How to govern GitHub Copilot
AI writing and reviewing code in your repositories, and the shift when it runs tasks on its own.
GitHub · Reviewed monthly, and when GitHub announces a capability change · Last reviewed 3 Sep 2026
No governance change Reviewed the recent changelog against GitHub Copilot's use pattern. No change to what it can do without approval or who reviews its output. Full changelog ↓How GitHub Copilot is used
We see one common way businesses use GitHub Copilot, and we govern it on its own terms. If your team uses it differently, that is fine: you describe the use in your own words and Certrak works out the governance from what it actually does.
Code generation and review
Consequence to people: LowWriting or reviewing code, with a developer in the loop
Governing GitHub Copilot in practice
- Name one person who owns GitHub Copilot in your business. Governance starts with a name.
- Write down what GitHub Copilot is used for. Certrak recognises one common use: Code generation and review. Yours may differ; write down yours.
- Decide what GitHub Copilot may and may not be given. Internal business information is in scope, so name what stays out.
- Agree that a person reviews every output before it is used, and name who.
- Look at this again once a year, and sooner on any of these: industry incidents and vendor model updates.
What changed, and how Certrak responded
We record every check here, including the ones that changed nothing. A check that found no governance change proves we looked.
-
No governance change Scheduled review
GitHub Copilot changelog
GitHub shipped it 28 Aug 2026.
Reviewed the recent changelog against GitHub Copilot's use pattern. No change to what it can do without approval or who reviews its output.