GitHub AI Scan for pull requests no longer requires CodeQL default setup on each repository. Existing organization or enterprise enablement now reaches all eligible repositories under the same permission hierarchy. The feature remains a public preview for organization-owned and personal repositories on github.com. It requires GitHub Advanced Security and does not support GitHub Enterprise Server.
GitHub makes AI Scan for pull requests generally available
2026-09-16Verified announcementTRIAL
GitHub made AI Scan for pull requests generally available. It scans changed code in languages and frameworks outside current CodeQL coverage, including PHP, Shell, Terraform HCL, Dockerfiles, JSP and Blazor. Findings are advisory: they cannot fail the code-scanning check or block a merge, and scans exclude forks and Dependabot pull requests. Public repositories can use it without a Copilot license; private and internal organization repositories require GitHub Code Security or Advanced Security and consume Code Security AI Credits.
Official · ReferenceAI Scan for pull requests generally availableReferencegithub.blog · 2026 09 16 code scanning ai scan no longer requires codeql default setup
Imported from the existing research archive. Migration preserves the recorded judgment and is not a fresh verification.
What this means for you
For AppSec teams, the scanner is now a supported production option with explicit billing and policy limits. GA does not make the model deterministic or independently validated, so rollout should track false positives, missed findings, credit use and reviewer load.
Evidence & related material
GitHub made AI Scan GA; findings cannot block merges, public repositories are eligible, and private use requires Code Security plus AI Credits.
Subsequent changes
AI Scan reaches GA with explicit billing and merge-control limits
Technical details & scores
| Status | generally available |
|---|---|
| Scope | organization-owned and personal repositories on github.com |
| Requirement Removed | CodeQL default setup per repository |
| Requirements | GitHub Advanced Security plus code scanning and AI Scan enabled by repository, organization or enterprise policy |
| Unsupported | GitHub Enterprise Server |
| Coverage | pull-request changes beyond current CodeQL language and framework coverage |
| Enforcement | advisory only; cannot fail checks or block merges |
| Exclusions | fork and Dependabot pull requests |
| Billing | Code Security AI Credits; public repositories eligible; private/internal organization repositories require Code Security or Advanced Security |
Technical impact 3
Engineering value 4
Adoption signal 4
Maturity 2
Verification cost 2
Risk 3