GitHub has started to enforce a default Copilot model policy for all generally available models on Copilot Business and Enterprise subscriptions. Unconfigured models are automatically switched to a “Delegate to default policy” state, which follows the organization’s default enablement setting, while open‑weight and data‑retention‑restricted models remain disabled.
Policy enforcement timeline
The rollout began on 2026‑08‑26 and will continue through 2026‑09‑01, with individual enterprises seeing the change at different points. The default policy is enabled, meaning that any model inheriting the policy becomes available to users unless an explicit override exists.
Model state semantics
After the rollout each model can appear in one of four states:
- Enabled: an administrator has explicitly turned the model on.
- Disabled: an administrator has explicitly turned the model off.
- Delegate to enterprise teams/apps or organizations: the model follows a setting inherited from a higher‑level entity.
- Delegate to default policy: the model follows the organization’s default enablement flag and updates dynamically when that flag changes.
Explicit choices are preserved; the system will not overwrite a manual enable or disable when applying the default policy.
Operational considerations
Practitioners should review the following areas:
- Configuration drift: because the “Delegate to default policy” state is live, any change to the default flag instantly propagates to all delegated models. Teams need a process to audit model states after policy adjustments.
- Compliance scope: open‑weight models (e.g., DeepSeek, Kimi K2) and models excluded from GitHub’s data‑retention agreement (e.g., Fable 5) stay disabled regardless of policy. Verify that any pipelines or IDE extensions that rely on these models are not silently failing.
- Per‑model overrides: administrators can still set durable enable/disable decisions for individual models. Document any overrides to avoid unexpected behavior when the default policy changes.
- Monitoring impact: CI/CD jobs, code‑completion services, and security‑related linting that depend on Copilot may see new model availability. Update monitoring dashboards to capture model state transitions and any related error rates.
Related CloudNinjas coverage: AI engineering.
What This Means For Practitioners
Teams should audit their current Copilot model configuration, confirm that the default policy aligns with security and compliance requirements, and establish a review cadence for any per‑model overrides. Keep an eye on the upcoming discussion about making the global policy an explicit setting and removing the “Delegate to default policy” state, as that could require a shift from dynamic inheritance to static configuration.
