business and Enterprise.
- Smaller changes. A bypass list for the “automatically request Copilot code review” rule, failed or timed-out reviews retried once, and “Balanced” effort reviews using three reviewer models with another model combining their findings.
The interpretation
AI review of code is being treated like any other managed business tool: it has policy, an audit trail, a cost and an off switch. That matters because the question buyers are starting to ask has moved from “do you use AI?” to “can you show me how it is controlled?”
So what
If a supplier says AI reviews the code you are paying for, ask three things. Who decides how thorough that review is? Can you see which reviews were done by AI and which by a person? And is the AI spend visible, or buried in their rate? Good answers name a policy, an audit trail and a human sign-off before release. BuildApps combines AI-assisted workflows with human review. See AI-assisted development, custom software development, or start a project.