AI Regulation in Hong Kong: 2026 Update

AI regulation in Hong Kong is evolving rapidly. Unlike the European Union';s comprehensive AI Act, Hong Kong has adopted a principles-based, sector-specific model that places compliance obligations on regulated industries rather than on AI technology itself. For international businesses operating in the city, this means navigating a patchwork of guidance from financial, data, and communications regulators rather than a single binding statute. This guide explains the current regulatory landscape, the most significant recent updates, the authorities responsible for enforcement, and the practical steps businesses should take to remain compliant.

Hong Kong does not yet have a standalone AI law. Instead, the government and its regulators have chosen a risk-proportionate, sector-led model. This approach reflects the city';s broader philosophy of light-touch regulation designed to preserve its status as a global financial and technology hub.

The foundational document for this approach is the "Artificial Intelligence: Model Personal Data Protection Framework" issued by the Office of the Privacy Commissioner for Personal Data (PCPD). This framework, which draws on the Personal Data (Privacy) Ordinance (Cap. 486), sets out how organisations should govern the use of AI systems that process personal data. It covers procurement, impact assessments, human oversight, and transparency obligations. While not legally binding in itself, it signals the PCPD';s enforcement expectations and is treated as authoritative guidance by most compliance teams.

Alongside the PCPD framework, the Hong Kong Monetary Authority (HKMA) has issued a series of circulars and supervisory guidance notes addressing AI use in banking and financial services. The Securities and Futures Commission (SFC) has similarly published guidance on algorithmic trading and AI-driven investment advice. The Insurance Authority (IA) has addressed AI in underwriting and claims handling. Each of these bodies operates under its own enabling legislation and can take enforcement action against regulated entities that fail to meet the standards set out in their guidance.

The result is a layered system. A fintech company deploying an AI credit-scoring model must satisfy the PCPD';s data protection requirements, the HKMA';s model risk management expectations, and potentially the SFC';s conduct rules - all simultaneously.

Several authorities share responsibility for AI regulation in Hong Kong. Understanding which body governs which activity is the first practical step for any business.

The PCPD is the primary regulator for AI systems that process personal data. It can investigate complaints, conduct audits, and issue enforcement notices under the Personal Data (Privacy) Ordinance. Recent amendments to the Ordinance have strengthened the PCPD';s powers, including the ability to impose administrative fines in certain circumstances. The PCPD';s AI framework specifically addresses six areas: AI strategy and governance, risk assessment and management, customisation of AI models, AI system evaluation, human oversight, and communication with data subjects.

The HKMA supervises all authorised institutions under the Banking Ordinance (Cap. 155). Its guidance on AI and model risk management requires banks to maintain model inventories, conduct validation exercises, and ensure that AI-driven decisions can be explained to customers and regulators. The HKMA has also introduced the Fintech Supervisory Sandbox, which allows banks to test AI applications in a controlled environment before full deployment.

The SFC regulates licensed corporations under the Securities and Futures Ordinance (Cap. 571). Its guidance on algorithmic trading requires firms to implement pre-trade controls, stress-testing, and kill-switch mechanisms. For AI-driven robo-advisory services, the SFC expects firms to conduct suitability assessments and disclose the use of automated systems to clients.

The Communications Authority oversees broadcasters and telecommunications operators. It has issued guidance on the use of AI-generated content in broadcasting, focusing on accuracy, transparency, and the risk of deepfakes. The Cyberport and Hong Kong Science and Technology Parks Corporation play a facilitative role, supporting AI development through funding and sandbox programmes rather than enforcement.

In practice, founders should consider engaging with the relevant regulator early, particularly if the AI application falls into a grey area between sectors. Regulators in Hong Kong have generally been willing to provide informal guidance before a product launches.

The regulatory landscape has shifted considerably in recent periods. Several developments are directly relevant to businesses operating or planning to operate in Hong Kong.

The PCPD published an updated version of its AI Model Framework, expanding its scope to cover generative AI systems. The revised framework addresses large language models, AI-generated content, and the specific risks of hallucination and bias. It introduces a new requirement for organisations to conduct a Data Protection Impact Assessment (DPIA) before deploying any generative AI system that processes personal data at scale. This requirement mirrors similar obligations in other jurisdictions and is now considered a baseline expectation by the PCPD.

The HKMA issued a circular on the use of AI in credit risk assessment, requiring authorised institutions to document the rationale for AI-driven credit decisions and to provide customers with a meaningful explanation when a credit application is declined. This obligation flows from the Code of Banking Practice and the HKMA';s supervisory expectations rather than from a specific statute, but non-compliance can trigger supervisory action.

