Original search capture
Technical capture of retrieved pages, not an AI answer. Original formatting is retained here.
# Search Results: How can a local organisation identify practical ways to apply AI in its operations in hong kong?
Found 10 results.
### Result 1
HKPC Releases "AI Readiness in Workplace Survey 2025" AI ...
https://www.hkpc.org/en/about-us/media-centre/press-releases/2025/ai-readiness-in-workplace-survey-2025
# HKPC Releases "AI Readiness in Workplace Survey 2025" AI Adoption Approaches 90%, Talent Shortage is the Biggest Challenge Eight Key Recommendations to Deeply Integrate AI with Industry Digital Transformation
(Hong Kong, 23 October 2025) – The Hong Kong Productivity Council (HKPC) today released the results of the **“AI Readiness in Workplace Survey 2025”**, which delves into the overall readiness, actual needs, challenges and future development opportunities of local enterprises in the application of artificial intelligence (AI).
...
AI technology is moving from initial trials to comprehensive integration and has become an important support for enterprises' digital transformation and strategic upgrades.
- **Widespread use of AI tools**: 88% of employees in surveyed companies have already used AI tools in their day-to-day work, mainly in customer service, data analysis, and marketing.
- **Integrating AI into Formal Workflows**: 92% of respondents plan to gradually introduce AI into related workflows in the future, with 24% planning to fully implement it within one year, indicating a strong willingness to drive adoption.
...
Despite the increasing popularity of AI technology applications, enterprises still face multiple challenges in practice:
...
2. **Data Privacy and Security Concerns**: Enterprises have concerns about data handling, regulatory compliance, and risk management.
...
**“Three Directions and Eight Actions” Lead Enterprises to Accelerate the Implementation of AI Applications**
To address the above challenges, HKPC has put forward eight recommendations to plan a systematic AI transformation roadmap for enterprises, from human resources, strategic layout to organisational culture:
**Establishing AI Foundations:**
1. Develop a clear AI development strategy and long-term plan.
2. Strengthen leadership from the top and cross-departmental collaboration to establish a top-down transformation promotion mechanism.
3. Establish a data governance and security compliance framework, along with a trusted AI application foundation.
**Deepening Operational Integration:**
1. Implement AI skills training for all employees and cultivate a digital organisational culture.
2. Promote the integration of AI systems with internal corporate systems to lower technical barriers.
3. Deeply embed AI tools into business processes to improve operational efficiency.
**Achieving Sustainable Impact:**
1. Implement the "One Enterprise, One AI Coach" Scheme to empower AI professionals to continuously promote AI training and application within the organisation.
2. Establish an AI investment return assessment and optimization mechanism.
...
In terms of **enterprise AI skills support**, HKPC assists enterprises in establishing AI governance frameworks and compliance guidelines, providing clear standards for data security, privacy protection, and ethics across the industry.
On the other hand, the HKPC Academy systematically promotes talent cultivation, provides professional courses, qualification certifications, and capacity improvement programs, and continues to provide AI professionals to the industry to improve the industrial ecosystem.
...
In terms of **industrial applications**, HKPC actively aligns with Government policy objectives, formulates a clear roadmap for AI+ development for enterprises, and verifies the effectiveness of the technology through scenario pilots.
To lower the entry threshold for enterprises, HKPC not only provides "lightweight, low-threshold" AI solutions covering applications such as customer service automation, document intelligence, and demand forecasting, but also integrates around 250 digital solutions from the Mainland and Hong Kong , along with numerous application cases through the “**Digital DIY**” platform, providing SMEs and individuals with around intuitive technical references and implementation paths, helping enterprises quickly achieve initial transformation.
At present, AI technology has achieved concrete results in three major areas: the introduction of visual inspection and predictive maintenance in the field of **smart manufacturing ** to improve production capacity and yield; In the field of **cyber security**, AI attack and defense drill platforms are used to strengthen enterprise protection capabilities; In the field of **smart city**, data analysis is used to optimise the efficiency of transportation, environment, and public services.
### Result 2
The Privacy Commissioner’s Office has Complet
https://www.pcpd.org.hk/english/resources_centre/publications/files/AI_ComplianceChecks.pdf
All organisations reviewed which collected and/or used personal data through AI systems implemented appropriate security measures to ensure that the personal data held by them in the course of using AI systems was protected.
These measures included access control, penetration testing, encryption of data and anonymisation of personal data, etc.
...
Among the 24 organisations, 23 (about 96%) of them conducted tests prior to the implementation of AI systems to ensure their reliability, robustness and fairness.
Additionally, 20 organisations (about 83%) conducted privacy impact assessments prior to the implementation of AI systems;
...
In addition to making reference to the Model Framework, the PCPD also encourages organisations to refer to the “Checklist on Guidelines for the Use of Generative AI by
Employees”5 issued by the PCPD to help them develop internal policies or guidelines on the use of generative AI by employees at work and comply with the relevant provisions of the
PDPO.
Through this compliance check exercise, the PCPD would like to provide the following recommended measures to organisations that develop or use AI:
•
If an organisation collects or processes personal data in the development or use of AI, it should adopt measures to ensure compliance with the relevant requirements of the PDPO, as well as monitor and review AI systems on a continuous basis;
•
Establish a strategy for the development or use of AI and an internal AI governance structure, and provide adequate training to all relevant personnel.
In addition, organisations should formulate an AI incident response plan to monitor and address
incidents that may inadvertently occur;
•
Conduct comprehensive risk assessments (including privacy impact assessments) to systematically identify, analyse and evaluate the risks, including privacy risks, in relation to the development or use of AI, and adopt appropriate risk management measures that are commensurate with the risks.
For instance, a higher level of human oversight should be adopted for AI systems with a higher risk profile;
•
Conduct internal audits (and independent assessments as necessary) of AI systems on a regular basis to ensure system security and data security, and that the development or use of AI continues to comply with the requirements of the organisation’s policies, including its AI strategy; and
4 https://www.pcpd.org.hk/english/resources_centre/publications/files/guidance_ethical_e.pdf
5 https://www.pcpd.org.hk/english/resources_centre/publications/files/guidelines_ai_employees.pdf
5
•
Communicate and engage effectively with stakeholders to enhance transparency in the use of AI, and fine-tune AI systems in a timely manner in response to feedback from stakeholders.
...
These AI systems were primarily applied in areas such as customer service, marketing, administrative support, compliance/risk management, and research and development, etc.
...
5. All organisations reviewed which collected and/or used personal data through AI systems
implemented appropriate security measures to ensure that the personal data held by them in the course of using AI systems was protected against unauthorised or accidental access, processing, erasure, loss or use.
These measures included access control, penetration testing, encryption of data and anonymisation of personal data, etc.
...
6. To achieve data minimisation, 16 (approximately 67%) of these 24 organisations used
anonymised data or pseudonymised data in the use of AI systems.
In addition, seven organisations (about 29%) also adopted privacy enhancement technologies such as synthetic data and federated learning to strengthen data security.
7. All organisations which collected and/or used personal data through AI systems formulated
Privacy Policy Statements setting out the organisation’s policies and practices in relation to the collection, use and processing of personal data.
...
