One-Tool Verdict —
GitHub Copilot Business

The money, named

What you pay:

40 seats x $19/seat/month x 12 months  =  $9,120 / year

What it has to beat.At a fully-loaded cost of ~$180,000 per engineer (salary, tax, benefits, equipment — swap in your real number), your 40-engineer org costs $7.2M/year. The Copilot line is 0.127% of engineering payroll.

Break-even, per engineer:

$9,120 / 40 engineers            =  $228 per engineer per year
$228 / $90/hour (=$180k / 2,000) =  2.5 hours per engineer per year

Copilot pays for itself if it saves each engineer about 38 minutes per quarter.

That is a very low bar. No credible study — including the ones most hostile to AI coding tools — claims the effect is zero for everyone all of the time. On license cost alone this is not a close call, and any vendor-comparison spreadsheet that stops at the $19 is measuring the wrong thing.

What it can cost you.Here is the line nobody puts in the quote. Assume 20% of engineering time currently goes to rework — fixing defects, reverting, re-doing work that shipped wrong. (This is the one number you should replace with your own; everything below scales linearly off it.)

40 engineers x 2,000 hours          =  80,000 engineering hours / year
x 20% baseline rework               =  16,000 hours / year on rework

Now apply the measured effect of AI-assisted authorship on rework, at three published severities:

So: the license is $9,120. The exposure is $70,000-$590,000. Central estimate ~$216,000, which is 23.7x the license.

This is why the verdict is “buy” and not “buy, congratulations, you’re done.” You are approving a $9,120 tool that moves a $216,000 number. Whether it moves in your favour is decided entirely by the controls below — not by the purchase.

The reason, against your stack

1. The most-quoted argument against this purchase has been withdrawn by the people who made it.

If someone on your team forwards you the METR study — “a randomized trial found developers were 19% slowerwith AI” — that number is a snapshot of February-June 2025 tooling, and METR themselves published a follow-up in February 2026 superseding it. Their new estimates point the other way: -18% time (a speedup) for returning developers, -4% for newly recruited ones. Both confidence intervals cross zero (-38% to +9%, and -15% to +9%), so the honest reading is inconclusive on magnitude, no longer evidence of slowdown. METR also flagged their own 2026 data as biased, because developers increasingly refuse to participate in a study that makes them work without AI.

Anyone still quoting the 19% at you in 2026 is quoting a retracted snapshot. Don’t let it block the purchase — and don’t let anyone use it to justify a six-month evaluation.

2. The argument for it is also weaker than the vendor page implies.

GitHub’s own headline — 55.8% faster — comes from a 2023 controlled experiment where 95 developers wrote an HTTP server in JavaScript from scratch. Greenfield, single-file, no existing codebase, no review, no on-call. Your engineers do not do that. They work in a Go/TypeScript codebase with years of history. The 55% is real and honestly reported; it just does not describe your Tuesday.

The number that describes your Tuesday is GitClear’s January 2026 finding: heavy AI users, measured against their own past selves, gained about 25% velocity. Real, meaningful, and roughly a quarter the size of the marketing figure.

3. The failure mode is specific, measurable, and lands on your stack.

GitClear analysed 623 million code changes from 2023-2026 (AI-assisted commits are now about a quarter of all commits). Every maintainability signal moved the wrong way:

• Code block duplication +81%
• Within-commit copy/paste +41%— and copy/paste now exceeds refactoring by ~5x, reversing a 2x preference the other way in 2022
• Refactoring line moves -70%
• Legacy maintenance (touching code older than 12 months) -74%
• Error-masking constructs — catch blocks and safe-navigation operators that swallow a failure without diagnosing it — +47%
• Two-week churn +15%

That last one is the expensive one, and the error-masking finding is the one that should worry you specifically: you run Datadog.Code that silently catches errors instead of surfacing them doesn’t page anyone. It degrades quietly and shows up as a support ticket, not an alert. A 47% increase in error-masking against a monitoring stack tuned for thrown exceptions is how you get a class of bug your dashboards are structurally blind to.

Google’s DORA data agrees on direction: in 2024 every 25% increase in AI adoption came with a 7.2% reduction in delivery stability.DORA’s 2025 report found throughput had turned positive as teams learned — but the stability penalty did not go away. Two years running, the same stubborn finding: AI makes you faster at producing changes and worse at landing them safely.

4. Buy Business, not Pro — the $4,320 delta is worth it.

Copilot Pro is $10/seat and would save you $4,320/year across 40 seats. Don’t. Business ($19) adds organization-wide policy management, content exclusion, audit logs, and — the one that matters — IP indemnity, which GitHub extends to unmodified suggestions only when the public-code filter is enabled. Pro, Pro+ and Max carry no indemnity at any price, including the $100/month Max tier. You are a Series B company that will be sent a security questionnaire by every enterprise buyer for the next three years. Pay the $9.

