Loading
As of July 2026, Hong Kong has no comprehensive AI statute. The Personal Data (Privacy) Ordinance is the only binding cross-sector law that reaches AI systems directly, while the Privacy Commissioner, the Digital Policy Office, the HKMA and the SFC layer on non-statutory guidance, and a new cross-government working group is reviewing whether bespoke AI legislation is needed. This page sets out the instruments, the dates, and which ones are binding versus guidance, with links to the primary sources for each.
Last reviewed: 28 July 2026 · A factual snapshot; AI policy is evolving, so confirm against the primary sources linked below
Hong Kong does not have, and has not proposed, a comprehensive AI statute as of July 2026. The only cross-sector law that reaches AI systems directly is the Personal Data (Privacy) Ordinance (Cap. 486), enforced by the Privacy Commissioner for Personal Data (PCPD), which binds any organisation that collects, holds or processes personal data, including through AI. Sitting alongside this binding law is a growing stack of non-statutory guidance: the PCPD’s 2021 Guidance on the Ethical Development and Use of Artificial Intelligence and its 2024 Artificial Intelligence: Model Personal Data Protection Framework set out the regulator’s expectations for AI governance, privacy impact assessment and human oversight, but neither creates new offences beyond the PDPO itself. A parallel Ethical Artificial Intelligence Framework, originally issued in 2023 for government bureaux and departments by the then Office of the Government Chief Information Officer and now maintained by its successor, the Digital Policy Office, is likewise offered for voluntary use by the private sector.
For regulated financial firms, the HKMA and SFC add sector-specific supervisory guidance rather than new legislation: HKMA circulars dating from 2019 and 2024 set expectations for AI and generative AI use by banks, and SFC circulars from 2024 and 2026 do the same for licensed corporations, including a joint GenAI Sandbox++ launched with the Insurance Authority and the Mandatory Provident Fund Schemes Authority in March 2026. In parallel, the government has invested in AI infrastructure and adoption programmes, including Cyberport’s AI Supercomputing Centre, a HK$3 billion AI Subsidy Scheme and a newly funded AI Research and Development Institute, while a cross-government working group convened in March 2026 is reviewing whether existing laws need updating or bespoke AI legislation is warranted. Overall, Hong Kong’s approach is pro-innovation and framework-driven, broadly similar in kind, though not in specific instruments, to Singapore’s: companies operating AI in Hong Kong today should treat the PDPO as their binding baseline and PCPD, HKMA and SFC guidance as the practical compliance bar regulators will expect, while watching the legislative review for signs that a standalone AI law may eventually follow.
The Hong Kong Monetary Authority issues a circular of high-level principles covering governance, application design and development, and ongoing monitoring for authorized institutions using AI, the first sector-specific AI guidance in Hong Kong.
The Privacy Commissioner for Personal Data issues the Guidance on the Ethical Development and Use of Artificial Intelligence, setting out three Data Stewardship Values and seven ethical principles plus a four-part practice guide. It is voluntary and creates no new legal obligations beyond the PDPO.
The then Office of the Government Chief Information Officer publishes a government-wide Ethical Artificial Intelligence Framework to guide bureaux and departments adopting AI and big data analytics. After OGCIO merged with the Efficiency Office to form the Digital Policy Office on 25 July 2024, the DPO took over the framework and later opened it for voluntary use by the private sector.
The PCPD publishes the Artificial Intelligence: Model Personal Data Protection Framework, giving organisations practical recommendations for procuring, implementing and using AI, including generative AI, in line with the PDPO. It remains non-statutory guidance.
The HKMA issues a circular on consumer protection for generative AI in customer-facing banking applications (19 August 2024), and the SFC issues a circular on the use of generative AI language models by licensed corporations (12 November 2024). Both are supervisory guidance, not new legislation.
The HKMA, SFC, Insurance Authority and Mandatory Provident Fund Schemes Authority, working with Cyberport, launch the GenAI Sandbox++, extending an earlier banking-only sandbox to securities, asset and wealth management, insurance, MPF and stored value facility firms.
On 16 March 2026 the PCPD issues an alert on the privacy and security risks of agentic AI tools. On 19 May 2026 it publishes findings from compliance checks on 60 organisations, showing 95% already use AI operationally with no PDPO contraventions found. Separately, the Secretary for Justice convenes the Inter-Departmental Working Group to Review Legislation to Support Wider Application of AI, from 6 March 2026, to review whether Hong Kong’s laws need updating for AI, including whether bespoke AI legislation is needed.
The distinction that matters most for compliance is whether an instrument carries legal force, is guidance, or is a proposal not yet introduced. The table below sorts the main instruments accordingly.