8. Among the 24 organisations, 15 (approximately 63%) of them made reference to the
...
Implementation and Management of AI Systems
9. Among the 24 organisations, 23 (about 96%) of them conducted tests prior to the
implementation of AI systems to ensure their reliability, robustness and fairness.
Additionally, 20 organisations (about 83%) conducted privacy impact assessments prior to the implementation of AI systems.
10. All organisations which collected and/or used personal data through AI systems conducted
risk assessments in the procurement, use and management of AI systems.
The main factors considered in the risk assessments included:
(a) security of data;
(b) requirements under the law (including the Personal Data (Privacy) Ordinance);
(c) volume, sensitivity, and quality of data;
(d) potential impact of the AI systems on individuals, the organisation, and the community;
(e) probability, severity, and duration of impact; and
(f) mitigating measures, etc.
11. Among these 24 organisations, 22 (approximately 92%) of them formulated data breach
response plans to address contingencies.
Among these, seven organisations (around 32%) specifically addressed AI-related data breach incidents in their response plans.
In addition, among the organisations which made reference to the Model Framework, 10
(approximately 83%) of them adopted the “human-in-the-loop” approach for human
oversight of the AI systems, ensuring that human actors retained control of the decision- making process to prevent and/or mitigate errors or improper decisions made by AI.
12. Among the 24 organisations, 11 (approximately 46%) of them conducted internal audits
and/or independent assessments on a regular basis, while 10 (approximately 42%) of them were planning to conduct internal audits and/or independent assessments on a regular basis to ensure that the use of AI complies with the organisation’s AI strategies and/or policies.
...
responsible for overseeing the use of AI systems, and conducted board-level discussions in relation to the use of AI systems.
15. Among the 24 organisations, 18 (75%) of them provided training for employees regarding
AI, with 15 (about 83%) also included training that covered AI-related privacy risks.
### Result 3
Enhancing AI Security from Within: A Practical Guide from ...
https://www.pcpd.org.hk/sc_chi/whatsnew/files/IAPP.pdf
•
Hong Kong’s Personal Data (Privacy)
Ordinance (PDPO) is a piece of
principle-based, technology-neutral
legislation
...
Among them:
Local Context
4
15 of them (about 63%) formulated policies
related to AI
18 of them (75%) provided training for
employees regarding AI
19 of them (about 79%) established AI
governance structures
...
Artificial Intelligence:
Model Personal Data Protection Framework
6
Benefits
Provide a set of recommendations on AI governance and the best practices for organisations procuring, implementing and using any type of AI systems, including generative AI (Gen AI), that involve the protection of personal data privacy
Assist organisations in complying with the requirements of the PDPO
Ensure AI Security
Increase competitiveness
Model Personal Data Protection Framework
7
Formulate AI Strategy and Governance
9 governance considerations
8
Purpose(s) of using AI
Privacy and security
obligations and ethical
requirements
International technical
and governance
standards
Criteria and procedures
for reviewing AI
solutions
Data processor
agreements
Policy on handling
output generated by
the AI system
Plan for continuously
scrutinising changing
landscape
Plan for monitoring,
managing and
maintaining AI solution
Evaluation of AI
suppliers
Formulate AI Strategy and Governance
Governance structure
9
Factors to be considered
Conduct Risk Assessment and Human Oversight
Process of risk assessment
10
Conduct risk assessment by a
cross-functional team
1
Identify and evaluate the
risks of the AI system
2
Adopt appropriate risk
management measures
commensurate with the risks
3
Privacy
risks
•
The allowable uses of the data for
customising procured AI solutions and /
or to be fed into AI systems to make
decisions
•
Volume of personal data
•
Sensitivity of data involved
•
The security of personal data used in an
AI system
Ethical
risks
•
The potential impacts of the AI system on the affected individuals, the organisation and the wider community
•
The probability that the impacts of the AI system on individuals will occur, as well as the severity and duration of the impacts
Risk type
Conduct Risk Assessment and Human Oversight
Risk-based approach to human oversight
11
An AI system likely to produce an
output that may have significant
impacts on individuals would
generally be considered high risk.
Management and continuous
monitoring of AI
Customisation and
implementation of AI
Data preparation
12
Execute Customisation of AI Models and
Implementation and Management of AI Systems
Process
Recommendations
Ensure compliance with privacy law
Minimise the amount of personal data involved
Document data handling
Manage data quality
Consider compliance issues based on the hosting of AI solution (‘on-premise’ or on a third party cloud) prior to integration
Ensure system security and data security
Conduct periodic audits
Establish an AI Incident Response Plan
Maintain proper documentation
Consider incorporating review
mechanisms as risk factors evolve
Conduct rigorous testing and validation of reliability, robustness and fairness
Foster Communication and Engagement with
Stakeholders
13
Checklist on Guidelines for the Use of Generative AI by Employees
14
Features
Presented in the form of
a checklist
As a matter of good
practice, organisations
should devise their own
policies and guidelines
in alignment with their
values and mission
Objective
To assist organisations in
developing internal policies or
guidelines on the use of Gen
AI by employees at work
while complying with the
requirements of the PDPO
15
Recommended Coverage
Scope
Protection of personal
data privacy
Data security
Violations of policies
or guidelines
Lawful and ethical use
and prevention of bias
Enhance AI Security = Enhance Competitiveness
16
Download AI-related guidelines from the PCPD’s
webpage
Evaluate organisation’s strategies on the use of AI
Develop relevant governance strategies and framework, draft relevant internal policies or guidelines
For enquiries, please contact PCPD’s “AI Security
Hotline” (2110 1155)
Join PCPD’s seminars and request internal training seminars
ease
low us!
### Result 4
LC Paper No. CB(2)783/2026(01)
https://www.legco.gov.hk/yr2026/english/hc/sub_com/hs52/papers/hs5220260615cb2-783-1-e.pdf
Since the establishment of the current-term administration, the
Government has made systematic plans and proactive implementation strategies
LC Paper No. CB(2)783/2026(01)
2
for Hong Kong’s AI development under a multi-pronged approach, encompassing policy, governance, scientific research and innovation, application scenarios, computing power infrastructure, talent cultivation and capital investment.
...
The strategic focus of the local AI and robotics technology
development lies in AI empowerment (AI+).
On one hand, this creates
conditions for the scientific research, transformation of outcomes and industrial development in local AI and robotics, driving AI as a core industry for Hong
Kong’s future development (“Industries for AI”).
On the other hand, we
promote the practical application of AI across various industries and public services (“AI for industries”), using industry-specific application scenarios to
drive the development of AI+ and robotics technologies.
This includes
encouraging the wider adoption of smart equipment, automation systems and human-machine collaboration solutions in traditional industries and public services, thereby driving industrial upgrading.
...
11.
Various local R&D and supporting organisations are encouraging
enterprises to adopt AI and robotics technologies in their operations.
For
example, the Hong Kong Industrial AI and Robotics Centre under the Hong Kong
Productivity Council (HKPC) focuses on the development of industrial AI and robotics technologies and commercialisation, developing projects covering logistics, automated assembly and product quality inspection, thereby enhancing
enterprises’ production capacity and data-driven management capabilities.
