AI code review is generally available from Anthropic and GitHub: the bill and the data terms

On 15 October 2026 Anthropic announced that Code Review, a Claude Code feature, is generally available after a research preview, for Team and Enterprise organisations. Several agents read each pull request alongside the surrounding code, a verification step checks the candidate findings, and the rest are posted as inline comments ranked by severity, with a summary and a check run. Anthropic says most reviews now finish about three times faster than in the preview, in 6 to 10 minutes rather than roughly 20.

There is no flat price per review. Reviews are billed on token usage through usage credits, separately from the plan's included usage, and charged to the organisation rather than the developer. The cost of each review depends on the review level (Quick, Standard or Deep, set per repository), the size of the change and how much needs checking. A repository added from the admin page starts at After every push, the setting that runs the most reviews. An organisation can set a monthly spend limit for the service; when it runs out, reviews are skipped and the pull request gets a comment saying why. Covering a whole GitHub organisation at once requires a spend limit to be set.

Anthropic is offering eligible Claude Enterprise organisations at least $10,000 in Code Review credits, to be claimed by 15 January 2027. The credits expire 30 days after they are claimed, and terms apply.

The documentation sets out who cannot use it. Code Review is not available to organisations with zero data retention enabled or the HIPAA configuration applied, is not covered by Anthropic's Business Associate Agreement, and is not yet available to organisations using customer-managed encryption keys. It works with repositories on GitHub, including GitHub Enterprise Server and GitHub Enterprise Cloud with data residency. Reviews run on Anthropic infrastructure, and costs appear on the Anthropic bill even where the organisation uses Claude Code through Amazon Bedrock, Google Cloud or Microsoft Foundry.

The default is the expensive setting. A repository starts on review after every push, so each push to an open pull request starts another review. Anthropic's own advice is a pilot on a few repositories set to review once per pull request or on request, then multiplying the average cost per review by the monthly volume of pull requests. That pilot is likely the only way to give finance a number before a wide rollout.

The data terms decide eligibility before cost does. A regulated organisation that has negotiated zero data retention, signed a Business Associate Agreement or holds its own encryption keys cannot switch this on today. For those buyers, the routes that remain are Claude in their own CI pipeline with an API key or cloud credentials, or the reviewer a developer runs inside a Claude Code session.

Billing can split from the rest of the estate. An enterprise buying Claude Code through a cloud provider to draw down a committed spend will see Code Review on a separate Anthropic bill, which procurement may need to approve as a new supplier line.

On 15 October 2026 GitHub made AI Scan for pull requests generally available. It looks for vulnerabilities in pull request changes in languages and frameworks that its CodeQL scanner does not currently support, naming PHP, Shell and Bash, Terraform, Dockerfiles, JSP for Java and Blazor for C#. Findings are advisory: they do not fail the code scanning check or block merges through rulesets. It does not run on pull requests from forks or from Dependabot. It is available on public repositories; private and internal organisation repositories need GitHub Code Security or GitHub Advanced Security, and no Copilot licence is required. Usage consumes Code Security AI credits, which can be capped with budgets.

The same day GitHub made agentic autofix for code scanning alerts generally available. Copilot works on an alert across the codebase, proposes a fix, reruns CodeQL to check the alert is closed and opens a draft pull request explaining the change. It is for Code Security and Advanced Security customers on GitHub Enterprise Cloud, including the data residency option. It uses AI credits from the Code Security budget and GitHub Actions minutes, and needs a Copilot billing method. An enterprise administrator enables the policy, then organisation or repository administrators turn it on. It works only on alerts from the default branch, with up to 25 alerts in one pull request. Once enabled, the free Generate Fix option is replaced by an Assign to Copilot button.

GitHub also announced that Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra will be deprecated across Copilot on 16 November 2026. Enterprise and Business customers move to the replacements automatically unless an administrator has turned off the global default or disabled the model.

AI Scan fills a known gap. Infrastructure code, shell scripts and container files are where many configuration and secret-handling mistakes live, and CodeQL did not read them. For a team already paying for Advanced Security, that coverage now arrives on the same bill, metered by AI credits rather than seats.

Agentic autofix changes the cost of a feature teams may already use. The free Generate Fix button goes once the policy is on, and fixes then draw AI credits and Actions minutes. Security leads will likely want a budget on the Code Security AI credit line before the policy is switched on, not after the first invoice.

The model deprecation is a change control point. Automatic replacement keeps work running, but a team that has validated its prompts or review rules against a specific model gets a different one on 16 November unless an administrator acts.