AI code scanning: preview conditions and later general availability
The news at the time
At preview launch, GitHub described AI detections on pull requests as extending language and framework coverage beyond CodeQL. Enterprise permission, organization enablement and repository CodeQL default analysis were required even though a separate AI engine performed the analysis.
The preview findings were informational and did not block merges. The announcement required a Copilot license and consumed organization AI credits during public preview, so the original feature was neither an automatic approval gate nor an unconditional free service.
Follow-up checked during renewal
GitHub’s 2026-10-15 notice announces AI Scan general availability. It says a Copilot license is not required; private and internal organization repositories still require GitHub Code Security or Advanced Security. These conditions differ from the preview announcement.
The later notice retains advisory-only findings and says AI Scan cannot block merges through rulesets. It does not run on fork pull requests or pull requests created by Dependabot.
The later billing model consumes Code Security AI Credits, displayed under Advanced Security in enterprise AI usage. The absence of a Copilot-license requirement does not mean scanning has no usage charge.
What to review before applying this
Use the later notice for current eligibility and billing interpretation, while retaining the preview conditions as history. Advisory findings need a human response and do not replace required checks or comprehensive security validation.
Editorial review suggestions; no hands-on product experiment was performed.
Claim-by-claim source evidence
At preview launch, GitHub described AI detections on pull requests as extending language and framework coverage beyond CodeQL. Enterprise permission, organization enablement and repository CodeQL default analysis were required even though a separate AI engine performed the analysis.
AI security detections must be allowed by your Enterprise policy and enabled at the organization level.
Evidence source ↗
While CodeQL is not the tool performing the AI analysis, the AI detection engine relies on it to function.
Evidence source ↗
The preview findings were informational and did not block merges. The announcement required a Copilot license and consumed organization AI credits during public preview, so the original feature was neither an automatic approval gate nor an unconditional free service.
These findings are informational and won’t block pull request merges.
Evidence source ↗
During public preview, AI security detections require a GitHub Copilot license and draw down your organization’s AI credits.
Evidence source ↗
GitHub’s 2026-10-15 notice announces AI Scan general availability. It says a Copilot license is not required; private and internal organization repositories still require GitHub Code Security or Advanced Security. These conditions differ from the preview announcement.
Code scanning AI Scan for pull requests is now generally available.
Evidence source ↗
A GitHub Copilot license is not required.
Evidence source ↗
For private and internal organization-owned repositories, GitHub Code Security or GitHub Advanced Security is required.
Evidence source ↗
The later notice retains advisory-only findings and says AI Scan cannot block merges through rulesets. It does not run on fork pull requests or pull requests created by Dependabot.
They do not fail the code scanning check and cannot block pull request merges through ruleset requirements.
Evidence source ↗
AI Scan does not run on pull requests from forks or pull requests created by Dependabot.
Evidence source ↗
The later billing model consumes Code Security AI Credits, displayed under Advanced Security in enterprise AI usage. The absence of a Copilot-license requirement does not mean scanning has no usage charge.
AI Scan for pull requests consumes Code Security AI Credits.
Evidence source ↗
Korean digest for the historical date: 2026-07-15. Quotations and source context were reviewed editorially; this is not an independent experimental verification.
Discussion