Meanwhile, the Hong Kong Applied Science and Technology Research
Institute (ASTRI) focuses its R&D efforts on AI and big data, as well as
intelligent perception and control.
Its research outcomes span areas such as
smart city, advanced manufacturing and intelligent equipment, helping enterprises strengthen their capabilities in key technologies such as visual inspection, predictive maintenance and autonomous system control, thereby further broadening the depth of AI and robotics applications within local industries.
...
To accelerate downstream industrial development, the “New
Industrialisation Acceleration Scheme” (NIAS) provides matching grants for enterprises engaging in industries of strategic importance (including AI) to set up
new smart production facilities in Hong Kong.
...
In terms of enterprise support, the Government has consistently supported enterprises in conducting R&D and technology transfer for AI-related
applications through the Innovation and Technology Fund.
As of end-April
2026, the Fund had funded over 390 AI-related projects involving a total funding
of around $1.1 billion, driving R&D and technology transfer in AI, including support for the application of robots, automated equipment and smart systems across various industries, thereby promoting the upgrading of production
processes and the adoption of human-machine collaboration.
...
The Government plans to launch an enhanced version of the
5
“Digital Transformation Support Pilot Scheme” (DTSPP), with a budget of
$300 million, after consultation with the Legislative Council this year.
The
DTSPP will focus on supporting SMEs in utilising off-the-shelf AI and cybersecurity solutions to help them upgrade, transform and enhance their
competitiveness in the AI era.
Meanwhile, the Digital Policy Office (DPO), in
collaboration with the Hong Kong Internet Registration Corporation Limited, will launch the “Safe AI@Workplace Empowerment Programme” in mid-2026 to proactively assist local SMEs and public and private sector organisations in
applying AI more safely in the workplace.
The programme will also provide
practical information such as case studies and assessment checklists to enhance security awareness regarding AI applications across all sectors of society.
...
Robust digital infrastructure and computing resources are essential for
driving the R&D and practical application of AI and robotics technologies.
...
While promoting the widespread application of AI technology
(including the related robotics technology) across various sectors, the
Government is committed to establishing a robust governance and regulatory framework to ensure that technological development progresses under the premise of safety and compliance, in a bid to safeguard the interests of AI users and promoting the sustainable development of AI.
...
The DPO has already developed “Ethical Artificial Intelligence
Framework” and the “Hong Kong Generative Artificial Intelligence
Technical and Application Guideline” to provide guidance for projects
involving the development and application of AI technologies.
These
documents cover ethical principles, governance frameworks and risk assessment for AI, assisting in the identification and management of potential risks and key considerations in AI projects (such as system security and robustness, personal
privacy, data security and management, etc.).
As AI forms the foundation of
intelligent robots and embodied intelligence technologies, most of the core principles and ethical standards on AI are applicable to AI robotics technology projects.
...
increasing diversity of application scenarios, the Government regularly examines key issues such as AI risks, safe application and governance standards to
...
This ensures
that Hong Kong’s regulatory framework for AI development aligns with national and international trends and cater for the local practical needs, and thus promote the healthy and orderly development of AI in Hong Kong.
...
With regard to robotics and embodied intelligence, although there is
currently no specific legislation in Hong Kong governing the development or application of related technologies, all organisations and individuals must comply with the existing rules and regulations applicable to the sectors or scenarios
concerned.
...
22. To evaluate whether the laws under different policy areas can keep pace
### Result 5
Empowering businesses through artificial intelligence in ...
https://www.legco.gov.hk/research-publications/english/essentials-2026ise08-empowering-businesses-through-artificial-intelligence-in-singapore-and-the-united-kingdom.htm
# Empowering businesses through artificial intelligence in Singapore and the United Kingdom
Artificial intelligence ("AI") is reshaping industries worldwide, transforming how businesses operate, from automating routine tasks to augmenting decision‑making and re‑engineering workflows for greater efficiency.
...
^ While Hong Kong has no standalone AI strategy, the Government identified AI as one of three priority industries in the 2022 Innovation and Technology ("I&T") Development Blueprint.^2Legend symbol denoting The other two industries are life and health technology, and advanced manufacturing and new energy technology.
See Innovation, Technology and Industry Bureau (2022).
^ This direction was reinforced in the 2025 Policy Address, which called for wider AI application across industries, while the 2026-2027 Budget further proposed a dedicated committee to steer AI-driven industry transformation.
...
Against this backdrop, there have been calls for Hong Kong to accelerate and broaden AI adoption among businesses by drawing on best practices of AI-advanced economies.^4Legend symbol denoting Legislative Council (2026).^ Notably, Singapore and the United Kingdom ("UK") have in place mature AI policy frameworks backed by robust implementation programmes.
As services-oriented economies with sizable professional sectors and a renewed focus on advanced industries (e.g. smart manufacturing), both places offer relevant models for mainstreaming AI in areas where Hong Kong also has a competitive niche.
This issue of Essentials first outlines global policy trends in harnessing AI for business transformation before reviewing Hong Kong's current policy landscape.
It then examines key approaches of Singapore and the UK, focusing on financial/technical support and enabling infrastructure.^5Legend symbol denoting These are vital policy levers that align with the OECD AI Principles in supporting innovation and trustworthy adoption of AI technologies.^
...
Increasingly, governments recognize that AI adoption requires more than software purchases.
The most effective initiatives often bundle financial incentives with hands-on technical support, such as diagnostics, skills training, mentoring and advisory services, to help firms re-engineer operations.^10Legend symbol denoting OECD (2025a).^ France exemplifies this holistic approach with its AI Booster programme.
Launched in 2023, it subsidizes up to 80% of eligible expenses while steering firms through a structured, four-stage process: online awareness training, expert diagnostics, pilot design and practical experimentation.^11Legend symbol denoting It targets small and mid-cap firms with 10 to 2 000 employees and a turnover exceeding €250,000 (HK$2.3 million).
...
Measures to empower businesses with AI in Hong Kong
- Hong Kong's AI development has progressed through incremental policy steps rather than a single, overarching strategy.
In December 2022, the Hong Kong I&T Development Blueprint identified "AI and data science" as a priority industry, backed by measures that support business adoption and industry transformation.
-
On governance, the Digital Policy Office under the Innovation, Technology and Industry Bureau leads the Government's digital policy agenda.
Instead of establishing a dedicated AI office, the Government has driven adoption through specialized task forces and units, including the AI Efficacy Enhancement Team set up to coordinate departmental AI application.
More recently, the 2026-2027 Budget announced the establishment of the Committee on AI+ and Industry Development Strategy to steer wider industrial transformation in alignment with the national "AI+" initiative.
^17Legend symbol denoting The Committee, chaired by the Financial Secretary and comprising experts and industry representatives, has an initial focus on life and health technology and embodied AI.
See Policy Address (2025) and The Budget (2026).^ Meanwhile, the Hong Kong AI Research and Development Institute supports research and industry application of AI, while advising the Government on AI governance and infrastructure.
...
In October 2024, the Government issued a policy statement on responsible AI use in the financial sector, following the launch of a Generative AI Sandbox for banks to test AI use cases within a risk-managed framework.^19Legend symbol denoting GovHK (2024a, 2026a).^
...
