Skip to main content

The DfE technical guidance and its content is intended for internal use by the DfE community.

Use GitHub Copilot safely

Use only the approved DfE account and entitlement. Complete required training and follow DfE data handling rules before use. Do not use DfE funded access for unrelated personal projects. SSO does not automatically enforce these usage restrictions.

Handle data and usage responsibly

  • Provide only the information needed. Check that the data classification, model, service and retention arrangements are approved before submitting sensitive information. Never include credentials. No training on business data does not mean no retention.

  • Check the usage or cost information available in your client and account. Follow the communicated allowance and request approval before increasing spend. Follow the allowance communicated by your organisation.

  • Break work into clear tasks, provide relevant context and review results before repeating requests. If usage is unexpectedly high, seek support or training. High usage alone does not prove misuse.

Review generated changes

Review and test every generated change before accepting or merging it. Copilot can produce incorrect or insecure code. Content exclusions and instructions are not substitutes for access controls or approved handling of sensitive information. Keep CI checks and human review in place.

For access, sign in and a first test prompt, follow Getting started with GitHub Copilot. For reviews and scanning, follow Work safely in DfE repositories.