AI Governance in Hong Kong: PCPD, SFC, HKMA, and the China AI Regulation Intersection

Hong Kong operates a distinct AI governance framework under common law, with PCPD enforcing the Personal Data (Privacy) Ordinance, SFC and HKMA setting financial sector expectations, and increasing alignment with Mainland China's CAC regulations creating a unique dual-compliance environment.

Key Takeaways

Hong Kong operates under its own common law system distinct from Mainland China — the Personal Data (Privacy) Ordinance (PDPO) governs data protection, not PIPL.
The PCPD (Office of the Privacy Commissioner for Personal Data) has issued guidance on AI and data protection, including model AI governance frameworks for financial institutions.
SFC and HKMA have both issued circulars on AI governance in financial services — algorithmic trading, credit decisioning, and AI-generated financial analysis are all in scope.
Hong Kong financial institutions with Mainland China operations face dual compliance: HKMA/SFC on the HK side, CAC and PIPL on the Mainland side. These frameworks have fundamental differences in approach.
Hong Kong's unique position means EU AI Act obligations may apply to HK companies serving EU clients, while also navigating Mainland regulatory alignment pressures.

"情報提供のみを目的としています。この記事は法律、規制、財務または専門的なアドバイスを構成するものではありません。具体的なアドバイスについては、資格を持つ専門家にご相談ください。"

Hong Kong's AI governance landscape — voluntary frameworks plus binding privacy law

Hong Kong does not have a dedicated AI Ordinance as of mid-2026. AI governance in Hong Kong operates through a combination of voluntary guidelines from the PCPD and the Digital Policy Office, sector-specific guidance from financial regulators (HKMA, SFC, Insurance Authority), and binding obligations under the Personal Data (Privacy) Ordinance (PDPO) where AI systems process personal data. Most businesses that discover an AI compliance problem find the root cause is a PDPO compliance gap, not a missing AI-specific rule.

The direction of travel is clear. The PCPD's 2025 compliance checks found 80% of organisations using AI in day-to-day operations (48 of 60 surveyed) — up from 75% in 2024. The PCPD has issued progressive guidance: ethical AI principles (August 2021), Model Personal Data Protection Framework (June 2024), Checklist on Guidelines for Generative AI by Employees (March 2025), and most recently in March 2026, agentic AI security guidance prompted by the OpenClaw platform vulnerabilities. The PCPD's stated focus for 2026 is shifting from education to enforcement.

The PDPO and what it requires when AI processes personal data

The Personal Data (Privacy) Ordinance is the binding legal framework. It applies any time personal data belonging to Hong Kong residents is processed — including when staff members feed customer enquiries, contact details, or other personal information into an AI platform. Six Data Protection Principles apply: lawful collection with clear purpose (DPP1), accuracy and retention (DPP2), use limited to the original purpose (DPP3), security of personal data (DPP4), transparency about practices (DPP5), and data subject access and correction rights (DPP6).

For AI specifically, the PCPD's guidance identifies four core risk areas: inputting personal data into third-party AI tools (often a DPP3 use limitation issue if the original collection purpose did not contemplate AI processing); training AI on personal data (requires lawful basis and is often a DPP1 issue if not appropriately disclosed at collection); AI outputs that reveal or infer personal data about identifiable individuals; and cross-border data transfer when AI services are hosted outside Hong Kong (DPP3 considerations and recent PCPD Section 33 enforcement). PDPO penalties can reach HK$1 million plus criminal liability for serious breaches.

The Model Personal Data Protection Framework for AI (June 2024)

The PCPD's Model Framework is the most directly relevant guidance for any Hong Kong organisation using AI. It is voluntary, but non-compliance with the framework will be taken as evidence of insufficient care in any subsequent PDPO investigation. The framework structures AI governance around four areas: AI strategy and governance (board-level oversight, named accountability, organisational structures); risk assessment (pre-deployment PIAs, ongoing risk monitoring); AI model lifecycle management (data preparation, model development, deployment, monitoring, retirement); and stakeholder engagement (transparency with data subjects, complaint handling, internal training).