To facilitate AI adoption, the Government is stepping up investment in computing infrastructure.
Anchoring this effort is the Artificial Intelligence Supercomputing Centre ("AISC") at Cyberport, backed by a HK$3 billion, three-year AI Subsidy Scheme launched in October 2024 to enable local universities, research institutes and strategic enterprises^20Legend symbol denoting Examples are enterprises from sectors like AI, fintech and advanced manufacturing.^ to tap AISC's computing power.
^21Legend symbol denoting Eligible users typically receive computing subsidies of up to 70% of the service list price of AISC, along with access to Cyberport's innovation platform and AI ecosystem.
See Trade and Industry Department (2026) and GovHK (2024b).^ By February 2026, the scheme had approved around 30 applications spanning large language models and biomedicine.
^22Legend symbol denoting The Budget (2026).^ Further capacity expansion is planned through the Sandy Ridge data centre cluster.
Due to begin operating in 2029, the facility will provide computing power of 180 000 peta-floating point operations per second ("PFLOPS") by 2032, equivalent to 36 times Hong Kong's current capacity.^23Legend symbol denoting GovHK (2026c).^
...
^24Legend symbol denoting NIFS covers expenses directly related to setting up new production lines, whereas Manufacturing+ supports adoption of smart technologies to upgrade existing production lines by covering relevant consultancy fees, equipment purchases and training expenses.
See GovHK (2025).^ For SMEs, an enhanced Digital Transformation Support Pilot Programme is expected to commence later this year to subsidize adoption of AI and cybersecurity solutions, building on earlier rounds that supported 8 800 SMEs in sectors such as retail and tourism.^25Legend symbol denoting GovHK (2026b) and Policy Address (2025).^
...
Despite the above initiatives, concerns remain over the depth and breadth of AI adoption in Hong Kong.
While a 2024 report jointly published by the Hong Kong Productivity Council and the University of Hong Kong Business School ("HKPC report") noted that 32% of local companies had applied AI technologies^26Legend symbol denoting HKPC and HKU Business School (2024).^, the depth of this integration appears limited.
...
Enterprise readiness: businesses, especially SMEs, continue to face barriers to AI adoption, including a lack of in-house expertise to upgrade legacy systems and integrate siloed data.
Stakeholders have thus called for support to go beyond funding, with more integrated assistance covering diagnostics, skills training and consultancy for workflow redesign;^30Legend symbol denoting Unwire Pro (2026) and Legislative Council (2026).^ and
- (c)
Computing power: as the Sandy Ridge facility will not come into operation until 2029, some analysts note that Hong Kong is the only top 20 economy in the IMF AI Index without large-scale supercomputing infrastructure.^31Legend symbol denoting POD Research Institute (2025).^ Highlighting this bottleneck, the HKPC report revealed that 44% of local enterprises had struggled to secure sufficient processing power, fuelling demands for more affordable and accessible computing resources.^32Legend symbol denoting HKPC and HKU Business School (2024).
...
- To begin with, Singapore has introduced a package of financial and technical support to de-risk AI adoption for firms at different stages of digital maturity:
...
Technical assistance: for SMEs with limited in-house AI expertise, the government provides a structured support pathway.
The AI Readiness Index is a 15-minute assessment tool that helps firms benchmark their AI maturity and decide on suitable adoption strategies.^39Legend symbol denoting The Index is developed by AI Singapore, a government-wide partnership comprising the National Research Foundation and other government agencies.
...
^ Beyond backing individual projects, ECI also helps institutionalize expertise by assisting firms to build "AI Centres of Excellence" or in-house AI teams to centralize AI-related expertise, resources and governance.
### Result 6
Media statement - Implications of the Development or Use ...
https://www.pcpd.org.hk/english/news_events/media_statements/press_20240221.html
# Media Statements
## Media statement - Implications of the Development or Use of Artificial Intelligence on Personal Data Privacy The Privacy Commissioner’s Office has Completed Compliance Checks on 28 Organisations
### Implications of the Development or Use of Artificial Intelligence on Personal Data Privacy The Privacy Commissioner’s Office has Completed Compliance Checks on 28 Organisations
With the development and use of Artificial Intelligence (AI) becoming increasingly common in Hong Kong, organisations may collect, use or process personal data when they develop or use AI systems, thereby posing risks to personal data privacy.
In order to understand the implications of the development and use of AI on personal data privacy in Hong Kong, **the Office of the Privacy Commissioner for Personal Data (PCPD)** **carried out compliance checks on 28 local organisations (Organisations) from August 2023 to ** **February** ** 2024 to understand their practices in relation to the collection, use and ** **processing ** **of personal data in the development or use of AI** **,** ** as well as the AI governance structure of the relevant organisations.**
**The ** **exercise ** **covered various sectors, ** **including telecommunications, finance and insurance, beauty services, retail, transportation and education sectors, and government departments.** Based on the findings of the compliance checks, the PCPD has the following overall observations as regards the Organisations’ data protection practices when they develop or use AI:
- **21 organisations** **used AI in ** **their ** **day-to-day operations**, which included using AI in data analysis, assessing interview performance of job candidates, and utilising chatbots to respond to customer enquiries, etc.;
- Among the 21 organisations, **19 of them established internal AI governance frameworks**, such as setting up an AI governance committee and/or appointed designated officer to oversee the development or use of AI products or services;
- **Only 10 out of the 21 organisations collected personal data through AI products and services**.
The 10 organisations provided data subjects with Personal Information Collection Statements on or before the collection of their personal data, which specified the purposes for which the data is to be used, as well as the classes of person to whom the data may be transferred;
- **Eight ** **out ** **of the 10 organisations ** **had ** **conducted privacy impact assessments ** prior to the development or use of AI products and services;
- **All of the 10 organisations implemented appropriate security measures** to ensure that the personal data held by them was protected against unauthorised or accidental access, processing, erasure, loss or use in the course of the development or use of AI products or services.
These measures included granting access to personal data to authorised personnel only, encrypting personal data at rest and in transit, conducting regular security vulnerability assessments and penetration tests, or providing employees with written guidelines and trainings; and
- Among the 10 organisations, nine of them retained personal data collected through the AI products or services.
Out of these, **eight organisations specified retention periods for personal data** and would delete or anonymise the data when the original purpose of collection has been achieved.
The remaining organisation allowed data subjects to delete their personal data themselves.
...
O** **rganisations, as data users, ** **bear** ** the responsibilit** **y** ** to ensure data security when they develop or use AI systems** **.
They should ** **review and assess the impacts of AI systems on personal data privacy in a timely manner ** **to** ** ensure compliance with the relevant provisions of the PDPO.”**
**The PCPD issued the “** **Guidance on the Ethical Development and Use of Artificial Intelligence** **” in August 2021 to ** **facilitate** ** the healthy development and ** **use** ** of AI in Hong Kong as well as ** **assist** ** organisations ** **to mitigate privacy and ethical risks in ** **comply** **ing** ** with the relevant ** **provisions** ** of the ** **PDPO in their** ** develop** **ment** ** or use ** **of ** **AI.**
Through this compliance check exercise, the PCPD would like to provide the following recommended measures to organisations which develop or use AI:
- If an organisation collects or processes personal data in the development or use of AI, it should adopt measures to ensure compliance with the PDPO, as well as monitor and review AI systems on a continuing basis;
- Establish a strategy for the development or use of AI and an internal AI governance structure, and provide adequate training to all relevant personnel;
- Conduct comprehensive risk assessment (including privacy impact assessment) to systematically identify, analyse and evaluate the risks, including privacy risks, in relation to the development or use of AI, and adopt appropriate risk management measures that are commensurate with the risks, for instance, adopt a higher level of human oversight for an AI system with a higher risk profile; and
- Communicate and engage effectively with stakeholders to enhance transparency in the use of AI, and fine-tune AI systems in response to concerns raised by stakeholders.
