Hong Kong Regulatory Crosswalk
Verification required. This page was compiled on 25 October 2026. Rows HK1, HK2, HK3, HK8 and HK9 were checked that day against the HKMA's and the government's own documents and are tagged [Verified]. Every other claim is tagged [Reported], [Recalled], [Conflict] or [Unverified] as explained on the section home page. Check the primary text before relying on any of them. This is not legal advice.
One row per instrument in the Hong Kong AI Regulatory Hub, with the wiki controls that relate to it and its verification status. The last column holds the primary URL and the date it was retrieved, for the rows that have been checked. The HKMA guidance is also mapped principle by principle further down this page.
The same data is available as a CSV file for GRC tooling: crosswalk.csv.
Legal force sorts each row under one of seven labels, so that law is not mistaken for guidance or for a voluntary framework. The label is this wiki's reading of the sources and carries the same verification caveat as the rest of the row.
| Label | Meaning |
|---|---|
| Binding law | Enacted law or regulation that applies generally in the jurisdiction, including provisions that start on a later date. |
| Binding in scope | Binding only on a sector, a free zone, a state or province, or public bodies. |
| Guidance | Published by a government or regulator, and not binding in itself. |
| Voluntary | A standard, code or framework that an organization chooses to adopt. |
| Proposed | A bill, draft or consultation, or a proposal that lapsed. It is not law. |
| Context | A policy, authority, programme or summary row that sets no rule. |
| Unclear | The sources used do not settle whether it binds. |
| ID | Instrument | Legal force | Type / status | Wiki controls | Verification tag | To verify | Primary URL and retrieval date |
|---|---|---|---|---|---|---|---|
| HK1 | HKMA Supervisory Guidance for Responsible Adoption of Artificial Intelligence (15 Oct 2026) | Guidance | Supervisory expectations for authorized institutions, applied proportionately; no deadline ("in a timely manner") | AI-CTRL-012; AI-CTRL-045; AI-CTRL-011; AI-CTRL-037; AI-CTRL-025; AI-CTRL-014; AI-CTRL-041 | Verified | Circular reference number | HKMA: Annex A, retrieved 25 Oct 2026 |
| HK2 | HKMA High-level Principles on Artificial Intelligence (1 Nov 2019) | Context | Superseded by HK1 on 15 Oct 2026 | AI-CTRL-012 | Verified | Whether the HKMA register still lists it as current | HKMA: Annex A (supersession statement), retrieved 25 Oct 2026 |
| HK3 | HKMA circular: Consumer Protection in respect of Use of Generative Artificial Intelligence (19 Aug 2024) | Guidance | Customer-facing generative AI; human-in-the-loop in the early stage | AI-CTRL-045; AI-CTRL-041 | Verified | The circular's own text (only its description in HK1 footnote 3 was read) | HKMA: Annex A, footnote 3, retrieved 25 Oct 2026 (as cited in HK1) |
| HK4 | HKMA consumer protection circular on big data analytics and AI (5 Nov 2019) | Guidance | Consumer protection for AI-based products; disclosure and opt-out expectations continue under HK1 | AI-CTRL-041 | Reported | Title, date and text | |
| HK5 | SFC circular to licensed corporations on generative AI language models (12 Nov 2024) | Guidance | Four core principles; investment advice and research treated as high-risk; notification to the SFC for high-risk use (reported) | AI-CTRL-012; AI-CTRL-011; AI-CTRL-034; AI-CTRL-005; AI-CTRL-014 | Reported | The circular text and any update | |
| HK6 | PCPD Artificial Intelligence: Model Personal Data Protection Framework (11 Jun 2024) | Guidance | Not law; four areas for organisations that buy, deploy and operate AI handling personal data | AI-CTRL-013; AI-CTRL-012; AI-CTRL-045 | Reported | The framework text | |
| HK7 | Personal Data (Privacy) Ordinance (Cap. 486) | Binding law | Binding law | AI-CTRL-013; AI-CTRL-017 | Recalled | Provisions relevant to AI | |
| HK8 | GenA.I. Sandbox++ (HKMA, SFC, Insurance Authority, MPFA; 5 Mar 2026) | Context | Programme | None | Verified | Cohort dates | Hong Kong Government press release, retrieved 25 Oct 2026 |
| HK9 | HKMA discussion paper on agentic AI governance | Proposed | Announced 15 Oct 2026; not yet published | AI-CTRL-006; AI-CTRL-025 | Verified | Publication and content | HKMA press release, retrieved 25 Oct 2026 (announcement only) |
HKMA guidance on responsible AI adoption: principle crosswalk
The HKMA issued its Supervisory Guidance for Responsible Adoption of Artificial Intelligence on 15 October 2026, as Annex A to a circular to authorized institutions. It supersedes the HKMA's High-level Principles on Artificial Intelligence of 1 November 2019 and groups nine principles under three pillars: Accountability (1 to 3), Resilience (4 to 6) and Trust (7 to 9). It was read on 25 October 2026, and the mapping below is this wiki's.
