How to govern GitHub Copilot
AI writing and reviewing code in your repositories, and the shift when it runs tasks on its own.
GitHub · Reviewed monthly, and when GitHub announces a capability change · Last reviewed 16 Oct 2026
Governance change Reviewed the changelog from 3 September to 15 October. Copilot can now operate desktop applications, author its own multi-step workflows, approve pull requests from code review, and apply security fixes on its own. Copilot features became enabled by default for Business and Enterprise on 24 September, and selected models are being retired in October and November. Full changelog ↓How GitHub Copilot is used
We see one common way businesses use GitHub Copilot, and we govern it on its own terms. If your team uses it differently, that is fine: you describe the use in your own words and Certrak works out the governance from what it actually does.
Code generation and review
Consequence to people: MediumWriting or reviewing code, with a developer in the loop
Governing GitHub Copilot in practice
- Name one person who owns GitHub Copilot in your business. Governance starts with a name.
- Write down what GitHub Copilot is used for. Certrak recognises one common use: Code generation and review. Yours may differ; write down yours.
- Decide what GitHub Copilot may and may not be given. Internal business information is in scope, so name what stays out.
- Agree that a person reviews every output before it is used, and name who.
- GitHub Copilot can run code or scripts and create, change, or delete records in another system without a person approving. Record which of these you allow, and who can change that.
- Look at this again every month, and sooner on any of these: industry incidents, vendor model updates and autonomy level changes.
What changed, and how Certrak responded
We record every check here, including the ones that changed nothing. A check that found no governance change proves we looked.
-
Governance change Scheduled review
GitHub Copilot can now interact with desktop apps with computer use
GitHub shipped it 1 Oct 2026.
Reviewed the changelog from 3 September to 15 October. Copilot can now operate desktop applications, author its own multi-step workflows, approve pull requests from code review, and apply security fixes on its own. Copilot features became enabled by default for Business and Enterprise on 24 September, and selected models are being retired in October and November.
How Certrak responded: Where Copilot is used for code, it can now run and change things beyond suggesting text: operating applications, approving pull requests and applying fixes. Owners are asked whether their people use these modes; if they do, the system is treated as running code and making changes, and the matching controls apply. Administrators should check the 24 September default-enablement change.
-
No governance change Scheduled review
GitHub Copilot changelog
GitHub shipped it 28 Aug 2026.
Reviewed the recent changelog against GitHub Copilot's use pattern. No change to what it can do without approval or who reviews its output.