### Result 7
Guidance Materials Published by the PCPD in Response to the...
https://www.digitalpolicy.gov.hk/en/our_work/digital_government/business_facilitation/business_facilitation_advisory_committee/business_facilitation_advisory_committee/doc/58BFAC_Paper_8_25_PCPD.pdf
Locally in Hong Kong, the Policy Address this year proposed to promote the development of AI+ and facilitate an extensive and deep integration of AI across sectors, while placing strong emphasis on safety
risk prevention.
...
To better understand how enterprises apply and perceive AI and to support them in enhancing their awareness of and capabilities in protecting personal data privacy, the PCPD has always striven to engage with the industry and collaborate with various organisations.
For two consecutive years from 2023 to 2024, the PCPD commissioned the Hong
Kong Productivity Council (HKPC) to conduct the “Hong Kong Enterprise
Cyber Security Readiness Index and Privacy Awareness” survey and the
“Hong Kong Enterprise Cyber Security Readiness Index and AI Security”
survey respectively.
These surveys aim to assess the readiness of local enterprises in responding to cyber security threats and AI security risks, as well as collect public opinion on privacy-related issues.
...
Organisations would need to comply with the relevant
requirements and the Data Protection Principles under the PDPO when
- 3 -
they handle personal data during the development and use of AI.
In order to understand the usage of AI in Hong Kong and its impact on personal data privacy, the PCPD carried out compliance checks on 28 local organisations from August 2023 to February 2024 and on 60 local organisations from February to May 2025 to understand their practices in relation to the collection, use and processing of personal data in the development or use of AI, as well as AI governance.
The PCPD has found no contravention of the PDPO during either round of the compliance
...
In response to the rapid development of AI, since 2021, the PCPD has published a series of guidance materials and leaflets to provide practicable recommendations for the public and organisations and help organisations understand and comply with the requirements of the PDPO.
...
“Guidance on Ethical Development and Use of AI” (AI Guidance)
helps organisations understand and comply with the relevant requirements of the PDPO as well as adhere to ethical principles when they develop and use AI systems.
The AI Guidance recommended that organisations
embrace three Data Stewardship Values 5 and set out seven Ethical
Principles for AI6 in line with international standards.
The AI Guidance also included a set of four-part practice guide premised on general business processes to assist organisations in effectively managing their AI systems.
1 The “Guidance on the Ethical Development and Use of Artificial Intelligence” is available at:
...
2 The leaflet entitled “10 TIPS for Users of AI Chatbots” is available at:
...
Building on prior success in publishing the AI Guidance and “10
TIPS for Users” Leaflet, and in order to assist organisations and businesses in using AI in a compliant manner and to improve the competitiveness of the local business environment, the PCPD issued the Model Framework – one of the first leading guides on AI in the privacy landscape in the Asia
Pacific region – in June 2024.
...
14.
“Artificial Intelligence: Model Personal Data Protection
Framework” (Model Framework) provides internationally recognised and practical recommendations and best practices, with a view to assisting organisations in complying with the requirements of the PDPO when they
procure, customise, implement and use AI (including generative AI).
...
16.
Based on general business processes, the Model Framework provides recommendations to assist organisations in considering the crucial element of personal data privacy protection into their AI application workflows.
The recommendations primarily cover the following four
areas:-
a. Establish AI Strategy and Governance: Formulate the
organisation’s AI strategy and governance considerations for
7 For example, the “Global AI Governance Initiative” (2023) issued by the Cyberspace Administration
of China; the “Advisory Guidelines on use of Personal Data in AI Recommendation and Decision
Systems” (2024) issued by the Personal Data Protection Commission of Singapore; the “Principles for responsible, trustworthy and privacy-protective generative AI technologies” (2023) issued by the
Office of the Privacy Commissioner of Canada; and the “Adopting AI Responsibly: Guidelines for
Procurement of AI Solutions by the Private Sector” (2023) issued by the World Economic Forum.
- 5 -
procuring AI solutions, establish an AI governance committee
(or a similar body) and provide employees with training
relevant to AI;
b. Conduct Risk Assessment and Human Oversight: Conduct
comprehensive
risk
assessments,
formulate
a
risk
management system, adopt a “risk-based” management
approach, and, depending on the levels of the risks posed by
AI, adopt proportionate risk mitigating measures, including deciding on the level of human oversight;
c. Customisation of AI Models and Implementation and
Management of AI Systems: Prepare and manage data
(including personal data) for customisation and/or use of AI
systems, test and validate AI models during the process of customising and implementing AI systems, ensure system
security and data security, and manage and continuously
monitor AI systems; and
d. Communication and Engagement with Stakeholders:
Communicate and engage regularly and effectively with
stakeholders, in particular staff, AI suppliers, individual customers and regulators, in order to enhance transparency of
AI systems and build trust among stakeholders.
...
The “Hong Kong Enterprise Cyber Security Readiness Index and
AI Security” that the PCPD conducted in 2024 revealed that only 28% of enterprises had established AI security policies.
To assist organisations in developing internal policies or guidelines on the use of generative AI by employees at work while complying with the requirements of the PDPO, the PCPD published the “Checklist on Guidelines for the Use of Generative
AI by Employees” (Guidelines) in March 2025, recommending that the
- 6 -
relevant internal policies or guidelines can cover the following areas:-
a. Scope of Permissible Use of Generative AI: Specify the
permitted generative AI tools (which may include publicly available generative AI tools and/or tools internally developed by organisations), the permissible purposes of use (for
example, drafting documents, summarising information,
creating textual, audio and/or visual content) and the
categories of employees to whom the policies or guidelines
apply;
b. Protection of Personal Data Privacy: Provide clear
instructions on the types and amounts of information that can be inputted into the generative AI tools (for example, whether to include personal data or other data), the permissible purposes for using the output information, the permissible storage of the output information, the applicable data retention policy and other relevant internal policies to comply with (for example, those on personal data handling and information security);
c. Lawful and Ethical Use and Prevention of Bias: Specify
that employees shall not use generative AI tools for unlawful or harmful activities, emphasise that employees are
responsible for verifying the accuracy of AI-generated outputs through ways such as proofreading and fact-checking, and for correcting and reporting biased or discriminatory AI-
generated outputs, as well as providing instructions on when and how to watermark or label AI-generated outputs;
d. Data Security: Specify the types of devices on which
employees are permitted to access generative AI tools (for example, work devices provided by employers) and the
categories of employees who are permitted to use generative
AI tools (for example, those who have operational needs, have received relevant training, and have prior permission), require employees to use robust user credentials, ensure that stringent security settings are maintained in generative AI tools, and report AI incidents (such as data breach incidents involving the use of AI; unauthorised input of personal data into
generative AI tools; output results that are abnormal and/or
- 7 -
may potentially breach the law) according to the
organisation’s AI incident response plan; and
e. Violations of Policies or Guidelines: Specify the possible
consequences of employees’ violations of the policies or guidelines, and refer to the PCPD’s Model Framework for
recommendations on establishing generative AI governance structure and measures.
