AI Governance in Hong Kong: PCPD, SFC, HKMA, and the China AI Regulation Intersection

Hong Kong's distinct AI regulatory position

Hong Kong operates its own legal system under the Basic Law and the "one country, two systems" principle. For AI governance, this means Hong Kong organisations are subject to Hong Kong law — primarily the Personal Data (Privacy) Ordinance (PDPO) — rather than Mainland China's CAC-administered regulatory stack. However, organisations operating across both Hong Kong and the Mainland must understand both frameworks.

The PDPO is enforced by the Office of the Privacy Commissioner for Personal Data (PCPD). The PCPD has issued AI-specific guidance, including an Ethical Accountability Framework for Hong Kong and a model AI governance framework document developed with the financial services sector. These are voluntary frameworks, not legislation, but they carry significant weight with regulators and enterprise buyers.

Financial sector: HKMA and SFC

Hong Kong's financial regulators are the most active AI governance authorities. The Hong Kong Monetary Authority (HKMA) has issued circulars on AI governance for authorised institutions covering model risk management, algorithm testing, and customer disclosure when AI influences financial decisions. The Securities and Futures Commission (SFC) has addressed AI in algorithmic trading, portfolio management, and financial analysis — including rules on disclosure when AI generates investment advice or research.

The Mainland dimension

Hong Kong financial institutions with Mainland operations face a dual-compliance environment that has no close parallel elsewhere. On the Hong Kong side, PDPO and HKMA/SFC apply with common-law principles. On the Mainland side, PIPL, DSL, and CAC's AI-specific regulations (Algorithm Recommendations, Deep Synthesis, Generative AI) apply with very different legal foundations — including strict data localisation requirements and content control obligations that have no equivalent in Hong Kong law. Organisations with significant cross-boundary operations need governance architectures designed for both systems simultaneously.