Every agent · Coding agents · GitHub (Microsoft)

GitHub Copilot

Q: What can GitHub Copilot act on?

Drafts for a human. Suggestions are drafted into the editor and the developer accepts each one, so a human is always in the loop. Code snippets and prompts are sent to the vendor; on Business and Enterprise plans they are not retained for training, on individual plans that depends on the setting.

Q: Is a human in the loop with GitHub Copilot, and does data leave the tenant?

Human in the loop by default: yes. Data leaves the tenant by default: yes. It drafts and a person decides, so the loop is real; what it can read is the question. Data leaves your tenant to the vendor by default.

Suggestions are drafted into the editor and the developer accepts each one, so a human is always in the loop. Code snippets and prompts are sent to the vendor; on Business and Enterprise plans they are not retained for training, on individual plans that depends on the setting.

drafts for a human

acts on

yes

human in the loop by default

yes

data leaves the tenant by default

The code open in the editor, the repository context it indexes, and chat history

reaches by default

What that means for the register

It drafts and a person decides, so the loop is real; what it can read is the question. Data leaves your tenant to the vendor by default. Pasted with only its name it lands as control until an owner is named.

This week

Confirm every developer is on the organisation plan, not a personal licence, and turn on the content exclusion list for repositories holding secrets or regulated data.

What holding it is evidence for

Requirement text and artefacts from a human-verified corpus licensed to Agent Register.

Data leaving the tenant to a model vendor ISO 42001 A.10.3 · ISO 42001 A.4.3 · ISO 42001 A.7.3 · ISO 42001 A.10.2 · EU AI Act Art.10 · EU AI Act Art.25

ISO 42001 A.10.3 Suppliers

Establish a process ensuring that the organization's use of services, products or materials provided by suppliers aligns with its approach to the responsible development and use of AI systems.

Evidence an auditor accepts: supplier assessment criteria covering responsible AI; completed assessments for AI suppliers including model, dataset and component providers; contract terms binding suppliers to the organization's AI requirements

ISO 42001 A.4.3 Data resources

As part of identifying resources, the organization shall document information about the data resources utilized for the AI system.

Evidence an auditor accepts: Data inventory; Data lineage records; Datasheets

ISO 42001 A.7.3 Acquisition of data

The organization shall determine and document details about the acquisition and selection of data used in AI systems, including provenance and consent where applicable.

Evidence an auditor accepts: Data acquisition records; Provenance documentation; Consent records

ISO 42001 A.10.2 Allocating responsibilities

Ensure responsibilities across the AI system life cycle are allocated between the organization, its partners, suppliers, customers and third parties.

Evidence an auditor accepts: RACI or equivalent covering each life cycle stage and each external party; contract clauses that state who is accountable for what; evidence the allocation is reviewed when the arrangement changes

EU AI Act Art.10 Data and data governance

High-risk AI systems that make use of techniques involving the training of AI models shall use training, validation and testing data that meet the quality criteria in Art.10(2)-(5): appropriate data governance, examination for possible biases, identification of data gaps/shortcomings, statistically ...

Evidence an auditor accepts: Data governance procedures; Bias examination records and remediation; Data-quality assessment per dataset

EU AI Act Art.25 Responsibilities along the AI value chain

Distributors/importers/deployers/other third parties become providers when they place on the market or put into service under their own name or trademark, substantially modify the system, or modify the intended purpose making it high-risk. The original provider shall cooperate with the new provider,...

Evidence an auditor accepts: Documented allocation of provider status across the value chain; Cooperation agreements between original and new providers

Do this for every tool your teams use

Paste the list and get this classification for every entry at once, with the owner column, the findings per department, and the controls the register is evidence for. Ten entries free, no account.

Build my agent register

GitHub Copilot coding agent · Cursor