19.
The Guidelines also provide practical tips on supporting employees in using generative AI tools, which include: -
a. Enhancing Transparency of the Policies or Guidelines:
Regularly communicate the policies or guidelines to
employees and keep employees informed of any updates in a timely manner;
b. Providing Training and Resources for Employees on the
Use of Generative AI Tools: Educate employees on how to
use generative AI tools effectively and responsibly, including explaining the capabilities and limitations of the tools, providing
practical
tips
and
examples,
encouraging
employees to read the privacy policies and terms of use of such tools, etc.;
c. Providing a Support Team: Set up a designated support team
to assist employees in using generative AI tools in their work, provide technical assistance, and address employees’
concerns; and
d. Establishing a Feedback Mechanism: Establish channels
for employees to provide feedback to help the organisation identify areas for improvement and tailor internal policies or guidelines according to the circumstances.
### Result 8
Events (10-10-2025) 3
https://www.digitalpolicy.gov.hk/en/news/speeches/2025/10/sp_20251010_3.html
# Speech by Mr Donald Mak, BBS, Deputy Commissioner (Data Governance), at the “LSCM Logistics Summit 2025” (with photos)
As we focus on the theme of the afternoon session, “Use of AI for Public Sector”, I must highlight the fact that the Government has long been promoting the adoption of AI within the civil service.
Back in September 2020, we launched the Big Data Analytics Platform, our very own central platform to support government bureaux and departments (B/Ds) to explore and develop AI and big data analytics projects.
By riding on the Big Data Analytics Platform, the Digital Policy Office (DPO) and the Transport Department jointly developed the Traffic Data Analytics System (TDAS) in April 2022 to analyse real-time traffic and transport data as well as real-time and forecast weather data collected from the Hong Kong Observatory.
The system employs machine learning and has developed an AI model that generates better forecast of traffic conditions such as journey time and traffic speed.
Noting the demand for AI chatbots for customer service and AI computer vision for image and video analytics, the DPO developed the “Chatbot-as-a-Service” infrastructure in June 2023 comprising ready-to-use building blocks such as a natural language processing engine, and the “AI Computer Vision Hub” in March 2024 to support B/Ds to develop more AI applications.
These facilities together with the Big Data Analytics Platform enable AI applications for processes including graphics and text recognition during processing of submitted documents or applications, traffic monitoring, water level monitoring, security surveillance, cargo handling zone management and many more.
Apart from the above, various government departments have been proactively exploring and developing applications using AI and robotics technologies in diverse areas of government operations.
The most visible examples are AI-powered robots, which perform a wide range of tasks under different conditions, including rescue operations, construction site monitoring, remote sea area surveillance, toxic gas detection, building wall inspections, and underground drainage checks.
Besides outdoor applications, AI has also been utilised for indoor operations across government departments, such as smart customer service, and processing and analysis of data, documents and images.
Examples include the application of AI by the Hong Kong Police Force for traffic enforcement; the use of AI by the Census and Statistics Department for trade data analysis; the implementation of AI-driven rostering system by the Government Flying Service to optimise crew scheduling; and the use of AI for enhancing the Government’s 1823 contact centre services to provide feedback to citizen’s enquiries and facilitate the handling of complaints.
To promote and accelerate AI adoption in the Government, our Office has recently launched the “AI+ Civil Services” Campaign, focusing on promoting broader use of AI within the Government.
Under the campaign, the DPO has introduced an AI+ Tool and Solution Catalogue, offering a wide range of ready-to-use AI applications to assist B/Ds in identifying suitable AI solutions.
Moreover, thematic technology forums, seminars and matching workshops are organised to foster exchange and collaboration between B/Ds and technology providers, and also to enhance government staff’s understanding of AI technologies and applications, and empower government departments to leverage AI for more efficient and intelligent public service delivery.
In the realm of AI research and development (R&D), the Government through the AIR@InnoHK innovation and research platform established the Hong Kong Generative AI Research and Development Center (or HKGAI in short) in 2023, focusing on the R&D of local generative AI foundation models and related applications.
In February this year, the HKGAI successfully launched Hong Kong’s first large language model (LLM).
Based on this LLM, the HKGAI has developed a series of generative AI applications, including HKPilot, HKChat and HKMeeting, which are currently being piloted by around 30 000 government staff across all B/Ds, assisting with tasks like document drafting, translation, summarisation, meeting minute-taking, and AI-powered information retrieval.
We are fully aware that effective AI governance is crucial for the safe and responsible adoption of AI.
It is imperative to strike a balance between fostering innovative AI applications and addressing the associated risks.
To this end, our Office had developed the “Ethical Artificial Intelligence Framework” in 2021 and updated it in July 2023 to provide guidance for government departments in adopting AI technologies through a structured approach that integrates ethical considerations into their IT projects and services.
Additionally, in April this year, the DPO promulgated the Hong Kong Generative Artificial Intelligence Technical and Application Guideline to provide appropriate codes and best practices for the development and use of generative AI technologies.
To further accelerate the application of AI within the Government, the Chief Executive had announced in his 2025 Policy Address a series of new initiatives, with a view to further enhancing public service effectiveness and efficiency through the use of AI.
Among others, the Government will set up the AI Efficacy Enhancement Team to co-ordinate and steer government departments in applying AI technology to their work effectively, exploring process re-engineering opportunities, and promoting technological reform in departments to improve efficacy.
Led by the Deputy Chief Secretary for Administration, the team will examine with government departments their needs for reform, with priority given to departments with greater interface with the public.
The AI Efficacy Enhancement Team will also drive government departments to launch “AI flagship projects” to make use of AI in expediting their processing of various licences and applications.
In addition, the DPO will develop an “AI Assistant” and integrate it into “iAM Smart” and the “Digital Corporate Identity” platform to provide users with instant responses to enquiries, personalised services, and tailored recommendations for suitable funding schemes and public service support for enterprises (especially small and medium enterprises).
Moreover, the Digital Policy Office will roll out various AI applications in respect of data analytics, customer service and document processing to promote extensive application in departments, while ensuring security and controllability.
...
The Government will continue to champion AI and leverage its transformative potential to deliver better public services.
I firmly believe that all organisations will benefit from the use of AI to enhance their efficiency and competitiveness.
### Result 9
www.pcpd.org.hk · english · news_eventsThe Privacy Commissioner’s Office has Completed Compliance ...
https://www.pcpd.org.hk/english/news_events/media_statements/press_20250508.html
# Media Statements
## The Privacy Commissioner’s Office has Completed Compliance Checks on 60 Organisations to Ensure AI Security
### The Privacy Commissioner’s Office has Completed Compliance Checks on 60 Organisations to Ensure AI Security
To understand the usage of AI in Hong Kong and its impact on personal data privacy, the Office of the Privacy Commissioner for Personal Data (PCPD) carried out compliance checks on 28 local organisations from August 2023 to February 2024 and provided practical recommendations to organisations which developed or used AI^[1]^.
