GitHub made AI Scan generally available for pull-request changes in areas CodeQL does not cover, including PHP, Shell, Terraform and Dockerfiles. Both code scanning and AI Scan must be enabled for automatic execution, which displays risk explanations and suggested fixes alongside existing results. Warnings are advisory, do not fail checks or block merging, and fork and Dependabot pull requests are excluded. Private organization repositories need Code Security or Advanced Security; usage also requires checking AI-credit and budget policies.