Two GitHub Copilot Defaults Your Legal Team Hasn't Seen

On September 28, 2026, GitHub will silently change two Copilot behaviors that most engineering teams have never explicitly configured: chat data retention moves from 28 days to the life of the account, and code review defaults from Lite to Balanced. Neither change requires any action from users to take effect. Both require action to prevent.

The Retention Change Is a Compliance Event, Not a Feature#

Copilot Chat on github.com and in GitHub Mobile currently retains conversation data for 28 days. GitHub's cloud agent, a separate surface, already retains data indefinitely. The September 28 unification merges all three surfaces into a single product under a single policy, and that policy adopts the cloud agent standard: lifetime retention.

For individual contributors, this is a product improvement. Longer history means better context across sessions. For enterprises under GDPR, HIPAA, SOC 2, or any framework with data minimization requirements, it is a material change to an approved data processing arrangement. Legal and privacy teams who approved Copilot under a 28-day retention assumption now have a different product. They may not know that yet.

The opt-out is structurally punishing. Disabling the unified experience removes Copilot access from github.com and GitHub Mobile entirely. There is no partial configuration that keeps the shorter retention window while preserving chat access. That asymmetry is worth stating directly: an organization cannot preserve its previous data posture without sacrificing the tool's web and mobile presence.

The Balanced Default Is a Silent Budget Increase#

The second change is less dramatic but touches every team running automated PR reviews. The current default effort level for Copilot code review is Lite. Quick analysis, lighter model, lower credit consumption. Starting September 28, the default becomes Balanced.

Balanced reviews use a higher-reasoning model and analyze full repository context rather than just the diff. According to the GitHub changelog, the shift applies to any repository or organization whose effort level is currently set to Default. Repositories with an explicit Lite selection are unaffected. But most organizations have never touched that setting, because Lite was the default and nobody had a reason to confirm it.

The practical consequence: every automated review on every unexamined repository gets more expensive on September 28. GitHub Actions jobs run longer. Credits drain faster. And Copilot Business credits dropped 37% on September 1, from 3,000 to 1,900 per user per month, with Enterprise dropping 44%, from 7,000 to 3,900, when promotional allowances expired. Teams entering October on tighter credit budgets will immediately encounter heavier per-review consumption, without ever making a deliberate choice.

Why Vendor Defaults Are a Governance Surface#

Both changes expose something that has become structurally true of AI coding tooling in 2026: the vendor's default configuration is now a compliance and cost decision that the vendor makes on the customer's behalf, unless the customer explicitly intervenes.

Governance frameworks assume that data retention periods are known quantities, documented, and approved. A tool update that changes those periods without requiring affirmative consent from the data controller is not a UI change , it is a modification to the underlying data arrangement. The fact that GitHub published it in a changelog is not equivalent to the customer organization reviewing and approving the change. Those are different processes. Engineering leaders who treat changelog entries as sufficient governance documentation are one audit finding away from discovering the gap.

The same logic applies to cost controls. A default that increases credit consumption per review, applied across an entire organization's pull request volume, is a budget decision. It should be made by someone with budget authority, not inherited from a vendor setting.

Hyrax's review layer maintains its own audit trail, independent of the vendor's log retention policy. That separation matters precisely because vendor-side defaults can shift. The review record is the engineering team's record, not the platform's.

What to Configure Before September 28#

The deadline is firm. Here is what needs to happen, organized by owner.

Admins, before September 28:

Navigate to organization settings, then Copilot, then Copilot code review. Set the effort level explicitly to Lite if the current credit budget was sized for Lite. Every repository without an explicit setting will inherit Balanced automatically. Repository-level overrides are available for teams that want Balanced on sensitive paths and Lite on routine changes, but they require per-repo configuration.

For the chat policy, review the unified Copilot experience setting before September 28. Confirm whether the new lifetime retention window is acceptable under existing data governance approvals, or escalate to legal before the deadline.

Legal and compliance, before September 28:

Review the official changelog against any existing data processing agreements, DPAs, or compliance attestations that reference Copilot's 28-day retention window. Determine whether the all-or-nothing opt-out is an acceptable trade-off or whether business units need to formally re-approve the tool under the new terms.

Finance, before October 1:

Upfront seat billing begins for existing Business and Enterprise customers on October 1. Seat assignments will require payment before users gain access, removing any provisional assignment window. Finance teams managing large seat counts need approval workflows updated before that date.

The Deeper Pattern#

GitHub is not behaving unusually here. Vendors routinely update default configurations as products mature. What has changed is that AI coding tools now sit in the middle of data flows that compliance frameworks care about, handling conversations that contain code, architecture decisions, and debugging context that may include sensitive business logic.

The governance assumption that these tools are ephemeral utilities with short data windows is now factually incorrect for Copilot users who do not act before September 28. Default-by-inaction is still a decision. It just happens to be the vendor's.

Hyrax is live at hyrax.dev.