Hong Kong AI Compliance
Resources for people who build, sell, audit or run AI systems in Hong Kong, with a focus on banks and other financial firms. The pages map Hong Kong guidance and law to the wiki's control library. The GCC and EU sections cover their regions in more depth and hold the general templates.
Verification required. This section was compiled on 25 October 2026. The HKMA Supervisory Guidance for Responsible Adoption of Artificial Intelligence (Annex A to the HKMA circular of 15 October 2026) and the government's announcement of the GenA.I. Sandbox++ were read from the regulators' own documents on that date, using a retrieval tool rather than line by line. Every other claim comes from secondary sources or memory and is tagged accordingly. The Insurance Authority's and the MPFA's own AI material was not researched. Check the primary text before relying on any claim. This is not legal advice.
Hong Kong's position in one line
Hong Kong has no AI law. Financial regulators set expectations through supervisory guidance and circulars: for banks, the HKMA guidance of 15 October 2026 [Verified]; for licensed corporations, the SFC circular on generative AI language models of 12 November 2024 [Reported]. The Personal Data (Privacy) Ordinance applies to personal data used by AI [Recalled].
What is in this section
| Page | For | What it holds |
|---|---|---|
| Hong Kong AI Regulatory Hub | Everyone | Instrument register, timeline, categories and roles, mapping to wiki controls, wiki coverage, verification checklist and sources |
| Hong Kong: Role Guide | Practitioners, product companies, auditors, implementors | One guide with a part for each role |
| HK-T1 | Banks (authorized institutions) | Self-assessment against the nine principles of the HKMA guidance |
| Hong Kong Regulatory Crosswalk | GRC tooling | Instrument-to-control map with verification status, and a principle-by-principle crosswalk of the HKMA guidance; both also as CSV files |
How claims are tagged
| Tag | Meaning |
|---|---|
| [Verified] | The point stated was checked against the regulator's own document, on the date given. The document was read with a retrieval tool and not line by line, so confirm the wording before you cite it. |
| [Reported] | Stated by secondary web sources found on 25 October 2026 (law-firm notes, press and research notes). Not read in the primary text. |
| [Recalled] | Stated from memory of the law or guidance and not re-checked. Verify before citing it. |
| [Conflict] | Secondary sources disagree. Resolve from the primary text. |
| [Unverified] | Single source, marketing-grade source, or not researched. |
The template is a working document, not a regulator-approved form.
Common templates to reuse
The GCC and EU sections contain working templates that are not tied to a region. Reuse them and adapt the regional lines.
| Need | Reuse | Adapt |
|---|---|---|
| System intake and tiering | GCC T01 or EU T01 | Use the HKMA materiality and risk assessment (principle 4) as the tiering basis |
| Inventory | SG-T2 or GCC T09 | Add the attributes HKMA principle 3 lists: purpose, owner, provider, model, risk classification, status, dependencies and key controls |
| Supplier due diligence | GCC T03 or EU T03 | Add the contract terms in HKMA principle 5 |
| Incident workflow | GCC T05 | Fill in the HKMA, SFC and PCPD routes |
| Bias testing record | GCC T10 | Use as it is |
| Risk register | GCC T12 | Use as it is |
Keeping this section current
Re-check every quarter. Watch for the HKMA discussion paper on agentic AI governance that the HKMA announced on 15 October 2026, any SFC update to its 2024 circular, and AI guidance from the Insurance Authority and the MPFA.