Usually no. Keep required approvals for people who are accountable for the code, and let an AI review be advisory. If you do count it, pair it with a human code owner and dismiss stale approvals, so a bot cannot wave through changes it never saw.
What the platform does by default
On GitHub, a branch protection rule can require a set number of approving reviews before a pull request merges. Approvals can come from people with write permission or from a designated code owner. A review that requests changes blocks the merge until it is approved or dismissed.
GitHub's documentation for Copilot code review adds that its reviews do not count toward required approvals unless Copilot approvals are enabled, and that new commits dismiss a Copilot approval. Those are sensible defaults. The documentation also marks Copilot approvals as a public preview feature that is subject to change, so check it again before relying on it.
Why accountability matters
An approval is a statement that a named person read the change and accepts responsibility. A bot can flag issues, but it is not accountable in an audit or an incident review.
The vendor guidance points the same way. GitHub says Copilot is not guaranteed to spot all problems and recommends supplementing it with a human review.
Three setups, compared
- Advisory only. The bot comments, people approve. Lowest risk, and easiest to explain to an auditor.
- Bot counts as one of two approvals. Faster, but one person plus a bot may approve a change nobody fully understood. Acceptable only for low risk paths such as documentation.
- Bot counts as the only approval. Avoid for anything that reaches production.
Settings that make a counted bot safer
If you choose the middle option, tighten the rest of the rule:
- Turn on dismissal of stale approvals. GitHub dismisses an approval when the diff changes after it was given, including new commits, so the bot has to look again.
- Require review from code owners. GitHub requests owners automatically when files they own change, and any one owner satisfies the rule. Put the CODEOWNERS file under an owner too, so it cannot be edited quietly.
- Require status checks to pass. GitHub requires each required check to report success, skipped or neutral before merging.
Write the policy down
Put one sentence in your contributing guide, such as: bot reviews are advisory and never replace the required human approval. Auditors reading your change management evidence like a rule that is both written and enforced by settings.
Quick check
Do Copilot reviews count as required approvals on GitHub?
Not by default. GitHub's documentation says they count only if Copilot approvals are enabled, and a new commit dismisses the approval.
What is the safest way to use a review bot?
As advisory input, with required human approval and code owner review still in place.
Sources
- GitHub Docs, Copilot code review
- GitHub Docs, About protected branches
- GitHub Docs, About code owners
Last reviewed: 19 October 2026.
