Hong Kong | Herbert Smith Freehills

Policy

AI regulation

AI-related law and regulation

Sector-specific AI regulations

Case law

11 Mar 2025 Insight

Reports and highlights

Hong Kong currently has no dedicated AI regulation, instead opting to rely on sectoral guidance from various regulators and government bodies which would apply depending on the context. These include the Digital Policy Office, the Office of the Privacy Commissioner for Personal Data, the Commerce and Economic Development Bureau, the Intellectual Property Department, the Financial Services and the Treasury Bureau, the Securities and Futures Commission, the Hong Kong Monetary Authority, the Insurance Authority, the Mandatory Provident Fund Schemes Authority and the Accounting and Financial Reporting Council.

Hong Kong wishes to develop artificial intelligence into one of its core industries. In February 2025, Hong Kong committed HK$1 billion (approximately $128 million) to establish the Hong Kong AI Research and Development Institute. In July 2024, the Digital Policy Office issued the Ethical Artificial Intelligence Framework (Version 1.4). The framework was originally developed to assist government bureaux/departments (B/Ds) in planning, designing and implementing AI and big data analytics in their IT projects and services. It consists of the following key components:

A tailored AI framework that provides a set of ethical AI principles, an AI governance structure, an AI lifecycle and an AI practice guide.
An AI assessment that includes a template for organisations to assess the benefits, impact, and risks of using AI applications. An AI application impact assessment is used to assess AI applications to ensure that the impact across the AI lifecycle is managed and that related ethical AI principles have been considered.
Existing standards and practices (for example, project management, IT security standards) should be used as part of the overall framework for managing IT projects; AI applications will be a subset of these projects.

The AI assessment template is to be used by B/Ds at the application level to support them on their management of the benefits, impact and risks of using AI. However, the Ethical AI Framework is also available for use by other organisations on a voluntary basis, and can be customised for general reference when adopting AI and big data analytics in IT projects.

Certain significantly harmful AI practices are expressed to be prohibited as they contravene prevailing regulations and laws pertaining to, in particular, personal data protection, privacy, intellectual property rights, discrimination and national security. In addition to the Ethical AI Framework, various policy statements have also been issued in relation to specific industries, including banking and finance, insurance, and sales of medical devices.

Currently, there is no AI-specific regulation or legislation in place in Hong Kong.

From consumer protection law to online safety, AI continues to stretch existing legal frameworks. See the latest updates below.

In August 2021, the Privacy Commissioner for Personal Data (PCPD) - the Hong Kong data protection regulator - issued Guidance on the Ethical Development and Use of Artificial Intelligence.

The objectives of this guidance are to facilitate the healthy development and use of AI in Hong Kong and assist organisations in complying with the provisions of the Personal Data (Privacy) Ordinance (PDPO) in their development and use of AI. The PDPO is the key data protection legislation which requires organisations processing personal data to comply with principles of fairness, transparency, purpose limitation, minimisation, accuracy, accountability, storage and security, among others.

The guidance applies to all data users and compliance with the guidance is voluntary. It recommends that organisations embrace three fundamental data stewardship values when they develop and use AI, namely being respectful, beneficial, and fair to stakeholders. In line with international standards, the guidance sets out the following seven ethical principles for AI:

Accountability: organisations should be responsible for what they do and be able to provide sound justifications for their actions.
Human oversight: organisations should ensure that appropriate human oversight is in place for the operation of AI.
Transparency and interpretability: organisations should disclose their use of AI and relevant policies while striving to improve the interpretability of automated decisions and decisions made with the assistance of AI.
Data privacy: effective data governance should be put in place.
Fairness: organisations should avoid bias and discrimination in the use of AI.
Beneficial AI: organisations should use AI in a way that provides benefits and minimises harm to stakeholders.
Reliability, robustness, and security: organisations should ensure that AI systems operate reliably, can handle errors and are protected against attacks.

