Safeguard
Research•

What happens when your Copilot credits run out?

GitHub's published rules for Copilot AI credits, fetched 18 October 2026: plan allowances, what happens at the limit, and how admins control extra spend.

Safeguard Security Team
4 min read

According to GitHub's documentation, when included Copilot AI credits run out, you either pay for additional usage or wait for the monthly reset. Individuals can pay extra to keep working. In organizations, extra usage is enabled by default unless an admin turns it off, and if it is off, usage is blocked until the next billing cycle.

Everything here comes from GitHub's Copilot billing documentation, fetched on 18 October 2026. Plans and terms change, so confirm on the pages listed under Sources. We make no claim about what GitHub spends to serve requests.

What do the plans include?

The individual plans page lists these monthly AI credit allowances:

  • Copilot Free and Student: an allowance, amount not stated on the page.
  • Copilot Pro, $10 a month: 1,500 credits, described as 1,000 base plus 500 flex.
  • Copilot Pro+, $39 a month: 7,000 credits.
  • Copilot Max, $100 a month: 20,000 credits.

For organizations, Copilot Business is $19 per granted seat per month with 1,900 credits per user, and Copilot Enterprise is $39 with 3,900 per user. Free and Student use automatic model selection only.

What happens to an individual at the limit?

The individual billing page says you can pay extra to keep working. You set a dollar budget for additional usage, and each AI credit costs $0.01, so a $10 budget covers 1,000 credits. Additional usage may be capped, and after a cap you must pay off the usage already incurred before continuing.

The page does not describe an automatic switch to a cheaper model. It notes that choosing a less expensive model yourself can stretch your allowance. Your allowance resets in full at 00:00 UTC on the first day of each calendar month, and unused credits do not carry over. You can also upgrade, paying the price difference, and Copilot prompts you as you approach the limit.

What happens in a team or enterprise?

Credits are pooled per billing entity. The pool resets at 00:00 UTC on the first of the month, with no carryover. After the pool is empty:

  • If additional usage is allowed, work continues at published per-credit rates and the organization is charged. This setting is enabled by default.
  • If it is not allowed, usage is blocked until the next billing cycle.
  • A user budget covers both the pool and extra usage. A user who exhausts it loses Copilot access even if the pool has credits left, and a budget of zero blocks the user right away.
  • Budgets are in US dollars, and $1 covers 100 AI credits.

The page says there is no automatic switch to cheaper models when a budget runs out. Admins set the policy in AI Controls settings and can disable the paid usage policy to stop any spending beyond included credits.

What does that mean for planning?

The surprise cases are the defaults. An org that never touched the setting can pay for extra usage without a conscious decision, and a heavy user can burn a pool that others expected to share. Both are easy to prevent with a decision made in advance.

What to do

  1. Open the Copilot billing settings for your org and read the additional usage policy.
  2. Decide on purpose: allow it with a cap, or disable it and accept blocks.
  3. Set user and cost center budgets in dollars, using $1 for 100 credits.
  4. Tell your developers what happens at the limit so a block is not a mystery.
  5. Review usage monthly, since credits reset on the first at 00:00 UTC.

Quick check

Do unused credits roll over?

No. The documentation says unused included credits do not carry over after the monthly reset.

Will Copilot switch to a cheaper model when credits run out?

The pages we read say there is no automatic switch for budgets, and the individual page does not describe a fallback. Check the current docs.

Sources

Last reviewed: 18 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.