Copilot Review Attribution: Why Bot Share Is Not AI Review Share

On November 6, 2026, GitHub announced explicit attribution fields for Copilot reviews and comments. The release also expanded API access to review settings and exposed review effort when available.

That creates a useful reason to audit an existing dashboard label: does “bot review share” mean all automated reviews, or only AI reviews? Those are different measurements. Confusing them can materially overstate AI adoption.

What changed in Copilot review attribution

GitHub describes the new capability as:

“Identify Copilot’s reviews and comments through explicit attribution fields.”

It also says teams can:

“See the review effort a review used”

The second statement applies when that metadata is available. Administrators can manage settings at enterprise, organization, and repository levels, subject to permissions and inherited policies. The release also exposes sources Copilot reports using for comments, including instructions and connected tools.

Attribution means identifying which system produced a particular record. It provides a stronger basis for identifying Copilot output than inferring identity from an account name alone. It does not identify every AI review product, reconstruct work performed outside GitHub, or establish whether a finding was correct.

Why teams should care about the denominator

A team evaluating AI review needs to separate three questions: how much recorded activity came from AI accounts, how widely the tool reached pull requests, and whether its feedback helped.

Review-event share answers only the first. A pull request can receive several reviews from one automated account. Another can receive one human review. Counting events does not give each pull request equal weight, and it does not measure review effort.

This also explains why replacing a human review with automated activity should not be inferred from a changing percentage. Human review volume could remain unchanged while automated reviews increase. The human share would fall even though the count stayed constant.

GitHub's code review documentation retains a direct recommendation:

“Supplement Copilot's feedback with a human review.”

That recommendation concerns validation responsibility. A dashboard's reviewer category cannot confirm that someone checked the reasoning, ran the tests, or understood the change.

Define AI share and bot share separately

For a fixed set of recorded review events, use these definitions:

AI reviews are a subset of bot reviews. Do not add AI share to all-bot share. To display mutually exclusive categories, use detected AI, other bots, and the remaining reviews.

GitQuick already exposes AI and bot review counts and percentages, with a three-part display for AI, other bots, and human-classified accounts. Its current classification uses account-login patterns and known service names. It does not yet ingest the new Copilot attribution fields, review-effort metadata, or reported context sources.

Consequently, “human” means not matched by those automation rules. A person can paste AI-generated feedback into a review. A custom automated account can have an ordinary-looking name. Neither becomes reliably detectable from login patterns alone.

What current public snapshots show

The public Showcase list contained 21 organizations when fetched on November 10, 2026. The examples below use the latest available one-month runs for three organizations. They count stored reviews attached to PRs created within each run window, rather than all reviews submitted during the calendar month.

AWS illustrates the difference: all bots account for 14.57% of recorded reviews, while detected AI accounts contribute 1.19%. Calling the larger figure “AI review adoption” would describe the wrong category.

Vercel illustrates the denominator problem. Detected AI accounts produce 97.7% of its bot reviews, but only 2.17% of all recorded reviews. Both percentages are correct. They answer different questions.

These are examples, not rankings. The organizations have different repositories and creation windows. None of these figures establishes Copilot usage specifically, AI authorship of the underlying code, review quality, or adoption of the November 6 release.

Audit the measurement before changing policy

Use the new attribution capability as a reason to make existing reporting more explicit.

1. Name the unit. Label counts as review events, reviewed PRs, or reviewers. Do not switch between them within a comparison.
2. Record the classification method. Distinguish provider attribution from login-based inference. Document which services and custom accounts are recognized.
3. Check the largest contributors. Inspect a sample of reviews from the accounts contributing most activity. Confirm their purpose and whether repeated reviews dominate the total.
4. Keep a stable comparison. Use the same repositories, PR selection rule, and observation window. Annotate changes to detection rules as well as changes to review policy.

The last step matters when adopting explicit attribution. If a previously unrecognized account becomes detectable, reported AI share can rise without any new AI activity. Treat that as a measurement change until the underlying records show otherwise.

Takeaway

Copilot's new attribution fields make its output easier to identify. The immediate reporting improvement is to preserve that identity without turning it into a claim about effectiveness.

Start with counts, state the denominator, and keep inferred categories visible. Then inspect actual feedback before deciding whether to expand or reduce automated review.

For related context, read When AI Reviews AI and Copilot Addressed Rate.

Explore the public AWS, GitHub, and Vercel snapshots, or browse all showcases. Try GitQuick on your organization to examine your recorded review mix.

Disclaimer: This article uses public GitHub metadata and the primary sources linked above. Login-based classification can misidentify accounts and cannot detect all AI-assisted work. Review activity is not a measure of code quality, individual performance, or causality. GitQuick is not affiliated with or endorsed by GitHub or the organizations mentioned.