Answers · AI output
Can I use GitHub Copilot code commercially?
Last updated
TL;DR: Yes. GitHub doesn't claim ownership of what Copilot generates, on any plan. But GitHub doesn't clear the code for you, and only some plans come with a promise to defend you. For Copilot Free, Pro and Pro+ (individual licenses), Section J of the GitHub Terms of Service (effective April 27, 2026) says GitHub doesn't claim ownership of your Input or Output. It also warns that Output may resemble code under open source licenses, makes you responsible for working out whether your use needs a third-party license, and makes your indemnity to GitHub cover Output you put in your products. For Copilot Business and Enterprise bought directly under a volume licensing agreement, the GitHub Generative AI Services Terms (which replaced the Copilot Product Specific Terms on March 5, 2026) say GitHub doesn't own Inputs or Outputs and won't train on them, and your agreement's defense of third-party claims, if it has one, applies to Outputs. Bought through Microsoft, Microsoft's Product Terms apply. Either way, check suggestions that match public code against their licenses, and remember that code generated from a prompt alone may not be protected by copyright.
What should I check, step by step?
1. Find out which terms you're under: an individual plan (GitHub Terms of Service, Section J), Copilot Business or Enterprise bought directly from GitHub (GitHub Generative AI Services Terms), or bought through Microsoft (Microsoft Product Terms for GitHub Offerings).
- Turn on public code matching. Set it to block suggestions that match public code, or allow them with code referencing, which shows the matching repositories and any license it detected.
- When a match shows a license, comply with it or remove the code: MIT and BSD need the notice kept, and GPL or AGPL code in a closed-source product is a problem. NOASSERTION means no license was found, which doesn't mean you can use it.
- Scan the packages Copilot's agent mode or cloud agent adds, the same way you'd scan a human's pull request.
- On an individual plan, check the setting that lets GitHub use your Inputs and Outputs to train models. Section J.3 says this happens unless you opt out in your account settings, and the opt-out only applies from then on.
- If you rely on Microsoft's Customer Copyright Commitment, confirm that your agreement includes a defense of third-party claims and read its conditions. Microsoft's required-mitigations page says that as of April 3, 2026, GitHub Offerings have no additional required mitigations and the duplicate detection filter is no longer required for coverage.
- Keep the human work visible (design, edits, tests, review) and keep a record of which plan and settings were in force when the code was written.
Individual plans (Free, Pro, Pro+)
Section J of the GitHub Terms of Service covers Copilot and other AI features for everyone not on a volume agreement. J.2: GitHub does not claim ownership of your Input or Output; Output may resemble training data or be subject to third-party copyrights or open source license terms, and you decide whether you need a license and comply with it.
- J.4 says Output is provided as-is, may be inaccurate or non-functional, and isn't guaranteed to be free of intellectual property claims. J.5 makes you responsible for your use of Output, and your indemnity to GitHub covers claims arising from Output you put into your products or services.
- There's no IP defense from GitHub on these plans.
Copilot Business and Enterprise
Bought directly from GitHub under a volume licensing agreement, the GitHub Generative AI Services Terms apply. They say GitHub does not own Inputs or Outputs, GitHub won't use Inputs or Outputs to train generative AI models without your documented instructions, and if your agreement provides for defense of third-party claims, that applies to Outputs.
- You still can't use Copilot to generate Outputs whose use you know, or reasonably should know, would infringe others' rights, and you're solely responsible for the applications and agents you build with it.
- The defense comes through Microsoft's Customer Copyright Commitment. Microsoft's required-mitigations page lists no additional required mitigations for GitHub Offerings as of April 3, 2026; the duplicate detection filter is now optional.
What code referencing shows
For inline suggestions, GitHub compares the suggestion plus about 150 characters of surrounding code with an index of public code. Depending on your policy, a match is blocked or shown with the matching file URLs and any detected license, or NOASSERTION if none was found.
- Copilot Chat responses that include matching code end with 'Similar code found with n license types - View matches'.
- A match tells you where similar code appears, not who wrote it first or whether that repository's license is correct. Check the original project's license before you keep the code.
What do the license checks say?
Yes means the license grants the use, on the duties listed. Duties such as source_disclosure, share_alike and network_source_offer are the ones that conflict with keeping a product closed-source.
| Use | Answer | Why |
|---|---|---|
| Keeping a Copilot suggestion that matches MIT code in a closed-source app (MIT) | Yes | Every use you described is granted by MIT, and nothing you described is prohibited. Duties: attribution, license_notice. |
| Keeping a Copilot suggestion that matches GPL-3.0 code in a closed-source app (GPL-3.0-only) | Yes | Every use you described is granted by GPL 3.0, and nothing you described is prohibited. Duties: attribution, license_notice, state_changes, share_alike, source_disclosure. |
How do I ask Rightshold about this (free, no key)?
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Copilot code referencing flagged a few suggestions as matching MIT and GPL-3.0 code. Can we ship them in our closed-source product?”
{
"tool": "check_rights_batch",
"arguments": {
"intended_use": {
"commercial_use": true,
"modification": true,
"redistribution": true
},
"items": [
{
"ref": "suggestion matching an MIT repo",
"license": "MIT"
},
{
"ref": "suggestion matching a GPL-3.0 repo",
"license": "GPL-3.0-only"
}
]
}
}- Free. check_rights_batch checks up to 100 snippets, packages and assets in one call and lists the duties for each.
- license_compatibility checks whether two licenses can be combined in one work.
- issue_rights_receipt (with an API key) binds a file's SHA-256 to the license and intended use you record, signs it and commits it to the ledger, so you can later show what you checked and when.
Rightshold checks the license you name against the use you describe. It doesn't detect Copilot-written or copied code, doesn't see your GitHub account or settings, and doesn't grant or confirm GitHub or Microsoft rights. Not legal advice.
What are the sources?
- GitHub Terms of Service, Section J: AI Features, Training, and Your Data (effective April 27, 2026)
- GitHub Generative AI Services Terms (March 2026)
- GitHub Terms for Additional Products and Features: GitHub Copilot (which terms apply)
- Microsoft: Customer Copyright Commitment required mitigations (GitHub Offerings)
- GitHub Docs: Code referencing in GitHub Copilot
- GitHub Docs: Finding public code that matches GitHub Copilot suggestions
- U.S. Copyright Office: Copyright and Artificial Intelligence, Part 2: Copyrightability (January 2025)
Related
- Who owns code written by an AI coding agent?
- How to check if AI-generated code copied open source code
- Can I use ChatGPT output commercially?
- Can I use MIT, GPL or AGPL code in a closed-source SaaS?
Not legal advice. JSON · Markdown · All answers
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'