| Point | What the guidance says |
|---|---|
| Who it applies to | Authorized institutions, applying the principles proportionately and using existing governance where appropriate |
| When | No fixed date. Institutions should uplift their policies, procedures and controls in a timely manner |
| Read with | The HKMA report on practical insights from the second cohort of the GenAI Sandbox, and other supervisory requirements |
Coverage shows how far the wiki covers the expectation: Direct (a wiki control addresses it) or Partial (the last column says what is missing).
| Principle | Expectation | Wiki controls | Test cases and templates | Coverage | What the wiki does not cover |
|---|---|---|---|---|---|
| 1 | Board and senior management accountability: the board approves an AI strategy with the approach and risk appetite; roles across the three lines for approval and monitoring; regular review by senior management | AI-CTRL-012, AI-CTRL-037 | TC-L02-005, TC-L02-024, TC-L01-003; HK-T1 | Partial | The wiki has no control or test case on board understanding of AI or on quantitative risk appetite measures |
| 2 | Use-case owners and human oversight: a named owner for each use case; in-the-loop, on-the-loop or in-command oversight with risk-based triggers; reviewers able to challenge, override or stop; oversight tested | AI-CTRL-045, AI-CTRL-023, AI-CTRL-011 | TC-L01-003, TC-L01-012, TC-L03-040, TC-L03-041; HK-T1 | Direct | |
| 3 | Inventory: an up-to-date inventory of approved use cases including third-party and embedded AI, with standard attributes; unlisted AI restricted; shadow AI controlled | AI-CTRL-011, AI-CTRL-001 | TC-L01-001, TC-L01-004, TC-L01-008, TC-L04-001; HK-T1 | Direct | |
| 4 | Risk-commensurate management: materiality and risk assessment sets the review depth; senior sign-off, independent validation and adversarial testing for material cases; end-to-end testing; tailored monitoring; fallback, recovery and a kill switch or equivalent; auditable records and outcome tracing | AI-CTRL-011, AI-CTRL-037, AI-CTRL-033, AI-CTRL-034, AI-CTRL-038, AI-CTRL-009, AI-CTRL-040, AI-CTRL-025, AI-CTRL-008 | TC-L01-005, TC-L01-015, TC-L01-018, TC-L01-021, TC-L02-013, TC-L14-016; HK-T1 | Partial | The wiki gates release on a security review; independent statistical model validation is outside its scope |
| 5 | Risk management frameworks: data within approved parameters and PDPO compliance, contracts that stop providers training on data without authorisation, masking; third-party due diligence, contracts, monitoring, concentration and exit; layered cyber controls against data poisoning and prompt injection | AI-CTRL-017, AI-CTRL-013, AI-CTRL-014, AI-CTRL-031, AI-CTRL-005, AI-CTRL-029 | TC-L13-001, TC-L16-008, TC-L16-023, TC-L03-021, TC-L15-004; HK-T1 | Direct | |
| 6 | Resources and expertise: adequate resources and capacity; organisation-wide awareness; role-specific training | AI-CTRL-044 | TC-L03-038, TC-L02-022; HK-T1 | Direct | |
| 7 | Accountability for outputs: controls against hallucination; stronger review where customers could be materially affected; rules for withholding, referring or blocking outputs | AI-CTRL-039, AI-CTRL-023, AI-CTRL-020 | TC-L05-018, TC-L03-033; HK-T1 | Direct | |
| 8 | Explainability and transparency: document explainability and its limits; inform stakeholders of purpose, functions, limits and the basis of material outcomes; prefer more explainable arrangements | AI-CTRL-041 | TC-L03-029, TC-L03-003; HK-T1 | Direct | |
| 9 | Ethical use and fair treatment: no unfair bias; monitoring and sampling of customer-affecting outputs; clarification, review and redress; tell consumers about AI use and its risks before service; existing disclosure and opt-out expectations continue | AI-CTRL-041, AI-CTRL-013 | TC-L03-031, TC-L03-032, TC-L03-008; HK-T1 | Direct |
Of the nine principles, seven are a direct match and two are partial. The partial ones are board understanding of AI with quantitative risk appetite, and independent model validation, the same two gaps found for the MAS Guidelines.
The same mapping is available as a CSV file: hkma_ai_guidance.csv.