AI regulation in Hong Kong: laws & policy (2026)

The HKMA, SFC, Insurance Authority and MPFA jointly expanded the generative-AI sandbox to banking, securities, insurance, asset management and MPF, offering supervisory guidance and GPU compute for risk-controlled AI piloting. It signals a coordinated, cross-sector 'innovate-and-supervise' posture for finance.

The HKMA admitted a second cohort focused on 'AI vs AI' defences and deepfake-related fraud, building supervisory experience before issuing firmer expectations. It shows AI governance in banking is being developed iteratively through experimentation.

The DPO published a voluntary best-practice guideline for the ethical, safe and responsible development, deployment and use of generative AI, targeting developers, platform providers and users. It is the government's central cross-sector reference for GenAI and was later updated in December 2025.

The Privacy Commissioner issued a checklist to help organisations craft internal policies governing employee use of GenAI in compliance with the Personal Data (Privacy) Ordinance. It extends Hong Kong's AI privacy guidance from organisational deployment down to day-to-day workplace use.

Run with Cyberport, the first sandbox cohort let banks trial generative-AI use cases under HKMA observation, informing later supervisory guidance. It marked the start of Hong Kong's structured, hands-on approach to AI in banking.

The Securities and Futures Commission required licensed corporations using GenAI language models to manage model risk, ensure senior-management oversight, address cyber/data risks and vet third parties, treating investment advice as a high-risk use case demanding human oversight. It set binding regulatory expectations for AI in securities markets.

The Financial Services and Treasury Bureau set out a 'dual-track' approach promoting AI adoption while mitigating cybersecurity, IP and data-privacy risks across the financial sector. It is the government's overarching policy frame for AI in finance.

The HKMA gave authorized institutions specific GenAI expectations for customer-facing applications, including opt-out/human-intervention rights and continuous output monitoring, extending its 2019 BDAI principles. It tailored bank AI governance to generative models.

The DPO published a framework with ethical principles, an AI governance model, a lifecycle guide and an impact-assessment template for AI projects (initially aimed at the public sector). It anchored the government's own ethical-AI baseline.

The Privacy Commissioner published the Asia-Pacific region's first comprehensive AI-specific data-protection framework, guiding organisations on procuring, deploying and governing AI (including generative AI) in line with the PDPO. It is Hong Kong's flagship AI privacy-governance reference.

The Privacy Commissioner set out three data-stewardship values and seven internationally recognised ethical AI principles to help organisations comply with the PDPO when developing or using AI. It established the foundational ethics-by-design approach Hong Kong still follows.

The HKMA's circular set out twelve principles for banks adopting AI, making boards and senior management accountable for governance, explainability, data quality and risk management. It was Hong Kong's earliest sector-specific AI regulatory guidance and underpins later banking AI rules.