.svg)
Organisations using artificial intelligence (AI) in Hong Kong will have to establish a clear strategy and conduct periodic risk assessments, under a new regulatory framework unveiled today.
In response to the expanding applications and privacy challenges of advancing AI technology, the Office of the Privacy Commissioner for Personal Data (PCPD) has released the “Artificial Intelligence: Model Personal Data Protection Framework” to support the Global AI Governance Initiative.
The framework is aimed at assisting organisations to procure, implement and use AI in compliance with Hong Kong’s Personal Data (Privacy) Ordinance (PDPO).
It outlines recommended measures across four key areas:
- Establishing an AI strategy and governance framework, including forming a committee and training employees.
- Conducting risk assessments, ensuring human oversight, adopting a "risk-based" management approach and implementing risk mitigation measures.
- Customising and managing AI models and systems, advising on data preparation, system security and continuous monitoring.
- Ensuring transparent communication and engagement with stakeholders, including staff, AI suppliers, customers and regulators, to build trust.
“AI security is one of the major fields of national security,” said Ada Chung Lai-ling, the privacy commissioner.
She added that the framework offers "internationally recognised and practical recommendations and best practices" to aid in procuring, implementing and using AI, including generative AI, while complying with the PDPO.
“I believe that the Model Framework will help nurture the healthy development of AI in Hong Kong, facilitate Hong Kong’s development into an innovation and technology hub, and propel the expansion of the digital economy not only in Hong Kong but also in the Greater Bay Area,” she said.
According to Professor Hon William Wong Kam-fai, who serves as a member of the PCPD’s standing committee on technological developments and is a legislative council member, the framework "provides valuable guidance for enterprises to leverage AI technology, promoting industrial innovation and upgrading".
Hong Kong is far from the only jurisdiction increasing its regulatory oversight of AI at the moment; the subject has become a key topic for payments and banking professionals in recent years thanks to the growth of AI technology such as ChatGPT.
Last week, the US Treasury Separtment issued a request for information on the uses, opportunities and risks of AI in the financial services sector.
And last month, the Danish Financial Supervisory Authority (FSA) issued guidance to financial companies on AI usage and outlined key implementation considerations, and the UK government launched a call for views on AI cybersecurity.
Meanwhile, in April, the European Data Protection Board (EDPB) announced in its 2024-2027 strategy that it is prioritising investigating AI issues.