The 2025 compliance check findings demonstrate what the PCPD expects in practice: 83% of personal-data-using organisations conducted PIAs pre-implementation; 96% conducted pre-deployment testing for reliability, robustness, and fairness; 79% had established AI governance structures with named responsible personnel; most had AI-specific incident response plans referenced in their data breach response. These are the benchmarks organisations should aim for.

Sector-specific guidance — financial services lead the way

Financial services regulators in Hong Kong have been most active. The HKMA issued circulars on use of GenAI in customer-facing applications (consumer protection guiding principles for authorised institutions) and on AI in AML/CFT monitoring systems. The 19 November 2025 HKMA circular noted 48 authorised institutions had completed feasibility studies for AI in ML/TF monitoring, with most concluding AI was useful in making systems more risk-based. The HKMA's 16 March 2026 circular observed AI use in optimising sanctions screening. The Securities and Futures Commission (SFC) issued a circular on Generative AI Language Models to Licensed Corporations, requiring LCs to critically review existing policies, procedures, and internal controls. The Insurance Authority indicated in August 2025 that updated guidelines on AI use in the insurance sector are forthcoming.

The Digital Policy Office (DPO) frameworks

The Digital Policy Office (formerly OGCIO) leads on AI strategy and government adoption. The DPO's Ethical AI Framework (July 2024) was developed for internal government adoption but is published for general organisational use. The framework includes ethical principles, AI governance model, lifecycle guide, and impact assessment template — all voluntary. The DPO's Generative AI Technical and Application Guideline (most recently updated December 2025) frames five governance dimensions for GenAI: personal data privacy, intellectual property, crime prevention, system security, and ethical use.

Critical infrastructure cybersecurity — the new regime

The Protection of Critical Infrastructures (Computer System) Ordinance (PCICSO) was gazetted on 28 March 2025 and came into force 1 January 2026. It adds a cybersecurity layer for organisations designated as operating critical infrastructure — including financial services, energy, transport, healthcare, and telecommunications. For AI systems deployed in critical infrastructure environments, the PCICSO requires cybersecurity incident response plans that specifically cover AI-related vulnerabilities. Tanner De Witt's January 2026 analysis noted that Security Bureau activity under PCICSO will likely lead to increased PCPD regulatory activity in parallel.

Agentic AI — the PCPD's emerging priority

The PCPD has specifically flagged agentic AI as a new risk category, prompted by the rapid adoption of OpenClaw and similar platforms since November 2025. Researchers identified multiple security vulnerabilities in OpenClaw including a critical one-click remote code execution flaw and command injection vulnerabilities. Cybersecurity firm Censys found over 21,000 OpenClaw instances exposed to the internet, many leaking unencrypted API keys, login tokens, and credentials. Approximately 12% of skills on OpenClaw's public marketplace (ClawHub) contained malware. The PCPD's response was specific guidance for enterprise governance: formal governance arrangements, least-privilege access, active detection of unauthorised "shadow" agents through network scanning, central registers of approved agents, and staff training on prompt-injection and credential leakage risks.

Practical compliance for Hong Kong businesses

For SMEs and larger organisations, the practical baseline is: review which AI tools are in use and whether they process personal data; ensure use is consistent with the original purpose of data collection or update privacy policies; conduct a PIA before deploying new AI systems that process personal data; implement the PCPD checklist for Gen AI use by employees (scope of permissible use, permissible inputs, output storage, ethical guardrails, breach consequences); designate a named person responsible for AI governance; and reference the Model Framework in AI governance documentation. For financial services firms, additional documentation, pre-deployment risk assessments, and audit-ready records demonstrating accountability for AI-driven customer-impacting decisions are expected. Hong Kong's 2026 prospects point to enforcement: organisations that have implemented these foundations now will be substantially better positioned than those waiting for legislation.

Further reading: OECD AI Policy Observatory