Hong Kong AI Regulation 2026: Frameworks and Gaps

Hong Kong has no comprehensive AI legislation, and sector guidance plus PDPO compliance forms the current minimum compliance floor

As of mid-2026, Hong Kong still has no comprehensive AI-specific legislation. The current AI regulatory framework is led separately by a number of sector regulators, advancing through guidelines, circulars and sandbox programmes, forming a "patchwork" regulatory structure. Understanding the practical coverage and gaps of this structure is the precondition for an enterprise to set its compliance strategy when deploying AI systems in Hong Kong.

The Overall Government Framework

The Digital Policy Office (DPO) published the Ethical Artificial Intelligence Framework in 2024, but the framework applies only to the AI applications of government departments themselves and has no statutory binding force on private enterprises.

Aimed at a wider audience is the DPO's Hong Kong Generative AI Technical and Application Guideline, published in April 2025. It covers operational guidance on technical risks such as data leakage, model bias, logging and monitoring of model behaviour, is addressed to technology developers and users, and constitutes best-practice recommendations rather than statutory requirements.

On 28 October 2024 the Financial Services and the Treasury Bureau issued a policy statement urging financial institutions to adopt full-lifecycle AI risk management and comprehensive governance frameworks.

In March 2026 the Department of Justice coordinated the setting up of an inter-departmental working group to review gaps in existing legislation for supporting wider AI applications, the first mechanism to concretely advance a cross-sector AI governance assessment.

Specific Actions by Sector Regulators

The Hong Kong Monetary Authority (HKMA) has the longest AI supervisory history: in November 2019 it established four principles of governance and accountability, fairness, transparency and data privacy; on 19 August 2024 it issued a GenAI circular requiring customer-facing AI applications in banking to let customers opt out or request human intervention; on 9 March 2026 it required the boards of all licensed institutions to submit a formal technology strategy business plan by 9 September 2026; and in March and May 2026 it issued circulars on AI-driven sanctions screening and on cybersecurity threats respectively.

On 12 November 2024 the Securities and Futures Commission (SFC) issued the Circular to Licensed Corporations on the Use of Generative AI Language Models (Ref 24EC55), which is mandatory and took immediate effect. The circular is built around four core principles and requires senior management oversight across the full AI system lifecycle. The use of AI for investment advice and research is classed as a "high-risk" activity subject to stricter requirements. Submitting a written AI governance policy when applying for a licence has become part of the licence application procedure.

The Insurance Authority (IA) promotes AI adoption and pilots in the industry through its 2025 AI facilitation programme and the 2026 GenAI Sandbox++, which are facilitative policies rather than restrictive regulation.

The Office of the Privacy Commissioner for Personal Data (PCPD) extends the PDPO framework to AI data processing and is driving PDPO reform (mandatory data breach notification and administrative fines); its role in AI governance is shifting from after-the-fact enforcement to proactive compliance guidance.

Comparison with the EU AI Regulation

The EU AI Act was formally adopted in 2024, establishing a risk classification system with strict requirements for high-risk AI systems and extraterritorial reach — Hong Kong companies using AI systems in the EU market must assess their compliance obligations.

Hong Kong's gaps concentrate in three areas: no cross-sector mandatory risk classification, no AI-specific liability framework, and no mandatory AI incident reporting mechanism. These gaps formally entered the assessment agenda after the inter-departmental working group was set up in March 2026, but no timeline has been announced for turning them into legislation.

Companion Reforms in Copyright and the PDPO

The legislative proposal for a text and data mining (TDM) exception to the Copyright Ordinance (Cap. 528) was announced in the 2024 Policy Address, allowing commercial and non-commercial AI developers to carry out computational analysis, on conditions including lawfully obtained sources, appropriate attribution and an opt-out for copyright holders. The consultation on the PDPO reform's mandatory breach notification and administrative fines continues to advance.

A Practical Compliance Strategy for Enterprises

Until comprehensive AI legislation is enacted, a Hong Kong enterprise's compliance framework has to be pieced together from industry regulator guidance. The financial sector is bound by HKMA and SFC circulars; every sector involving personal data is bound by the PDPO and the PCPD framework; and cross-sector government procurement and services need to comply with DPO guidelines.

Summary

The current state of Hong Kong AI regulation in 2026 is that sector regulators are each taking action, the overall government framework is still under assessment, and there is no comprehensive AI law. For enterprises, "sector regulatory guidance plus PDPO compliance" is the clear combination that forms the current minimum compliance threshold; closely tracking the inter-departmental working group's assessment progress is the most reliable early-warning channel on the direction of future legislation.

For sector-level implementation cases, see HK Insurance AI Underwriting: Rules and Deployment and Hong Kong Family Office AI Research: SFC Boundaries; for the personal data layer, see Hong Kong PDPO and AI Compliance: Framework and Enterprise Minimums.