GitHub Copilot Global Model Policy Is Now Generally Available

GitHub announced on August 26, 2026 that its global model policy for Copilot Business and Copilot Enterprise is now generally available, with enforcement rolling out gradually through September 1. The policy, first announced in July, determines which AI models are on or off by default for an organization. Models that were previously unconfigured will now inherit the global policy state, and open-weight models such as DeepSeek and Kimi K2 will remain disabled by default regardless of how the policy is set.

What happened

Detail	Fact
Announcement date	August 26, 2026
Rollout deadline	September 1, 2026
Plans affected	Copilot Business, Copilot Enterprise
Default policy state	Enabled (models become available to users)
Open-weight models excluded by default	DeepSeek, Kimi K2
Data-retention models excluded by default	Fable 5

GitHub first described this policy in July 2026. The full enforcement phase began August 26 and will complete by September 1, meaning different enterprise accounts will see the change at different points within that window.

The core mechanic is a new status called “Delegate to default policy.” Any model your organization had not previously configured will move to this state automatically. From there, the model follows whatever your global policy is set to. Because the default policy is enabled, most unconfigured generally available models will become visible to your users without any admin action.

What exactly are the four model states?

After the rollout completes, every model in your Copilot settings will show one of four statuses:

• Enabled: An admin explicitly turned the model on.
• Disabled: An admin explicitly turned the model off.
• Delegate to enterprise teams or organizations: The model follows a setting inherited from a parent enterprise team or organization.
• Delegate to default policy: The model tracks your global policy setting dynamically.

The key protection here is that GitHub says it will never override an explicit choice. If an admin has already enabled or disabled a specific model, that setting stays put.

Which models are excluded regardless of policy?

Two categories are blocked from default enablement no matter what your policy says:

1. Open-weight models, including DeepSeek and Kimi K2. These are models whose weights are publicly released and can be run or fine-tuned outside GitHub’s controlled environment.
2. Models not covered by GitHub’s data retention agreement, specifically citing Fable 5 as an example. If GitHub cannot guarantee how your data is stored or handled, the model stays off by default.

Admins can still turn these on manually for their organization if they choose to accept those conditions.

Why it matters

For most organizations on Copilot Business or Enterprise that have not actively managed their model list, this rollout will quietly expand what models developers can access starting September 1. That is worth knowing before it happens, not after a developer asks why they suddenly have new options.

The exclusion of open-weight models by default is a meaningful data governance choice. Models like DeepSeek have raised questions about data handling, and GitHub is signaling that it will not quietly enable them through a blanket policy. If your legal or security team has questions about which AI models your developers are using, this policy gives you a cleaner audit trail through the four explicit states.

The “Delegate to default policy” state is dynamic, meaning a single policy toggle affects every model in that state at once. That is powerful for admins who want one switch, but it also means changing the global policy has broad, immediate effects across your whole model catalog. If you operate in a regulated industry, you may want to set models individually rather than rely on the global toggle.

Separately, GitHub says it is evaluating whether to eliminate the “Delegate to default policy” state entirely, replacing it with a requirement that every model have an explicit on or off decision. That would be a more conservative governance posture and is worth watching if you are building internal AI policies around Copilot. For teams already thinking about how to integrate AI tooling responsibly into their workflows, this kind of explicit-by-default approach is generally the safer starting point.

Our take

This is a sensible governance move, and the default-enabled policy for generally available models is probably fine for most businesses. The more useful detail is the exclusion list. Knowing that Fable 5 and open-weight models like DeepSeek are off by default tells you what GitHub considers higher-risk, which is useful signal when building your own internal AI policy.

The proposed future change, forcing an explicit decision on every model, is the right direction. “Delegate to default policy” is a convenience, but convenience in AI governance tends to create surprises later. If you are an admin, do not wait for GitHub to force the question. Go set your model states intentionally now, document the reasons, and review when new generally available models are added. You can follow other recent Copilot updates to stay on top of what’s changing in the platform.

What to do about it

1. Log into your GitHub Enterprise or Organization settings and open the Copilot model policy panel before September 1.
2. Review which models show “Delegate to default policy” and decide whether to leave them, explicitly enable, or explicitly disable each one.
3. Check whether any excluded models (DeepSeek, Kimi K2, Fable 5) need to be turned on or confirmed off based on your data handling policies.
4. Document your explicit model decisions so you have an audit trail if a compliance question comes up later.
5. Watch for GitHub’s potential removal of the “Delegate to default policy” state and plan to migrate to explicit settings before it becomes mandatory.

The practical takeaway: review your Copilot model list before September 1 so the rollout does not catch your team off guard.

Source: GitHub Changelog