Verify the output

Copilot writes fluently, and fluent text sounds right even when it isn't. Large language models can produce plausible but incorrect details, often called "hallucinations." Building a quick review habit is the single best way to use Copilot safely.

The 60-second review checklist

1. Open the citations. When Copilot cites a file or email, click through and confirm the source actually says what the answer claims.
2. Check every number. Totals, percentages, dates and prices are the most common errors. Recalculate anything that matters.
3. Check names and owners. Make sure people, teams, customers and action-item owners are correct and spelled right.
4. Look for what's missing. Summaries can drop caveats, dissenting views or open decisions. Ask "what did this leave out?"
5. Read it as the recipient. Does the tone fit? Would you be comfortable with your name on it?

Data and spreadsheets

When Copilot in Excel suggests a formula or an insight, spot-check a few rows by hand. Confirm that the formula references the right range and that filtered or hidden rows aren't skewing the result.

Code

AI-generated code needs the same review as any other code, and sometimes more. It can compile cleanly and still be wrong.

• Run the tests, and add tests for edge cases Copilot may not have considered.
• Check for security issues such as unsanitized input, hard-coded secrets and outdated dependencies.
• Use Copilot code review as an extra reviewer, not a replacement for a human approval.

Match review effort to risk

A meeting recap for yourself needs a glance. A customer contract, financial figure or production deployment needs a careful read. Frameworks like the NIST AI Risk Management Framework formalize this idea for organizations, and the OWASP GenAI Security Project covers the security side.