| Instrument | Status | Applies to / owner |
|---|---|---|
| Personal Data (Privacy) Ordinance (Cap. 486) | Binding | PCPD; applies to any organisation that collects, holds or processes personal data in Hong Kong, including through AI systems |
| PCPD Guidance on the Ethical Development and Use of Artificial Intelligence (2021) | Guidance | PCPD; voluntary reference for organisations developing or using AI that touches personal data |
| PCPD Artificial Intelligence: Model Personal Data Protection Framework (2024) | Guidance | PCPD; voluntary best-practice framework for organisations procuring or deploying AI, including generative AI |
| HKMA AI and generative AI guidance for banks (2019 principles; 2024 GenAI circular) | Guidance | HKMA; applies to authorized institutions, i.e. banks and deposit-takers, in Hong Kong |
| SFC circulars on generative AI use and AI-enabled cyber risk (2024, 2026) | Guidance | SFC; applies to licensed corporations and SFC-licensed virtual asset service providers |
| GenAI Sandbox++ (HKMA, SFC, Insurance Authority, MPFA and Cyberport, 2026) | Voluntary | Joint financial regulators and Cyberport; open to participating banking, securities, asset management, insurance, MPF and stored value facility firms |
| Ethical Artificial Intelligence Framework (originally OGCIO 2023, now maintained by the Digital Policy Office) | Guidance | Digital Policy Office, successor to the Office of the Government Chief Information Officer; reference for government bureaux and departments, voluntary for the private sector |
| Inter-Departmental Working Group to Review Legislation to Support Wider Application of AI (from March 2026) | Proposed | Cross-government group under a Steering Committee chaired by the Secretary for Justice; may recommend bespoke AI legislation, though none has been introduced as of July 2026 |
For a comparison of how other pro-innovation, framework-driven jurisdictions approach AI, see our Singapore AI governance guide and the full AI regulation by country comparison.
Two practical points follow. First, the enforceable obligations on an organisation operating AI in Hong Kong today come from the laws that already apply to it, above all the Personal Data (Privacy) Ordinance enforced by the PCPD, and sector-specific law for regulated industries such as banking and securities. PCPD, HKMA and SFC guidance shapes how those obligations are expected to be met in an AI context, but the guidance itself is not a separate source of legal liability. Second, this is a moving position: the Inter-Departmental Working Group convened in March 2026 is actively reviewing whether Hong Kong needs bespoke AI legislation, so an AI governance approach built today should be able to absorb a future statutory framework rather than assume the current guidance-led model is permanent.
Because the guidance layer is voluntary, the weight of day-to-day AI governance sits with each organisation’s own framework and controls, benchmarked against what the PCPD, HKMA and SFC have said they expect. Our AI GRC guide covers how those pieces fit together, and a short governance assessment benchmarks where an organisation stands against a structured model.
No. As of July 2026, Hong Kong has no standalone AI statute. AI is governed through existing laws, chiefly the Personal Data (Privacy) Ordinance, plus non-statutory guidance from the Privacy Commissioner, the Digital Policy Office and financial regulators. The Inter-Departmental Working Group to Review Legislation to Support Wider Application of AI, convened by the Secretary for Justice in March 2026, is reviewing whether bespoke AI legislation is needed, but no bill has been introduced.
The Personal Data (Privacy) Ordinance (Cap. 486) is the main binding law that reaches AI systems, through its data protection principles governing collection, accuracy, use, security, openness and access to personal data. Regulated sectors also carry binding obligations under existing laws such as the Banking Ordinance and the Securities and Futures Ordinance, which HKMA and SFC AI guidance interprets rather than replaces. AI-specific documents from the PCPD, HKMA and SFC are guidance, not separate binding rules.
No. The Guidance on the Ethical Development and Use of Artificial Intelligence (2021) and the Artificial Intelligence: Model Personal Data Protection Framework (2024) are both voluntary, non-statutory documents. They explain how the PCPD expects organisations to meet existing PDPO obligations when using AI, and are used as a practical benchmark in the PCPD’s compliance checks, but failing to follow them is not itself an offence.
Yes, in the form of supervisory guidance rather than statute. The HKMA has issued high-level principles on AI for authorized institutions since 2019 and a 2024 circular on generative AI in customer-facing banking services. The SFC has issued circulars on the use of generative AI language models (2024) and on cybersecurity measures against AI-enabled cyberattacks (2026) for licensed corporations. Both regulators also run the joint GenAI Sandbox++ launched in March 2026 for supervised experimentation.
Hong Kong has invested in AI infrastructure and adoption programmes rather than publishing a single national AI strategy document. These include Cyberport’s AI Supercomputing Centre, operational from December 2024, a three-year, HK$3 billion AI Subsidy Scheme announced in the 2024-25 Budget, and the Hong Kong AI Research and Development Institute, which the Legislative Council has funded to begin operating in the second half of 2026.
Not confirmed. Hong Kong’s newest AI body, the AI Research and Development Institute, is oriented toward research, development and commercialisation rather than safety testing or evaluation of frontier models. Safety features as a stated government priority alongside AI adoption, and the PCPD has issued targeted risk alerts, such as its March 2026 warning on agentic AI, but no standalone AI safety institute has been confirmed as established.
Hong Kong’s approach is pro-innovation and framework-driven: it relies on existing, technology-neutral laws, chiefly data protection and financial regulation, supplemented by voluntary guidance and regulatory sandboxes, rather than a dedicated AI statute. This puts it in the same broad category as jurisdictions like Singapore, though the specific instruments, regulators and guidance documents are distinct and should not be assumed to be equivalent. For companies, this means compliance obligations in Hong Kong today flow mainly from the PDPO and sector-specific rules, while PCPD, HKMA and SFC guidance sets the practical bar regulators will expect even though it is not separately enforceable.
A short, free assessment benchmarks where your organisation stands against a structured AI governance model, useful precisely because Hong Kong’s layer is guidance and sandbox rather than a single statute.
This page is general information describing the state of Hong Kong AI policy as at 28 July 2026, not legal or compliance advice. A legislative review is underway and positions change; always confirm the current position against the primary sources linked above and obtain advice from your own qualified counsel before relying on it.