HKMA Supervisory Guidance for Responsible Adoption of Artificial Intelligence

What it is

On 15 October 2026 the Hong Kong Monetary Authority wrote to all authorized institutions about its Framework for Responsible Adoption of Artificial Intelligence. The framework rests on three pillars, Accountability, Resilience and Trust, which the HKMA abbreviates as ART. The circular, signed by Carmen Chu, Executive Director (Banking Supervision), came with three annexes.

• Annex A, the Supervisory Guidance. The HKMA’s updated supervisory expectations for AI. It supersedes the High-level Principles on Artificial Intelligence of 1 November 2019.
• Annex B, Practical Insights from the Second Cohort of the GenAI Sandbox. Observations and good practice from sandbox pilots, cross-referenced to the guidance.
• Annex C, a Concept Note on Governance of Agentic AI. Preliminary thinking on how agents should be governed, which the HKMA says will inform future supervisory requirements.

The HKMA says the guidance draws on practical experience from its GenAI Sandbox and on the Financial Stability Board’s report on sound practices for responsible adoption of AI, published the same day.

Who it applies to

All authorized institutions, meaning the banks, restricted licence banks and deposit-taking companies the HKMA supervises. The guidance asks them to apply the principles proportionately to their AI adoption, drawing on existing governance and risk management arrangements, and to read them alongside the Annex B report and other prevailing supervisory requirements. It covers AI that is built internally, provided by third parties or embedded in other products.

What it requires

The nine principles sit under the three pillars.

Accountability.

1. The board approves an AI strategy that sets the institution’s approach and risk appetite, with a governance framework that sets roles across the three lines of defence for approving use cases before deployment and managing risk after it.
2. Every deployed AI use case has an assigned owner, responsible for defining the system’s authority, overseeing controls and escalating issues. Human oversight can be human-in-the-loop, human-on-the-loop or human-in-command, with risk-based triggers for approval or intervention. The board and senior management remain accountable for the outputs.
3. An up-to-date inventory of approved AI use cases, with use of solutions outside the inventory restricted. The inventory should generally record purpose, owner, provider and model, risk classification, lifecycle and approval status, dependencies and key controls. Institutions should tell staff not to adopt unapproved tools or use approved tools for unapproved purposes, and should control shadow AI.

Resilience.

4. Management commensurate with each use case’s materiality and risk. An initial assessment decides how much review and approval a use case needs. Lifecycle expectations cover end-to-end testing against acceptance criteria, independent validation and adversarial testing for material use cases, ongoing monitoring including of AI that takes actions, credible fallback and recovery, a kill switch or equivalent for more material uses, and auditable records. For higher-risk outputs those records may include prompts, model versions and the evidence behind the reasoning.
5. Risk management that covers data governance, third-party risk and cyber risk. Contracts should stop AI providers reusing customer personal data or confidential information for training unless authorised. Institutions remain responsible for outcomes from external AI services and should assess concentration, continuity, substitutability and exit risk. Cyber controls should address data poisoning, prompt injection and safeguard bypass, and the HKMA says institutions should not rely solely on model instructions or filters.
6. Sufficient resources, expertise and role-specific training.

Trust.

7. Institutions remain accountable for AI outputs, including actions, and should define when outputs must be withheld, referred for review or blocked from triggering actions.
8. Use cases should be explainable and transparent to internal and external stakeholders in proportion to their materiality, with more explainable approaches preferred where they achieve the objective.
9. AI adoption should be ethical and fair to customers. Customers should be told when a service is powered by AI and of the relevant risks, and affected parties should be able to seek clarification, review or reassessment of outputs.

Key dates

• 1 November 2019. HKMA High-level Principles on Artificial Intelligence issued.
• 19 August 2024. HKMA circular on consumer protection in the use of generative AI.
• 5 March 2026. Joint circular on the expansion of the GenAI Sandbox into GenAI Sandbox++.
• 15 October 2026. ART Framework announced, with the Supervisory Guidance, the Practical Insights report and the agentic AI Concept Note.

The guidance sets no fixed compliance date. It asks institutions to uplift their policies, procedures and controls in a timely manner. Significant AI incidents are reported to the HKMA under existing supervisory requirements.

How it relates to other frameworks

For personal data the guidance points banks to the Personal Data (Privacy) Ordinance, and the PCPD’s AI Model Personal Data Protection Framework sets out how the privacy regulator expects that to work for AI. Banks with securities business also answer to the SFC, whose circular on generative AI language models covers licensed corporations. The Digital Policy Office’s Generative AI Guideline and Ethical AI Framework is the general, non-binding reference.

Outside Hong Kong, the structure is close to Singapore’s MAS AI Risk Management Guidelines, with an inventory, risk materiality, lifecycle controls and kill switches for high-risk uses. Institutions that run ISO/IEC 42001 or the NIST AI RMF will recognise most of the controls.

A note on this page

This is Aicura’s reading of the HKMA guidance. It is not legal or supervisory advice and it is not the guidance itself. Read the primary source on the HKMA’s Banking Policy and Supervisory Documents site, and take advice on how it applies to your institution.