Ethical Stack

GitHub Copilot

Commercial coding assistant embedded in IDEs, GitHub, and terminal workflows; models and hosting paths vary.

Score calculation

(6 + 2 + 6 + 2) ÷ 4 = 4.0

4 of six dimensions rated. Unrated dimensions and BDS status are excluded.

Full scoring method ↗
Setup details

This covers product controls, not the entire Microsoft cloud stack or underlying models.

Energy

↑

GitHub Copilot does not publish service-specific energy or water data; the model and serving provider determine most inference impact.

Reasoning & sources

Copilot lets users switch among supported chat models, but inline suggestions and some clients may use different models. The documentation offers choice, not energy or water accounting. Pick a smaller capable model where available and request model/region-level figures from GitHub before making a low-impact claim.

No per-task electricity, water, or emissions data, serving-region breakdown, or lifecycle assessment was found for the harness.

Training rights

↑

GitHub Copilot is a harness that connects to models; its sources do not establish a complete rights record for the training data of every model it can use.

Reasoning & sources

Copilot lets users select among models on supported plans, but model-specific hosting and training terms differ. That choice is useful control, not evidence that the models’ training corpora were licensed or that code-referencing prevents training. Check the selected model’s hosting and terms, and prefer a provider that publishes rights provenance.

The provider and exact model vary by configuration; no complete rights ledger can be inferred from the harness license or provider list.

Privacy

↑

Copilot data handling varies by subscription, selected model, and hosting provider.

Reasoning & sources

The published rules distinguish individual from Business/Enterprise plans and document different provider paths. Check the exact plan and model; do not generalize an enterprise exclusion to a personal account or every model host.

Plan, selected model/provider, enabled features, and deployment mode can change this assessment.

Openness

↑

The product is proprietary; model choice and code-reference features do not expose its implementation.

Reasoning & sources

GitHub documents Copilot as a hosted commercial product and explains its model and code-reference features, but it does not publish the product implementation under an open-source license. Model selection and code-reference controls do not make the service code inspectable. The editor integration and selected model are separate layers.

This score covers the harness/editor source only; hosted services, models, data, or enterprise features may remain proprietary.

Worker treatment

↑

Microsoft’s FY2025 Human Rights Transparency Report describes supplier monitoring and reports findings in its Devices/Cloud Supply Chain and Provisioning scope, including 34 forced-labor/trafficking indicators (33 closed, one corrective plan), 50 fair-compensation findings (46 closed, four plans), and 75 working-hours/rest findings (68 closed, seven plans). These are supplier-audit findings, not AI-annotation-specific results.

Reasoning & sources

Microsoft reports supplier findings and closure plans, but the reported scope is not specific to AI annotation and some plans remain open. This is relevant when deciding whose business to support, while pay and working conditions for the team behind GitHub Copilot remain unestablished. Ask for current worker outcomes for that team and its suppliers.

Microsoft’s Supplier Code sets expectations for subcontractors and describes compliance processes, but it is not an audit of the specific models offered through Copilot. It does not name their labeling vendors, pay, or safety provisions. Ask Microsoft/GitHub for model-specific workforce evidence before treating a supplier policy as an outcome.

Microsoft reports supplier findings and closure plans, but the reported scope is not specific to AI annotation and some plans remain open. This rating describes the company relationship or supplier policy, not a finding about this particular product’s use.

Working conditions for the people building or supporting GitHub Copilot are not established by this company-wide record. The published findings cover specified supplier audit scopes, not all suppliers, model evaluation labor, or all remediation outcomes.

Government & military

↑

Microsoft’s final 2026 review says its external investigation found evidence supporting elements of 2025 reporting, including IMOD Azure storage consumption in the Netherlands and AI-service use. Microsoft says it disabled specified storage/AI subscriptions in September 2025, while continuing other software, professional services, Azure and Azure AI services to IMOD.

Reasoning & sources

The company confirms defense-ministry Azure/AI use and a review supporting elements of serious surveillance-related reporting; it stopped specified services but continues others. This is relevant when deciding whose business to support. Deployment of GitHub Copilot or this particular model release under those contracts remains unestablished; consider the company relationship separately from the product’s actual use.

Microsoft is a JWCC cloud provider in the Department of Defense procurement. This establishes a Microsoft-level defense relationship but not GitHub Copilot use in JWCC workloads. Buyers can weigh Microsoft’s broader contract portfolio while keeping it separate from product deployment.

The company confirms defense-ministry Azure/AI use and a review supporting elements of serious surveillance-related reporting; it stopped specified services but continues others. This rating describes the company relationship or supplier policy, not a finding about this particular product’s use.

Deployment of GitHub Copilot under these contracts is not established. The report does not access IMOD customer content, does not establish the content/use of every service, and does not say the wider commercial relationship ended.

BDS status

↑

Microsoft is named as a consumer boycott priority target in the BNC guide. GitHub is part of Microsoft; the classification follows its parent company.

Reasoning & sources

If following this BNC campaign is a requirement, consider alternatives to paid Microsoft products where practical. Check the model and host this tool connects to as well as the company providing the tool. This label follows the named company’s campaign status; it does not claim that BDS separately reviewed this exact product.

This review covers the named targets in the BNC consumer/pressure guide and No Tech campaign, not every BDS campaign, local group, investment or supplier. Lists and ownership can change. A company’s absence from these lists is not an endorsement or proof that it has no relevant relationships.

Microsoft’s final 2026 review says Covington found evidence supporting elements of reporting about IMOD Azure storage and AI-service use, including Azure storage consumption in the Netherlands. Microsoft says it disabled specified subscriptions/services in September 2025 but continues providing IMOD with other Azure, Azure AI, software, and professional services. The report did not access customer content and does not establish all downstream uses.

How GitHub Copilot is used in this relationship is not established. Microsoft describes only selected service suspensions; the report does not establish all IMOD use, civilian impact, or the full scope of continuing services.

All sources

Side by side