GitHub's changelog entry of 1 September says two separate things, and the difference between them is the whole story. First: “Every Copilot code review now includes an approval assessment in the overview comment.” Second, immediately after: “An approval assessment alone does not count toward merge requirements.”
The mechanism that does count
The binding one is separate: “When enabled, Copilot can submit an approval that counts toward the repository's required-approvals rule.” GitHub states that this ability is off by default and configurable at the enterprise, organization, and repository level — three places an administrator can turn it on. Repository administrators can also “choose which file paths Copilot is allowed to approve”, and the approval behaves like a human one on invalidation: if new commits are pushed after Copilot approves, its approval is dismissed just as a reviewer's would be.
What the common framing gets wrong
Both simplifications are wrong in opposite directions. “GitHub turned on AI pull-request approvals” overstates what shipped for everyone — the thing that turned on universally is the assessment, which GitHub says counts for nothing at merge time. But “it's just another review bot” badly understates it, because once an administrator flips the switch, a repository configured for one required approval can be merged with zero humans having read the diff. The path allowlist is the only structural brake, and it is set per repository.
The control this lands on
Required-approvals is not an ordinary setting. It is the control most engineering organisations point auditors at as change-management and segregation-of-duties evidence for SOC 2. This is the first time a first-party AI reviewer can satisfy it, and the changelog does not address whether a Copilot approval discharges that control. That question is now live for every enterprise on the platform, and it will be answered by auditors rather than by GitHub.
Where it is available
The feature is in public preview across five plans — Copilot Pro, Pro+, Max, Business and Enterprise. Default-off is doing real work here; the risk is not the ship date but the first quarter in which somebody enables it globally to unblock a backlog.