...
The compliance checks ** **covered** ** 60 local organisations (Organisations) ** **across** ** various sectors**, including telecommunications, banking and finance, insurance, beauty services, retail, transportation, education, medical services, public utilities, social services and government departments, and aim to understand whether the Organisations complied with the relevant requirements of the Personal Data (Privacy) Ordinance (PDPO) in the collection, use and processing of personal data during the use of AI.
Meanwhile, the compliance checks also examined the Organisations’ implementation of the recommendations and best practices provided in the “Artificial Intelligence: Model Personal Data Protection Framework”^[2]^ (Model Framework) published by the PCPD in 2024, as well as their governance as regards the use of AI.
...
**These AI systems ** **we** **re primarily applied in areas such as customer service, marketing, administrative support, compliance/risk management** **,** ** and research and development** **,** ** etc.**;
...
They provided data subjects with Personal Information Collection Statements on or before the collection of personal data, which specified the purposes for which the data was to be used, as well as the classes of persons to whom the data might be transferred, etc.;
- Among the 24 organisations, **19 (** **about** ** 79%) of them retained the personal data collected through AI systems and specified ** **the ** **retention periods for personal data.
...
- **All organisations ** **reviewed ** **which collected and/or used personal data through AI systems** **implemented appropriate security measures** to ensure that the personal data held by them in the course of using AI systems was protected.
These measures included access control, penetration testing, encryption of data and anonymisation of personal data, etc.
Among these, seven organisations (around 29%) also activated AI-related security alerts and conducted red teaming drills;
- Among the 24 organisations, **23 (** **about** ** 96%) of them conducted test** **s** ** prior to ** **the ** **implementation of AI systems** to ensure their reliability, robustness and fairness.
Additionally, **20 organisations (** **about** ** 83%) conducted ** **p** **rivacy ** **i** **mpact ** **a** **ssessment** **s** ** prior to the implementation of AI systems**;
- Among these 24 organisations, **22 (** **a** **pproximately** ** 92%) of them formulated** **data breach response plans** to address contingencies.
...
Additionally, **seven organisations (** **about** ** 29%) ** **planned** ** to make reference to the ** **aforesaid** ** guidelines**; and
- Among these 24 organisations, **19 (** **about** ** 79%) of them established** **AI governance structures**, such as setting up AI governance committees and/or appointing designated personnel to be responsible for overseeing the use of AI systems.
...
** ** Organisations, as data users,** **bear** ** the responsibility to ensure** ** the ** **data security of AI systems** **when developing or using AI systems** **.
They should also** ** review, monitor and assess the impact of AI systems on personal data privacy** ** in a timely manner ** **to ensure compliance with the relevant ** **provisions** **of** ** the PDPO.
** **Meanwhile** **, organi** **s** **ations should ** **proactively** ** formulat** **e** ** AI ** **i** **ncident** ** response plans** ** and provid** **e** ** appropriate training to their ** **employees** ** to cope with AI-related ** **contingencies** **.** **”**
In addition to making reference to the Model Framework, the PCPD also encourages organisations to refer to the “Checklist on Guidelines for the Use of Generative AI by Employees”^[5]^ issued by the PCPD to help them develop internal policies or guidelines on the use of generative AI by employees at work and comply with the relevant provisions of the PDPO.
Through this compliance check exercise, the PCPD would like to provide the following recommended measures to organisations that develop or use AI:
- If an organisation collects or processes personal data in the development or use of AI, it should adopt measures to ensure compliance with the relevant requirements of the PDPO, as well as monitor and review AI systems on a continuous basis;
- Establish a strategy for the development or use of AI and an internal AI governance structure, and provide adequate training to all relevant personnel.
In addition, organisations should formulate an AI incident response plan to monitor and address incidents that may inadvertently occur;
- Conduct comprehensive risk assessments (including privacy impact assessments) to systematically identify, analyse and evaluate the risks, including privacy risks, in relation to the development or use of AI, and adopt appropriate risk management measures that are commensurate with the risks.
For instance, a higher level of human oversight should be adopted for AI systems with a higher risk profile;
- Conduct internal audits (and independent assessments as necessary) of AI systems on a regular basis to ensure system security and data security, and that the development or use of AI continues to comply with the requirements of the organisation’s policies, including its AI strategy; and
- Communicate and engage effectively with stakeholders to enhance transparency in the use of AI, and fine-tune AI systems in a timely manner in response to feedback from stakeholders.
...
These AI systems were primarily applied in areas such as customer service, marketing, administrative support, compliance/risk management, and research and development, etc.
...
The remaining five organisations (approximately 21%) did not retain the personal data collected through AI systems.
1. All organisations reviewed which collected and/or used personal data through AI systems implemented appropriate security measures to ensure that the personal data held by them in the course of using AI systems was protected against unauthorised or accidental access, processing, erasure, loss or use.
These measures included access control, penetration testing, encryption of data and anonymisation of personal data, etc.
Among these, seven organisations (around 29%) also activated AI-related security alerts and conducted red teaming drills.
1. To achieve data minimisation, 16 (approximately 67%) of these 24 organisations used anonymised data or pseudonymised data in the use of AI systems.
In addition, seven organisations (about 29%) also adopted privacy enhancement technologies such as synthetic data and federated learning to strengthen data security.
2. All organisations which collected and/or used personal data through AI systems formulated Privacy Policy Statements setting out the organisation’s policies and practices in relation to the collection, use and processing of personal data.
Among these, seven organisations (approximately 29%) (including those from banking and finance, insurance, beauty services and retail sectors) formulated Privacy Policy Statements that also covered the application of AI.
...
Implementation and Management of AI Systems
1. Among the 24 organisations, 23 (about 96%) of them conducted tests prior to the implementation of AI systems to ensure their reliability, robustness and fairness.
Additionally, 20 organisations (about 83%) conducted privacy impact assessments prior to the implementation of AI systems.
2. All organisations which collected and/or used personal data through AI systems conducted risk assessments in the procurement, use and management of AI systems.
The main factors considered in the risk assessments included:
1.
security of data;
2.
requirements under the law (including the Personal Data (Privacy) Ordinance);
3.
volume, sensitivity, and quality of data;
4.
potential impact of the AI systems on individuals, the organisation, and the community;
5.
probability, severity, and duration of impact; and
6.
mitigating measures, etc.
3. Among these 24 organisations, 22 (approximately 92%) of them formulated data breach response plans to address contingencies.
Among these, seven organisations (around 32%) specifically addressed AI-related data breach incidents in their response plans.
In addition, among the organisations which made reference to the Model Framework, 10 (approximately 83%) of them adopted the “human-in-the-loop” approach for human oversight of the AI systems, ensuring that human actors retained control of the decision-making process to prevent and/or mitigate errors or improper decisions made by AI.
