Enterprise coding agents are not interchangeable. Their contracts, data controls, and completion costs can differ by a spectacular margin, which makes the buying decision less about flashy demos and more about legal language.
GitHub Copilot, AWS Kiro, Cursor, Devin, and Devin Desktop each take a different position on intellectual-property claims. The contract language checked on September 26, 2026, shows why enterprises should compare the indemnity terms line by line instead of treating every “AI coding agent” as the same product with a different logo.
Indemnity Terms Are All Over the Map
GitHub Copilot Business and Enterprise offer “uncapped IP indemnification for unmodified outputs.” GitHub’s Trust Center says that protection includes unmodified code from the Copilot coding agent, giving customers a defined position when generated code becomes part of a dispute.
AWS Kiro also offers indemnity for its output under the AWS Customer Agreement and AWS Service Terms. Its indemnity is uncapped for copyright claims on output, according to the AWS Bedrock FAQ—a notably clean promise in a market where the fine print often arrives with a ceiling.
Cursor’s language covers claims that the Service or any Suggestion infringes or misappropriates third-party intellectual property. The use of “Suggestions” matters because it names the generated material rather than leaving customers to guess whether protection applies to the output they actually received.
Cognition takes a narrower route for Devin and Devin Desktop. The company defends claims that its Services infringe patents, copyrights, or trade secrets, but excludes Customer Data, including Outputs, from that protection.
Cognition’s indemnity also caps liability at two times the fees paid during the prior 12 months. An executed order form controls over the Cognition MSA, and the Platform Terms for Cognition’s Pro, Max, and Teams plans, updated June 30, 2026, state that indemnity applies only to customers on Paid Service Tiers.
Those dates matter because the relevant documents have moved. Cognition updated its MSA on June 8, 2026, while Cursor updated its MSA on August 13, 2026; Microsoft also made a change for GitHub Copilot on April 3, 2026. Contract review is not a one-time ceremony performed after procurement has already picked a winner.
Residency Controls Meet a Very Uneven Cost Curve
Cognition’s product history adds another wrinkle. Cognition acquired Windsurf, then renamed the Windsurf editor Devin Desktop on June 2, 2026, making Devin and Devin Desktop products from Cognition while leaving enterprises to track which terms apply to which service.
GitHub Copilot Business and Enterprise do not retain prompts from IDE chat and completion. Prompts from other surfaces are retained for 28 days, and GitHub does not train on Business or Enterprise data.
Enterprises using GitHub Enterprise Cloud with data residency can pin Copilot inference to the United States or the European Union. That control adds 10% to AI credit consumption, turning geography into a direct budget line rather than a compliance checkbox.
Kiro’s data protection page states that enterprise content is never used for service improvement and is stored in the region where the profile is configured. Kiro inference stays inside the United States or Europe, except for models tagged experimental.
Those controls address where enterprise data goes, but they do not answer how much agent work will cost. A McKinsey study indicates that the cost of completion for different AI agents could differ by as much as 30 times.
Lari Hämäläinen, a McKinsey senior partner, described the gap this way: “Imagine like you’re running an operation, but every day there’s a 30x difference in the cost.” That is not a rounding error; it can reshape which tasks an enterprise automates and which ones remain with human developers.
McKinsey also warns that AI spending may rise as agents become more common, while about a third of organizations already spend more than 10% of their technology and communication budgets on AI. The sensible comparison therefore has three columns: what the agent produces, where enterprise data stays, and who pays when the output causes trouble.
There is no universal winner in these terms. GitHub and Kiro offer specific uncapped protections in defined areas, Cursor names Suggestions in its defense, and Cognition combines exclusions with a two-times fee cap—proof that “enterprise-ready” still requires a lawyer, a spreadsheet, and patience.
Based on