5. Kill the double-pay on 6 seats.

You already pay for Cursor Pro on 6 engineers. Rolling Copilot Business to all 40 means those 6 seats carry two paid assistants doing substantially the same job: 6 x $19 x 12 = $1,368/year of duplicate spend.Either exclude those 6 from the Copilot rollout or sunset Cursor there after a 30-day preference check. Small money — but it’s the kind of line that quietly becomes six of them by next year.

6. Procurement gotcha, if you’re not on Enterprise Cloud.

You are on GitHub Enterprise Cloud, so this doesn’t bite you. For everyone else reading: as of April 22, 2026, GitHub paused new self-serve sign-ups for Copilot Business for organizations on GitHub Free and GitHub Team plans. If that’s you, you cannot put this on a card this afternoon — you have to go through sales, and your “decide by Friday” timeline is now a two-week timeline. Check which plan you’re on before you promise a date.

What to do instead of just buying it

Three controls. Together they cost roughly one engineer-week to set up. They are what separates the $72,000 outcome from the $590,000 one.

1. Turn on the public-code filter before you assign a single seat. Org admin setting. It suppresses suggestions matching public code at 65 lexemes or more (~150 characters), and it is the precondition for the IP indemnity you’re paying Business rates to get. Costs nothing. Buying Business and leaving this off is the single most common way to pay for indemnity and not have it.

2. Put a meter on duplication and two-week churn before rollout, not after. Take a 60-day baseline of duplicated-block rate and the share of code rewritten within two weeks. Re-measure at 90 days. If churn is up more than 10 points you have bought the $590,000 outcome and you need to intervene — but you will only know that if you took the baseline first. Do not skip this because it delays the rollout by two weeks. The baseline is the entire difference between managing this tool and hoping about it.

3. Cap PR size and rehearse rollback.DORA’s consistent finding across 2024 and 2025 is that the instability comes from AI generating large, hard-to-review batches — and that small batches plus frequent, practised use of revert/rollback is the documented moderator that turns AI adoption net-positive. You already run CircleCI; enforce a diff-size threshold that flags oversized PRs for split, and make sure reverting a bad deploy is a rehearsed one-command operation rather than an incident-time improvisation.

Add one review norm to your engineering handbook: reviewers must reject catch blocks and safe-navigation operators that suppress an error without handling it. That is the +47% signal, it is invisible to linters, and it is cheap to stop at review and expensive to find in production.

What would change our mind

• Your engineers are mostly senior and work in one large, tightly-coupled monolith. That is closest to METR’s population, where the evidence for net speedup is weakest and the review burden is highest. Verdict downgrades to a 90-day paid pilot on one team.
• You cannot instrument churn and duplication. Without control #2 you are buying blind and the range above is not a range, it is a coin flip. Pilot on 8 seats instead of rolling to 40.
• GitHub moves code completions from unlimited to metered credits at the Business tier. Today, completions and next-edit suggestions are explicitly excluded from AI-credit consumption and stay unlimited on every paid plan; the credit pool only covers chat, agents and CLI. If that changes, your $9,120 becomes a variable bill and the entire break-even calculation above has to be re-run.
• Business rises above roughly $30/seat.At 40 seats the break-even moves from 2.5 to ~4 hours per engineer per year. Still likely worth it — but it stops being the non-decision it is at $19.

What we checked

Every number above came from a page we opened, so you can check our work before you forward this to finance.

• GitHub Copilot plan pricing— docs.github.com/en/copilot/get-started/plans (Business $19/granted seat/mo; Enterprise $39; Pro $10; Pro+ $39; Max $100; the April 22, 2026 self-serve pause notice)
• GitHub Copilot plans & FAQ— github.com/features/copilot/plans (IP indemnity conditional on the public-code filter; 65-lexeme duplication threshold; completions excluded from AI-credit metering)
• GitHub / Microsoft controlled experiment, 2023— 55.8% faster, n=95, HTTP server in JavaScript, 95% CI [21%, 89%], p=0.0017
• Uplevel Data Labs, 2024— 800 developers (351 with Copilot access, 434 without); no significant efficiency change; +41% bug rate
• METR, July 2025— RCT, 16 developers, 246 tasks: +19% completion time (slower), CI [+2%, +39%]
• METR, February 2026 update— supersedes the above; -18% (returning devs, CI [-38%, +9%]) and -4% (new devs, CI [-15%, +9%]); authors flag selection bias
• Google DORA, 2024 — -1.5% delivery throughput and -7.2% delivery stability per 25% increase in AI adoption
• Google DORA, 2025— throughput turns positive; stability penalty persists; 90% adoption, 30% report little or no trust in AI output
• GitClear “The Maintainability Gap,” June 2026— 623M changes, 2023-2026: duplication +81%, copy/paste +41%, refactoring -70%, legacy maintenance -74%, error-masking +47%, churn +15%, function connectivity -35%
• GitClear, January 2026— heavy AI users vs. their own past selves: ~25% velocity gain

This is a One-Tool Verdict, published in full and free. Verdicts like it are retired: it stays here as a record of the work, with nothing to buy.