Artificial IntelligenceRegulations

Hong Kong

No comprehensive lawApproach: No AI law; dense sectoral guidance, hardest in finance

Hong Kong has no comprehensive AI legislation, and none is close. Its regulators fill the space with guidance and supervision. The Digital Policy Office publishes an Ethical AI Framework and a Generative AI Technical and Application Guideline, the privacy commissioner has a model framework for AI and personal data, and the Monetary Authority and Securities and Futures Commission actively supervise AI use in financial services, where the real compliance pressure sits. The September 2026 Policy Address announced a new Commissioner for AI post and reviews of deepfake crime and AI product liability, and the government will consider deepfake legislation after Law Reform Commission recommendations.

Key points

  • No comprehensive AI statute or published plan for one.
  • The PCPD's Model Personal Data Protection Framework for AI (2024) is the reference standard for AI touching personal data; on August 25, 2026 the PCPD added guidance on protecting personal data in the use of agentic AI, with nine recommendations.
  • The Digital Policy Office's generative AI guideline gives practical direction to developers, providers, and users.
  • HKMA and SFC supervision makes financial services the most regulated AI context in the territory. On October 15, 2026 the HKMA issued new Supervisory Guidance for Responsible Adoption of AI and said a discussion paper on supervising agentic AI, including a registry of material AI agents, will follow.
  • The 2026 Policy Address announces a Commissioner for AI post, a Law Reform Commission cybercrime sub-committee review of deepfake crime that will seek public views, a Department of Justice review of AI product liability, and AI agent safety-management guidelines for 2027.

Laws and instruments

PDPO and PCPD AI frameworks (applied to AI)

Personal Data (Privacy) Ordinance, Cap. 486
In force

The privacy ordinance binds AI systems processing personal data, with the PCPD's 2024 model framework setting the expected governance controls for procurement, implementation, and oversight. Guidance of August 25, 2026, Protecting Personal Data Privacy in the Use of Agentic AI, adds nine recommendations and makes clear that organizations remain accountable under the ordinance for what their AI agents do.

Effective: Ordinance in force; AI framework published 2024; agentic AI guidance August 25, 2026
Primary source: PCPD, Model Personal Data Protection Framework for AI ↗

Timeline

  • 2019 onward
    HKMA and SFC issue AI and generative AI supervisory expectations for financial services.
  • 2024
    PCPD model framework for AI and personal data.
  • April 2025
    Digital Policy Office generative AI technical and application guideline.
  • August 25, 2026
    The PCPD issues guidance on protecting personal data privacy in the use of agentic AI, with nine recommendations.
  • September 16, 2026
    The 2026 Policy Address announces a Commissioner for AI post in the Digital Policy Office, a Law Reform Commission review of deepfake crime, and a Department of Justice-led working group on liability for AI products.
  • October 15, 2026
    The HKMA issues Supervisory Guidance for Responsible Adoption of AI under its 'ART' framework and announces a coming discussion paper on supervising agentic AI.

Who it applies to

No AI-specific statutory duties. Binding exposure runs through the privacy ordinance and, for financial firms, supervisory expectations that function as requirements in practice.

Penalties

PDPO enforcement for data-protection breaches; supervisory action for regulated financial institutions.

Recent developments

October 15, 2026
Hong Kong Monetary Authority

Hong Kong's banking regulator issues AI supervisory guidance and plans a framework for AI agents

The Hong Kong Monetary Authority announced an 'ART' framework of accountability, resilience, and trust for AI in banking, issued its latest Supervisory Guidance for Responsible Adoption of Artificial Intelligence, drawing on its generative AI sandbox, and described an AI training-data platform built with Cyberport and the University of Hong Kong. It also said it will publish a discussion paper on a supervisory framework for agentic AI that explores intent-anchored accountability, a registry of material AI agents, and intervention mechanisms.

Source ↗

Common questions

Does Hong Kong have a comprehensive AI law?
No. Hong Kong has no comprehensive AI legislation, and none is close. Its regulators fill the space with guidance and supervision. The Digital Policy Office publishes an Ethical AI Framework and a Generative AI Technical and Application Guideline, the privacy commissioner has a model framework for AI and personal data, and the Monetary Authority and Securities and Futures Commission actively supervise AI use in financial services, where the real compliance pressure sits. The September 2026 Policy Address announced a new Commissioner for AI post and reviews of deepfake crime and AI product liability, and the government will consider deepfake legislation after Law Reform Commission recommendations.
What are the penalties for AI violations in Hong Kong?
PDPO enforcement for data-protection breaches; supervisory action for regulated financial institutions.
Who does AI regulation in Hong Kong apply to?
No AI-specific statutory duties. Binding exposure runs through the privacy ordinance and, for financial firms, supervisory expectations that function as requirements in practice.
Related topics
Transparency and disclosureBiometrics and facial recognition
Cite this page

Artificial Intelligence Regulations, "AI Regulation in Hong Kong," reviewed October 26, 2026, https://artificialintelligenceregulations.com/jurisdictions/hong-kong.html.

Entries state the position as of the review date and link to the primary text for verification.