Works with · GitHub Copilot · GitHub
Does a GitHub Copilot approval count for SOC 2 or PCI DSS?
Technically it can satisfy GitHub’s required-approvals rule; for an audit it does not. Since September 2026 GitHub lets Copilot approvals count toward a repository’s required approvals when enabled. Auditors have not followed: a Copilot approval is not an approval by a qualified person other than the author, which SOC 2 CC8.1 and PCI DSS 6.2.3.1 both expect. PSCO keeps Copilot in the loop and adds the named Officer whose approval is the one your auditor samples.
How GitHub Copilot reviews
Copilot code review reads the diff, posts review comments and suggested changes, and can issue an approval assessment. Repository administrators can allow those approvals to count toward branch protection, including path-scoped approvals for low-risk directories.
What it cannot do
Copilot cannot be the independent human approver in an audit. The fact that GitHub counts its approval toward the required-approvals rule is a merge-gate setting, not an audit standard. A-LIGN’s relayed view on the Vanta community is that fully AI-only review is not accepted as standard, and PCI DSS 6.2.3.1 names individuals other than the author, not tools.
How PSCO reads its output
PSCO recognizes the Copilot reviewer logins, records its comments and approval assessment as findings in the Officer’s packet, and marks the approval as "cannot count as the independent approver" on the timeline. If path-scoped approvals are on, PSCO still requires the Officer’s review on every in-scope PR, and the attestation records both.
Two-step setup
Keep GitHub Copilot.
Keep Copilot code review on. You may leave "count toward required approvals" enabled or off; PSCO’s check is what gates the merge.
Add PSCO.
Install the PSCO GitHub App, pick the repos in scope, and add the psco/approved check and one approval from @psco-officers to branch protection.
The shared-model tip
Point it at the same model the Officer uses.
Point Copilot at the same rulebook the Officer uses. Add the model’s rules to .github/copilot-instructions.md and reference psco.model.yaml from it. Keep the sensitive paths, required checks and forbidden patterns identical in both places so the robot and the human check the same rules, and so the Officer's packet shows the AI's findings next to the clause they map to.
frameworks: [soc2, iso27001] sensitive_paths: auth/**: deep infra/**: deep required_checks: [ci, tests, sast, secrets] forbidden: [hardcoded_secret, tls_verify_off]
Other reviewers
Claude Code · Codex · Cursor Bugbot · CodeRabbit · Greptile · Graphite Diamond · Qodo · Macroscope · Devin Review · Ellipsis · Sourcery · Bito AI Code Review Agent · CodeAnt AI · repowise · Gemini Code Assist · Amazon Q Developer · Augment Code · Snyk · Semgrep · Dependabot · Renovate · All
Keep GitHub Copilot. Add the human who signs.
Connect GitHub and PSCO detects the reviewers already on your repos. Your price comes from your real PR history.