4. Among the 24 organisations, 11 (approximately 46%) of them conducted internal audits and/or independent assessments on a regular basis, while 10 (approximately 42%) of them were planning to conduct internal audits and/or independent assessments on a regular basis to ensure that the use of AI complies with the organisation’s AI strategies and/or policies.
...
1. Among these 24 organisations, 15 (about 63%) of them formulated policies related to AI, and seven (about 29%) were planning to formulate such policies.
2. Among the 24 organisations, 19 (about 79%) of them established AI governance structures, such as setting up AI governance committees and/or appointing designated personnel to be responsible for overseeing the use of AI systems, and conducted board-level discussions in relation to the use of AI systems.
3. Among the 24 organisations, 18 (75%) of them provided training for employees regarding AI, with 15 (about 83%) also included training that covered AI-related privacy risks.
### Result 10
employee use of generative AI tools
https://www.pcpd.org.hk/english/news_events/newspaper/newspaper_20250514.html
# Newspaper Column
## PCPD in Media
### Fostering AI Security: The New Checklist on Guidelines for the Use of Generative AI by Employees – Privacy Commissioner’s article contribution at Hong Kong Lawyer (May 2025)
Turning to Hong Kong, AI remains the strategic focus of the Government.
The “Hong Kong Innovation and Technology Development Blueprint”, promulgated by the Government in late 2022, aims to focus on the development of the AI industry.
Building on this momentum, the Government reiterated its dedication to advancing AI development in the latest Budget announced in February, recognising AI as a core driver of new quality productive forces.
To that end, the Government has rolled out various initiatives, including a notable allocation of HK$1 billion for the establishment of the Hong Kong AI Research and Development Institute, a move aimed at supporting our city’s innovative research and development as well as industrial application of AI.
**A Tool or a Threat**
Beyond policy initiatives, AI has already transformed workplaces in Hong Kong in unimaginable ways, with both employers and employees harnessing the benefits of AI to automate day-to-day tasks, streamline operational procedures and enhance productivity and services.
Behind the extraordinary capabilities of AI, however, lie risks that may not be easily noticeable.
For instance, although generative AI (“**Gen AI**”) chatbots are capable of carrying out a wide array of tasks, such as consolidating information, generating graphics and videos, and even assisting in medical diagnoses, they may store some, if not all, of the prompts inputted and the files shared by users for the purpose of training the underlying models.
With a vast amount of data stored in the systems, which may include personal data and confidential information, these chatbots may be seen as treasure troves of sensitive data and become attractive targets for hackers and cyber criminals.
Hence, the very power that enables AI to process and analyse a large quantity of data is also a potential threat to personal data privacy.
...
It is imperative, therefore, for organisations to pay heed to the risks of AI and implement robust and effective measures to ensure AI security.
...
To mitigate such risks, organisations should, among other things, provide clear and comprehensive guidance to their employees to assist them in using AI tools in a safe manner, without jeopardising, in particular, personal data privacy.
To facilitate the safe and healthy development of AI in Hong Kong and to help organisations develop internal policies or guidelines on the use of Gen AI by employees at work while complying with the requirements of the Personal Data (Privacy) Ordinance (“**PDPO**”), the PCPD published the “Checklist on Guidelines for the Use of Generative AI by Employees” (“**Guidelines**”) in March this year.
The Guidelines recommend various aspects for organisations to consider when developing their internal AI policies or guidelines, including the key elements set out below.
Scope of Permissible Use of Gen AI
Firstly, the AI policy or guideline should specify the Gen AI tools that are permitted within the organisation, which may include publicly available tools and/or internally developed tools.
In addition, organisations should clearly define the permissible purposes for using these tools to avoid ambiguity – for example, whether employees may use such tools for drafting documents, summarising information or creating textual, audio and/or visual content, such as photos or videos for promoting the organisation’s products or services.
To clearly delineate accountability, it is also important for organisations to specify whether such policies are applicable to the entire organisation or only to specific divisions or employees.
Protection of Personal Data Privacy
It is recommended that organisations provide clear instructions in relation to both the “inputs” and “outputs” of the Gen AI tools.
Regarding the permissible inputs to the tools, organisations should specify the types and amounts of information that can be entered.
For instance, clear instructions should be provided on whether employees may share personal or copyrighted data with the tools.
Regarding the outputs generated by the Gen AI tools, the AI policy should outline the permissible purposes for using the outputted information (including personal data), and whether, when and how such personal data should be anonymised before further use.
Additionally, guidance should be provided in respect of the permissible storage of the output information and the applicable data retention policy.
Organisations should also ensure that their AI policies are aligned with other relevant internal policies, including those on personal data handling and information security.
Lawful and Ethical Use and Prevention of Bias
To ensure lawful and ethical use of the Gen AI tools, it should be specified in the policy that employees shall not use such tools for unlawful or harmful activities.
The Guidelines also recommend that the AI policy or guideline should emphasise that employees acting as human reviewers are responsible for verifying the accuracy of AI-generated outputs through practices such as proofreading and fact-checking, and for correcting and reporting biased or discriminatory AI-generated outputs.
To enhance transparency and avoid misleading customers or other stakeholders, organisations should also provide instructions on when and how to watermark or label AI-generated outputs.
Data Security
With the aim of safeguarding data security, the AI policy should specify the types of devices on which employees are permitted to access Gen AI tools and the categories of employees who are permitted to use these tools.
Employees should be required to use robust user credentials and maintain stringent security settings in Gen AI tools.
In the event of any incident involving AI, such as a data breach, an unauthorised input of personal data into Gen AI tools, an abnormal output result and/or an output result that may breach the law, employees should be required to report such incidents according to the organisation’s own AI Incident Response Plan.
Violations of Policies or Guidelines
Lastly, we recommend organisations to specify the possible consequences of employees’ violations of the policies or guidelines on the use of AI.
Practical Tips
The Guidelines also provide practical tips to organisations on supporting employees in using Gen AI tools.
For example, organisations are encouraged to regularly communicate the AI policies or guidelines to employees and keep employees informed of any updates in a timely manner to enhance transparency.
Organisations can also establish channels for employees to provide feedback that can help the organisations identify areas for improvement.
Moreover, it is recommended that organisations provide training and resources to employees so that they may use Gen AI tools effectively and responsibly.
Additionally, it is desirable for designated support teams be set up to assist employees in using Gen AI tools in their work.
Other than providing technical assistance, the support teams should be able to address any concerns that employees have in relation to the AI policies or guidelines.
...
**The AI Model Personal Data Protection Framework**
In adopting the Guidelines to formulate their AI policies, organisations may also wish to refer to the “Artificial Intelligence: Model Personal Data Protection Framework” (“**Model Framework**”) published by my Office in June 2024 which provides internationally well-recognised and practical recommendations and best practices to assist organisations to procure, implement and use AI in compliance with the relevant requirements of the PDPO.
Specifically, the Model Framework, which is based on general business processes, covers recommended measures in the areas of (1) AI strategy and governance; (2) risk assessment and human oversight; (3) customisation of AI models and implementation and management of AI systems; and (4) communication and engagement with stakeholders.
...
It is high time for organisations to devise their own AI policies or guidelines so that their employees can use the new technology effectively, responsibly and safely, and become the true master of the technology, not the other way round.