To support the Global AI Governance Initiative of China, in June 2024, the PCPD published the Artificial Intelligence: Model Personal Data Protection Framework, which targets organisations procuring, implementing and using AI systems that involve the use of personal data. The model framework provides internationally well-recognised and practical recommendations and best practices to assist organisations to procure, implement, and use AI (including generative AI) in compliance with the relevant requirements of the PDPO, so that organisations can harness the benefits of AI while safeguarding personal data privacy. Its recommended measures are in the following four areas:

Establish AI strategy and governance. Formulate the organisation’s AI strategy and governance considerations for procuring AI solutions, establish an AI governance committee (or similar body), and provide employees with training relevant to AI.
Conduct risk assessment and human oversight. Conduct comprehensive risk assessments, formulate a risk management system, adopt a 'risk-based' management approach, and - depending on the levels of the risks posed by AI - adopt proportionate risk mitigating measures, including deciding on the level of human oversight.
Customisation of AI models and implementation and management of AI systems. Prepare and manage data (including personal data) for customisation and use of AI systems, test and validate AI models during the process of customising and implementing AI systems, ensure system security and data security, and manage and continuously monitor AI systems.
Communication and engagement with stakeholders. Communicate and engage regularly and effectively with stakeholders - in particular internal staff, AI suppliers, individual customers and regulators - to enhance transparency and build trust.

On 8 July 2024, the Hong Kong Government - through the Commerce and Economic Development Bureau (CEDB) and the Intellectual Property Department (IPD) - launched a two-month public consultation that explores the enhancement of the Copyright Ordinance regarding the protection for AI technology development.

Under the existing Copyright Ordinance, works generated by AI are already protected by copyright. The consultation document investigates copyright protection of AI-generated works, copyright infringement liability for AI-generated works, the possible introduction of a specific copyright exception, and various other issues relating to generative AI.

The consultation paper proposes to introduce a new copyright infringement exception to allow reasonable use of copyright works for text and data mining, and computational data analysis and processing, for the training of AI models. The consultation period has now concluded, and a paper was submitted to the Legislative Council for discussion on 16 July 2024.

The Hong Kong Competition Commission (HKCC) – the principal competition authority in Hong Kong – does not have direct consumer protection powers outside of its competition law remit. Whilst conduct affecting digital markets remains one of the HKCC's three enforcement priorities, we are yet to see any AI-specific guidance or cases so far.

Hong Kong has established an open environment for foreign direct investment, characterised by minimal restrictions and a strong commitment to free market principles. In addition, there are no quota or tariff policies affecting AI and robotics trade with Mainland China, positioning Hong Kong as a strategic bridge for companies aiming to access the Mainland market.

Financial Services

There is no central framework for regulating the use of AI in the financial services sector in Hong Kong. Instead, the Securities and Futures Commission (SFC) and Hong Kong Monetary Authority (HKMA) have published circulars and guidelines to outline their regulatory expectations in this area.

The Financial Services and the Treasury Bureau issued a Policy Statement on the Responsible Application of Artificial Intelligence in the Financial Market on 28 October 2024, setting out the government's approach towards the responsible application of AI in the financial market. It includes the government's 'dual-track' approach to promote the development of AI and address potential challenges, current opportunities and use cases for AI, and the types of risks associated with the use of AI and corresponding measures to mitigate those risks. The policy statement provides that financial institutions should formulate an AI governance strategy and adopt a risk-based approach in the procurement, use, and management of AI systems, with human oversight to mitigate the potential risks.

The SFC has not yet published extensive guidance on the role of AI in the financial services sector. However, on 12 November 2024, it issued a circular on the use of generative AI language models that set out the SFC's expectations for licensed corporations that offer services or functionality provided by Generative AI language models (including as part of third party products) in respect of their regulated activities. It identified four core principles that licensed corporations may implement in a risk-based manner, specifically senior management responsibilities, AI model risk management, cybersecurity and data risk management, and third party provider risk management; the Appendix to the circular further lists non-exhaustive risk factors tied to each core principle. Asides from the circular, the SFC is participating in the International Organisation of Securities Commissions' Fintech Task Force AI Working Group - as part of which it will keep under review any findings or recommendations from such organisation to consider whether further regulatory guidance to SFC-licensed firms is necessary.

