HK-T1 HKMA ART Principles Self-Assessment (Banks)
Verification required. This is a working template, not a regulator-approved form. Principle numbers refer to the HKMA Supervisory Guidance for Responsible Adoption of Artificial Intelligence (Annex A to the HKMA circular of 15 October 2026), read on 25 October 2026. The questions summarise the guidance in this wiki's words; check the wording in the guidance itself. This is not legal advice.
How to use: This is a blank form. Copy it and fill in the empty cells for your institution. To copy it, follow the "Suggest an edit to this page" link in the footer to reach its Markdown source.
Rate each line Met, Partly met or Not met, record the evidence and name an owner for any gap. The principle-by-principle mapping to wiki controls is in the Hong Kong Regulatory Crosswalk.
Accountability
| # | Principle | Question | Rating | Evidence | Gap owner |
|---|---|---|---|---|---|
| 1.1 | 1. Board and senior management | Has the board approved an AI strategy that sets out the approach to AI and the risk appetite? | |||
| 1.2 | 1 | Are roles for pre-deployment approval and post-deployment monitoring assigned across the three lines? | |||
| 1.3 | 1 | Does senior management review the strategy and framework regularly? | |||
| 2.1 | 2. Use-case owners and human oversight | Does every deployed use case have a named owner who defines its authority and oversees its controls? | |||
| 2.2 | 2 | Is the oversight model (in-the-loop, on-the-loop or in-command) chosen per use case, with risk-based triggers for approval or intervention? | |||
| 2.3 | 2 | Do reviewers have the competence, information, time and authority to challenge, override or stop the system, and is oversight effectiveness tested? | |||
| 3.1 | 3. Inventory | Is there an up-to-date inventory of approved use cases covering in-house, third-party and embedded AI? | |||
| 3.2 | 3 | Are "AI use" and the recorded attributes (purpose, owner, provider, model, risk classification, status, dependencies, key controls) defined? | |||
| 3.3 | 3 | Is AI that is not in the inventory restricted, and is shadow AI controlled? |
Resilience
| # | Principle | Question | Rating | Evidence | Gap owner |
|---|---|---|---|---|---|
| 4.1 | 4. Risk-commensurate management | Does a materiality and risk assessment decide the level of review and approval for each use case, and is it refreshed? | |||
| 4.2 | 4 | Do material or higher-risk use cases get senior management sign-off, independent validation and, where appropriate, adversarial testing? | |||
| 4.3 | 4 | Is each use case tested end to end against acceptance criteria before deployment and before material change, with residual risk accepted by the approver? | |||
| 4.4 | 4 | Is monitoring tailored to the use case, including safeguards where AI monitors AI? | |||
| 4.5 | 4 | Do material or higher-risk use cases have a built-in kill switch or equivalent, and credible fallback and recovery, including for third-party failure? | |||
| 4.6 | 4 | Are records kept across the life cycle, and can material outputs be traced? | |||
| 5.1 | 5. Risk management frameworks | Do contracts stop providers reusing personal or confidential data for training without authorisation, and is data masked where possible? | |||
| 5.2 | 5 | Are AI providers subject to due diligence, contracts with audit rights and notifications, monitoring, and concentration and exit assessment? | |||
| 5.3 | 5 | Are layered controls in place against data poisoning and prompt injection, beyond model instructions and filters? | |||
| 6.1 | 6. Resources and expertise | Are resources and capacity planned, and are awareness and role-specific training in place? |
Trust
| # | Principle | Question | Rating | Evidence | Gap owner |
|---|---|---|---|---|---|
| 7.1 | 7. Accountability for outputs | Are there controls against inaccurate or fabricated outputs, with stronger review where customers could be materially affected? | |||
| 7.2 | 7 | Is it defined when outputs must be withheld, referred for review or barred from triggering actions? | |||
| 8.1 | 8. Explainability | Is each use case's explainability and its limits documented, and shared with stakeholders as appropriate? | |||
| 9.1 | 9. Ethical use and fair treatment | Are customer-affecting outputs monitored for bias, with clarification, review and redress available? | |||
| 9.2 | 9 | Are customers told that AI is used, and of its risks, before an AI-powered service is provided? |
Sign-off
| Role | Name | Date |
|---|---|---|
| Prepared by | ||
| Reviewed by (risk function) | ||
| Approved by |
Wiki controls: AI-CTRL-012, AI-CTRL-045, AI-CTRL-011, AI-CTRL-037, AI-CTRL-025, AI-CTRL-014, AI-CTRL-041.