The SFC updated its guidance on virtual asset trading platforms to address AI-driven market-making and order-routing systems. Platforms licensed under the new virtual asset regulatory regime must now demonstrate that their AI systems comply with the same standards applied to traditional algorithmic trading.

The government published a policy statement on responsible AI development, committing to a set of principles including transparency, accountability, fairness, and human oversight. While the policy statement does not create binding legal obligations, it signals the direction of future regulation and is likely to inform the drafting of any future AI-specific legislation.

A common mistake among foreign businesses entering Hong Kong is to assume that the absence of a single AI Act means there are no meaningful compliance obligations. In practice, the sector-specific guidance from the HKMA, SFC, and PCPD creates a dense web of expectations that can expose businesses to regulatory risk if ignored.

If your business is assessing its AI compliance position in Hong Kong, we can help structure the review correctly from the outset. Contact us at info@vlolawfirm.com.

The Personal Data (Privacy) Ordinance (Cap. 486) is the primary statute governing the use of personal data in AI systems. Its six Data Protection Principles (DPPs) apply to any organisation that collects, holds, processes, or uses personal data in Hong Kong, regardless of where the organisation is incorporated.

DPP 1 requires that data be collected for a lawful purpose directly related to the organisation';s functions and that the data subject be informed of the purpose at the time of collection. For AI systems, this means that organisations must clearly disclose when personal data will be used to train or operate an AI model. A non-obvious requirement is that this disclosure obligation applies even when the AI model is operated by a third-party vendor - the data controller remains responsible.

DPP 3 restricts the use of personal data to the purpose for which it was collected. This creates a significant constraint on AI development: data collected for one purpose cannot simply be repurposed to train a new model without fresh consent or a compatible purpose analysis. Many organisations underestimate this restriction when building AI systems from existing customer datasets.

DPP 4 requires data security measures proportionate to the harm that could result from unauthorised access. For AI systems, this includes securing training data, model weights, and inference outputs. The PCPD has indicated that it will scrutinise AI-related data breaches with particular attention to whether adequate security measures were in place.

The PCPD';s AI framework supplements these statutory obligations with specific recommendations on human oversight. Organisations are expected to ensure that consequential decisions - those affecting employment, credit, insurance, or access to services - are subject to human review before being implemented. This expectation is not yet codified in statute, but the PCPD has signalled that it will consider the absence of human oversight as an aggravating factor in any enforcement action.

Practical scenario one: a retail bank in Hong Kong deploys an AI model to assess mortgage applications. The model uses customer transaction history, credit bureau data, and property valuation inputs. Under the current framework, the bank must disclose the use of AI in its application process, conduct a DPIA, document the model';s decision logic, and ensure that a human officer reviews any declined application before the decision is communicated to the customer.

Practical scenario two: a technology company based outside Hong Kong operates a recruitment platform that uses AI to screen CVs submitted by Hong Kong residents. Even though the company has no physical presence in Hong Kong, the PCPD takes the position that the Ordinance applies to any organisation that controls the use of personal data relating to Hong Kong residents. The company must comply with the DPPs and should appoint a local representative to handle data subject requests.

Financial services is the sector where AI regulation in Hong Kong is most developed. Both the HKMA and the SFC have issued detailed guidance, and both have demonstrated a willingness to take supervisory action against firms that fall short of their expectations.

The HKMA';s model risk management framework applies to all AI and machine learning models used in credit assessment, market risk, liquidity management, and fraud detection. Authorised institutions are required to maintain a model inventory that records the purpose, inputs, outputs, and validation status of each model. Models must be validated by a function independent of the development team before deployment, and re-validated whenever there is a material change to the model or its operating environment.

The HKMA has also addressed the use of AI in customer-facing applications, including chatbots and virtual assistants. Institutions must ensure that customers are informed when they are interacting with an AI system rather than a human agent. Disclosures must be clear and prominent, not buried in terms and conditions. A common mistake is to treat this as a one-time disclosure at account opening rather than a real-time notification at the point of interaction.

The SFC';s conduct requirements for AI-driven investment advice focus on suitability and transparency. Licensed corporations using robo-advisory platforms must conduct the same suitability assessment as a human adviser and must be able to demonstrate that the AI';s recommendations are consistent with the client';s investment objectives and risk tolerance. The SFC has indicated that it will hold the licensed corporation responsible for the AI';s outputs, even where the underlying model is provided by a third party.