The HKMA has taken a more proactive role in issuing guidelines and circulars pertaining to the role of AI in the financial services industry for all authorised institutions. On 1 November 2019, it issued a circular that set out high-level principles to the banking industry on the use of AI applications, covering their governance, application design and development, and monitoring and maintenance. These principles are supplemented by publications including:

A research paper titled Generative Artificial Intelligence in the Financial Services Space, published on 27 September 2024, which explores the transformative potential of generative AI and its implications for the financial industry, particularly in terms of operational efficiency, risk management, and customer engagement.
A circular and Annex, issued on 9 September 2024, to explain how the use of AI can improve the effectiveness and efficiency of monitoring money laundering and terrorist financing risks. It also sets out the actions that the HKMA is taking to further support and accelerate the use of AI in authorised institutions’ monitoring processes – for example, establishing a dedicated team to provide supervisory feedback and technical guidance to assist authorised institutions in applying AI in enhancing their monitoring processes.
A circular, issued on 19 August 2024, to provide guiding principles on the use of GenAI in customer-facing applications from a consumer protection perspective. These build on the guiding principles, the HKMA issued on 5 November 2019 in respect of the use of big data analytics and AI, focussing on four key aspects: governance and accountability, fairness, transparency and disclosure, and data privacy and protection.
An insight article, shared on 23 May 2024, regarding the implications of AI on manpower management in the banking industry. In this context, the HKMA will publish an updated study on "Capacity Building for Future Banking" in 2025 to identify skills gaps in the banking industry for the next five years (2026 - 2030).
A thematic review, published on 17 April 2024, of the design, implementation and optimisation of transaction monitoring systems. The review included an examination of how AI is used to optimise transaction monitoring systems and provided anti-money laundering and counter-financing of terrorism specific guidance based on industry best practices.

From a more practical perspective, the HKMA has invited authorised institutions to participate in the GenAI Sandbox initiative launched in August 2024 in collaboration with the Hong Kong Cyberport Management Company Limited. The GenAI Sandbox aims to promote responsible innovation in GenAI and will empower banks to pilot GenAI use cases within a risk-managed framework.

In addition:

In 2023, the Insurance Authority outlined the responsibilities of insurers and intermediaries regarding the use of chatbots under the 'regulated activities' regime, reminding them to uphold the principles of fair customer treatment and enable fully informed customer decisions. The Insurance Authority is enhancing its Guideline on Cybersecurity by developing a Cyber Resilience Assessment Framework specific for the insurance sector. It will also conduct a Fintech survey to evaluate current technology adoption trends in the insurance sector, focusing on AI and related cybersecurity measures.
In February 2024, the Mandatory Provident Fund Schemes Authority (MPFA) issued a circular to its regulatees providing guidance on offering robo-advisor service. It will keep monitoring the adoption of AI in the pension industry and issue further or updated guidance if necessary having regard to the market and regulatory development.
The Accounting and Financial Reporting Council (AFRC) is the independent regulator of the accounting profession. It will assess the emerging opportunities and potential risks associated with the development of AI by audit firms. Guidance will be developed to enhance awareness and support AI deployment by the accounting profession with an emphasis on the importance of upholding audit quality while ensuring alignment with quality management standards.

Healthcare

On 3 January 2024, Hong Kong’s Medical Device Division (MDD) of the Department of Health issued a Technical Reference document TR-008: Artificial Intelligence Medical Devices which provides clarity for devices using AI and machine learning - including continuous learning capability - and the technical requirements expected for listing these medical devices on the Medical Device Administrative Control System. This document applies to all AI medical devices that fall within the scope of the Medical Device Administrative Control System.

Explore the latest landmark rulings as AI-related disputes make their way through the courts.

In progress

Dr Yeung Sau Sing Albert v Google Inc [2014] 4 HKLRD 493. Dr Yeung Sau Sing Albert brought an action for defamation on the basis that entering his name into Google Search generated suggested words that were defamatory to him by implying his involvement in criminal activities. The Court of First Instance allowed Dr Albert's claim to proceed past a summary dismissal application on the basis that Google designed and set up a search engine using autocomplete and related search features using AI, and there was an arguable case that Google was a "publisher" of the defamatory material (rather than a mere conduit or passive facilitator). Find out more in our blog post. This decision is currently being appealed by Google.

Key contacts

Hannah Cassidy

Partner, Head of Financial Services Regulatory, Asia, Hong Kong

Leanette Ko

Associate, Hong Kong

Peggy Chow

Of Counsel, Singapore

Tommy Tong

Partner, Hong Kong

Legal Notice

The contents of this publication are for reference purposes only and may not be current as at the date of accessing this publication. They do not constitute legal advice and should not be relied upon as such. Specific legal advice about your specific circumstances should always be sought separately before taking any action based on this publication.

Stay in the know

We’ll send you the latest insights and briefings tailored to your needs

Subscribe now

Follow us

Follow us