Contact usGet started

Frameworks · Hong Kong

AI governance frameworks and regulation in Hong Kong

Hong Kong governs AI without an AI-specific law. The Personal Data (Privacy) Ordinance applies to AI that uses personal data, with the PCPD's AI framework showing how. Financial regulators set the most detailed expectations, through the HKMA's 2026 ART guidance for banks and the SFC's circular for licensed corporations, and the Digital Policy Office publishes non-binding ethical AI guidance.

Who regulates AI here

Hong Kong

Hong Kong publishes an ethical AI framework for government and a generative AI guideline for developers, providers and users, with privacy guidance for organisations from the PCPD.

Regulator guidancePCPD AI Model FrameworkArtificial Intelligence: Model Personal Data Protection FrameworkHong Kong PCPD's AI Model Personal Data Protection Framework of June 2024. Guidance for organisations buying and using AI, with risk-based human oversight.Published 11 June 2024. Recommended best practice under the Personal Data (Privacy) Ordinance. Not itself binding.Public sector policyHong Kong GenAI Guideline and Ethical AI FrameworkHong Kong Generative AI Technical and Application Guideline and Ethical AI FrameworkThe Digital Policy Office's Generative AI Guideline and Ethical AI Framework for Hong Kong. Twelve principles, an AI impact assessment and practical guidance.Generative AI Guideline issued 15 April 2025, version 1.1 December 2025. Ethical AI Framework version 2.0 December 2025. Non-binding.Regulator guidanceHKMA ART guidanceHKMA Supervisory Guidance for Responsible Adoption of Artificial IntelligenceThe HKMA's October 2026 supervisory guidance on AI for Hong Kong banks. Nine principles across accountability, resilience and trust, and what each one asks.Issued 15 October 2026 to all authorized institutions. Supersedes the HKMA's High-level Principles on Artificial Intelligence of 1 November 2019.Regulator guidanceSFC generative AI circularSFC circular to licensed corporations on the use of generative AI language modelsThe SFC circular on generative AI language models for Hong Kong licensed corporations. Its four core principles, high-risk uses and SFC notification.Issued 12 November 2024 and in effect. Reinforced by the SFC's circular of 2 June 2026 on AI-enabled cyberattacks.

All Hong Kong frameworks

International

Standards and frameworks that apply across borders. Most organisations use one of these as the backbone of their AI governance, whatever their jurisdiction.

StandardISO/IEC 42001ISO/IEC 42001:2023 AI management systemsISO/IEC 42001 is the certifiable international standard for an AI management system. What it requires, how Annex A works and how to get ready to certify.Published December 2023, current editionIn Aicura from ProStandardISO/IEC 42005ISO/IEC 42005:2025 AI system impact assessmentISO/IEC 42005 is international guidance on assessing how an AI system affects people and society, when to assess, what to record and how it links to 42001.Published May 2025, current editionVoluntary frameworkNIST AI RMFNIST AI Risk Management Framework (AI RMF 1.0)The NIST AI RMF is a voluntary framework for managing AI risk through four functions, Govern, Map, Measure and Manage. What it asks and who uses it worldwide.Version 1.0 current, revision under wayIn Aicura from ProVoluntary frameworkNIST Generative AI ProfileNIST AI RMF Generative AI Profile (NIST AI 600-1)NIST AI 600-1 applies the AI Risk Management Framework to generative AI. Its 12 risks, the suggested actions behind them and who uses the profile and why.Final, published July 2024StandardISO/IEC 23894ISO/IEC 23894:2023 Guidance on AI risk managementISO/IEC 23894 adapts the ISO 31000 risk process to AI. What the guidance covers, its AI risk sources and lifecycle mapping, and how it fits with ISO 42001.Published February 2023, current editionStandardISO/IEC 38507ISO/IEC 38507:2022 Governance implications of the use of AI by organizationsISO/IEC 38507 is guidance for boards on governing an organisation's use of AI. What it asks of directors, how it links to ISO/IEC 38500 and who uses it.Published April 2022, current editionVoluntary frameworkOECD AI PrinciplesOECD Recommendation of the Council on Artificial Intelligence (OECD AI Principles)The OECD AI Principles are the intergovernmental standard for trustworthy AI, adopted 2019 and revised 2024. The five principles and how to apply them.Adopted May 2019, revised May 2024Voluntary frameworkHUDERIAHUDERIA: Risk and impact assessment of AI systems for human rights, democracy and the rule of lawHUDERIA is the Council of Europe's method for assessing AI risks to human rights, democracy and the rule of law. Its four elements, scoring and who uses it.Methodology and Model adopted, non-bindingLawCouncil of Europe AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)The Council of Europe AI Convention is the first binding international treaty on AI. Who has signed and ratified, what it asks of parties and when it applies.Open for signature, not yet in forceVoluntary frameworkG7 Hiroshima Code of ConductHiroshima Process International Code of Conduct for Organizations Developing Advanced AI SystemsThe G7 Hiroshima Code of Conduct sets 11 voluntary actions for advanced AI developers, with OECD HAIP reporting. What it asks and who reports under HAIP 2.0.Voluntary, reporting framework v2.0 liveVoluntary frameworkUNESCO AI Ethics RecommendationUNESCO Recommendation on the Ethics of Artificial IntelligenceUNESCO's Recommendation on the Ethics of AI is the global standard its member states adopted in 2021. Its values, principles and Ethical Impact Assessment.Adopted November 2021

All International frameworks

Aicura in Hong Kong

Frameworks elsewhere

Guides

Questions

Does Hong Kong have an AI law?

No. Hong Kong has no AI-specific law. AI is governed through the Personal Data (Privacy) Ordinance, sector regulators' guidance and the Digital Policy Office's non-binding frameworks.

What AI guidance applies to Hong Kong banks?

The HKMA's Supervisory Guidance for Responsible Adoption of Artificial Intelligence, issued on 15 October 2026 under its ART Framework, which superseded the 2019 high-level principles. The HKMA's 2024 circular on consumer protection in the use of generative AI also applies to customer-facing uses.

Is the PCPD AI framework mandatory?

The framework itself is recommended practice rather than law. The Personal Data (Privacy) Ordinance it explains is binding, and the HKMA and SFC both point their regulated firms to it.

What does the SFC expect of firms using generative AI?

Its November 2024 circular sets four core principles covering senior management responsibility, model risk management, cybersecurity and data risk, and third-party provider risk. Using AI for investment advice or research to clients is treated as high risk and needs extra safeguards and notification to the SFC.

Start with the AI you run.

Every framework begins with knowing which AI systems and agents you have. The AI register is free to start.

Sign upContact us