Can Copilot approve pull requests under PCI DSS?

No. Since September 1, 2026 GitHub lets Copilot code review approvals count toward a repository's required-approvals rule when an administrator enables it. PCI DSS v4.0.1 requirement 6.2.3.1 says manual code reviews must be performed by individuals other than the originating code author who are knowledgeable about secure coding techniques, and that the review is reviewed and approved by management before release. Copilot is not an individual. A Copilot approval can open the merge button; it cannot be the review an assessor accepts.

What 6.2.3 and 6.2.3.1 require

Requirement 6.2.3 asks that bespoke and custom software be reviewed before release to production to identify and correct vulnerabilities. Requirement 6.2.3.1, which applies when manual code review is used, adds three conditions:

• The review is performed by individuals other than the originating code author.
• Those individuals are knowledgeable about code-review techniques and secure coding practices.
• The review is reviewed and approved by management prior to release.

The same requirement notes that knowledgeable third-party personnel may perform the review. That clause is the reason an outside reviewer is not just tolerated but named as acceptable.

The wording above is taken from a third-party summary of the standard. Check it against the PCI SSC text before quoting it to your QSA.

Where Copilot fits

Copilot code review is good at the first part of 6.2.3: finding vulnerabilities before release. Its comments and suggested fixes are useful, and a PSCO Officer reads them before deciding. It cannot satisfy 6.2.3.1 because it is not an individual, it cannot be shown to be knowledgeable in the sense the standard means, and its approval is not a management approval.

The path-scoped approvals GitHub offers, where Copilot can approve changes under low-risk directories, do not help either. The cardholder data environment is not a low-risk directory, and an assessor sampling changes in scope will look at exactly those paths.

What satisfies it

• A reviewer other than the author: a named PSCO Officer, posting the review from their own account.
• Knowledge of secure coding: Officers have five or more years of engineering with security work or a recognized credential, and the Officer Dossier documents it.
• Management approval before release: your release owner merging after the Officer's approval. PSCO never merges, so that step stays with you.
• Depth where it matters: paths that handle cardholder data, cryptography and payments are Deep Review by default, read in full by a senior Officer.

Keep Copilot on. Leave "count toward required approvals" on or off as you like; the psco/approved check is what gates the merge, and the Officer's review is what the assessor samples.