Your organization's silence now carries a price tag. Starting October 22, GitHub reads "Unconfigured" as "yes" and flips Copilot features on by default.
On September 24 GitHub announced a new global default policy for Copilot Business and Enterprise. From October 22, every GA Copilot feature an administrator has left "Unconfigured" follows the global default — and if the organization never sets one, features switch on by themselves. Admins get exactly 28 days to decide. The policy reaches beyond the "Features & clients" page to cover Copilot Code Review and MCP server access. Three options: Enabled, Disabled, and "Let organizations decide." Explicit choices are preserved; preview features stay opt-in. New models already run on this logic: GPT-6 Sol and Luna enable themselves unless the global default is switched off, and they are billed as premium requests. Which means spend can grow without a single decision ever being made inside your company.
A new AI feature used to wait for an explicit "yes" from the organization. Now silence means consent. Let me call the thing by its name: a silent default is still a management decision — just one somebody else made for you. And like every decision, it comes with a budget line and an audit trail. For companies carrying EU AI Act obligations (deadline December 2, 2026), "an MCP server that enabled itself" is an audit event, not a footnote in a changelog.
What this means for a lead. Four calendar entries before October 22. Inventory: every feature sitting in "Unconfigured" is a decision you have already outsourced to the vendor. An explicit MCP server policy, set before the first auto-enablement, not after. Premium request limits agreed with finance: spend nobody approved still lands on somebody's invoice. And a named owner of the AI Controls page — a page with no owner configures itself. How to govern the LLM tools themselves is the neighboring domain, kept by the Magister of the Machine Mind; here the question is who decides, and when.
Now the contentious part, said out loud. Is default-on the mark of a mature platform, or a transfer of responsibility from vendor to customer? My yardstick: a platform is entitled to propose defaults, but the price of silence is always billed to the one who stayed silent. You have 28 days to make sure the decision remains yours.
📎 github.blog/changelog/2026-09-24-default-enablement-of-copilot-features-for-copilot-business-and-enterprise · github.blog/changelog/2026-09-22-openais-gpt-6-sol-and-gpt-6-luna-now-available