GitHub Copilot Enterprise Risk Assessment | AI Tool Risk

Back to AI Tools

GitHub Copilot

Risk Overview

Moderate Risk

3.7

/10

Code Generation

Code Completion

Top Risks

Copilot Coding Agent accesses code repositories and executes code changes autonomously. Active class action lawsuit over open-source training data. Individual plan training opt-in by default. Session logs for Coding Agent retained for life of account. Open-source license reproduction risk in suggestions.

Mitigations

Use Business or Enterprise plan for stronger training/retention protections. Configure content exclusions via .copilotignore and repository settings. Opt out of training for individual plans in settings. Review IP indemnification coverage carefully. Monitor Doe v. GitHub litigation developments.

Get started

Is your team using

GitHub Copilot

safely?

Book a Demo Free Assessment

Highest Risk Categories

The highest-scoring risk categories identified in this assessment.

Legal Terms

GitHub ToS includes binding arbitration and class action waiver. Active class action litigation (Doe v. GitHub) ongoing regarding open-source code training. IP indemnification offered for Business/Enterprise paying customers covering Copilot suggestions. Pending litigation is a material legal risk.

/10

Training Use

Individual Free/Pro users: GitHub may train on inputs/outputs unless user opts out in settings. Business/Enterprise customers: contracts prohibit use of Copilot interaction data for model training—effectively opt-out by default for enterprise. Prompt data discarded once suggestion returned for Business/Enterprise.

/10

Data Retention

Business/Enterprise: prompts discarded once suggestion returned; user engagement data kept 24 months. Individual plans: prompts and suggestions kept 28 days; engagement data 2 years. Copilot Coding Agent session logs kept for life of account.

/10