For virtual asset trading platforms, the SFC';s licensing conditions require that AI systems used in trading or market-making be subject to pre-trade risk controls, including position limits and automated circuit breakers. Platforms must also maintain audit logs sufficient to reconstruct any AI-driven trading decision.

Many underestimate the documentation burden associated with these requirements. Building a compliant AI governance framework in financial services requires investment in model documentation, validation infrastructure, and ongoing monitoring - not just a one-time compliance exercise.

Hong Kong';s regulatory framework for AI is likely to become more structured in the coming years. Several developments point in this direction.

The government has indicated that it is monitoring international developments, including the EU AI Act, the UK';s sector-based approach, and the frameworks emerging in Singapore and mainland China. While Hong Kong is unlikely to adopt a comprehensive AI Act in the near term, officials have signalled that binding rules may be introduced for high-risk AI applications, particularly in financial services, healthcare, and critical infrastructure.

The PCPD has indicated that it intends to issue further guidance on automated decision-making, including a right for data subjects to request human review of consequential AI decisions. This would represent a significant expansion of data subjects'; rights under the Ordinance and would impose new operational obligations on organisations that rely heavily on automated processes.

The HKMA is expected to issue updated guidance on the use of AI in anti-money laundering (AML) and know-your-customer (KYC) processes. Current guidance encourages the use of AI in transaction monitoring but requires institutions to ensure that AI-generated alerts are reviewed by qualified compliance staff. Future guidance is likely to address the explainability of AML models and the obligations that arise when an AI system generates a suspicious transaction report.

The SFC is expected to update its guidance on AI in investment research, addressing the use of large language models to generate research reports and investment recommendations. Key issues include attribution, accuracy, and the risk of market manipulation through AI-generated content.

Businesses should treat the current principles-based framework not as a permanent state of affairs but as a transitional period. Organisations that build robust AI governance structures now - covering model documentation, impact assessments, human oversight, and transparency - will be better positioned to comply with any future binding rules.

For businesses that want to get ahead of these changes, we can assist with AI governance frameworks, regulatory mapping, and engagement with Hong Kong regulators. Contact us at info@vlolawfirm.com.

Does Hong Kong have a binding AI law?

Hong Kong does not currently have a standalone AI statute. Regulation is delivered through sector-specific guidance from the HKMA, SFC, Insurance Authority, and PCPD, supplemented by the Personal Data (Privacy) Ordinance. This means that binding obligations depend on the industry in which the AI system is deployed. A financial services firm faces detailed supervisory expectations from the HKMA and SFC, while a non-regulated business faces primarily data protection obligations under the Ordinance. The government has signalled that more structured rules may follow, but no binding AI Act is in force at present.

How long does it take to build a compliant AI governance framework in Hong Kong?

The timeline depends on the complexity of the AI systems in use and the maturity of the organisation';s existing compliance infrastructure. For a financial institution deploying multiple AI models, building a compliant governance framework - covering model inventory, validation, impact assessments, and disclosure procedures - typically takes several months of focused effort. For a smaller business using a single AI application, a targeted compliance review and the implementation of basic controls can often be completed more quickly. Engaging specialist legal and technical advisers at the outset reduces the risk of having to redo work as guidance evolves.

Should a foreign company with no Hong Kong office comply with Hong Kong AI rules?

Yes, in many cases. The Personal Data (Privacy) Ordinance applies to any organisation that controls the use of personal data relating to individuals in Hong Kong, regardless of where the organisation is incorporated or where its servers are located. If a foreign company';s AI system processes personal data about Hong Kong residents - for example, through a website, app, or recruitment platform - the PCPD takes the position that the Ordinance applies. Financial services regulations apply to any entity conducting regulated activities in Hong Kong, which can include cross-border digital services. Foreign companies should conduct a jurisdictional analysis before launching AI-driven products or services targeting Hong Kong users.

Hong Kong';s approach to AI regulation is practical and sector-focused, but it is not permissive. Businesses that treat the absence of a single AI Act as a signal that compliance is optional do so at real risk. The PCPD, HKMA, and SFC each have meaningful enforcement powers, and all three have demonstrated a willingness to use them. The direction of travel is toward greater structure and, eventually, binding rules for high-risk applications.

VLO Law Firms advises international clients on AI regulation in Hong Kong. We can assist with regulatory mapping, AI governance frameworks, data protection impact assessments, and engagement with the PCPD, HKMA, and SFC. To request a consultation, contact: info@vlolawfirm.com