Hong Kong AI regulation in 2025: no single AI Act, but GenAI and privacy rules matter

Privacy is another major part of the framework. The Office of the Privacy Commissioner for Personal Data, or PCPD, said it published a Checklist on Guidelines for the Use of Generative AI by Employees in March 2025 to help organisations develop internal policies or guidelines for employees using GenAI at work while complying with the PDPO.

Key Hong Kong AI and GenAI materials at a glance

Why businesses should not wait for a new AI law

The absence of a standalone AI statute does not remove legal and operational risk. The DPO guideline expressly identifies issues such as data leakage, model bias and errors as technical risks that need to be addressed. The PCPD’s employee GenAI checklist connects workplace use of GenAI with internal policies and PDPO compliance.

In practice, the risk often starts with everyday behaviour: an employee pastes customer information into a public GenAI tool, uses AI output in a client document without review, or stores generated material in a way the organisation cannot audit. Those are not futuristic AI-governance problems. They are current data handling, accuracy, accountability and privacy problems.

What an internal GenAI policy should cover

The DPO guideline says organisations adopting GenAI services should develop internal policies or guidelines. These may cover permitted tools, including publicly available and internally developed GenAI tools or applications; permitted uses such as drafting, summarising information or creating text, audio or visual content; policy applicability; permitted types and amounts of input information; permitted use of output information; and permitted storage of output information.

The PCPD has also said an AI policy should specify the types of devices on which employees may access GenAI tools and the categories of employees who are permitted to use them.

A workable first version of an AI use policy should therefore answer at least these questions:

1. Which tools are approved? List public tools, enterprise tools and internally developed GenAI applications that staff may use.
2. What may they be used for? Define whether GenAI can be used for drafting, summarising, research support, coding, translation, audio or visual content creation, or other tasks.
3. Who is covered? Make clear which teams, roles, contractors, workflows or business units fall within the policy.
4. What information may be entered? Set rules for the types and amounts of input information, especially where personal data, confidential information or client materials may be involved.
5. How can output be used? State whether AI-generated content can be used internally, externally, in customer communications or in formal documents, and when human review is required.
6. How should output be stored? Define whether AI outputs may be copied into other systems, retained, deleted, logged or used for future reference.
7. Which employees and devices are allowed? Specify the categories of staff who may use GenAI and the devices on which access is permitted.
8. How will risks be reviewed? Build checks for data leakage, model bias and errors into approval, monitoring and review processes.

PDPO and personal data: the core compliance issue

For many organisations, the biggest AI compliance question is not whether a tool is labelled as AI. It is whether personal data is being collected, entered, processed, exposed, retained or reused.

The PCPD said its employee GenAI checklist was designed to help organisations create internal workplace policies while complying with the PDPO. Broader PCPD guidance also includes practical guidance, ethical principles and a self-assessment checklist to assist organisations in complying with the Personal Data (Privacy) Ordinance, Cap. 486, when developing and using AI.

That means an AI policy should not be limited to a yes-or-no list of tools. It should also address data sources, lawful and appropriate input, access permissions, output review, storage arrangements and deletion or retention practices. Where a system involves personal data, privacy governance is not an optional add-on; it is central to the deployment.

What employees and everyday users should do

The DPO guideline is not aimed only at engineers or platform vendors. Government material says it provides practical operational guidance for technology developers, service providers and users.

For employees, the safest starting point is simple: follow the organisation’s internal AI policy before entering company documents, customer information, internal emails or other non-public material into a GenAI tool. If there is no policy, that gap should be escalated rather than treated as permission to proceed.

Users should also avoid treating AI output as automatically correct. The official guidance highlights model bias and errors as risks that need to be handled. Important customer-facing content, legal or financial material, HR decisions, medical or sensitive information, and anything involving personal data should be checked by a responsible human reviewer.

FAQ

Does Hong Kong currently have an AI law?

Hong Kong does not currently have a standalone legal framework specifically addressing AI, big data or machine learning, according to a 2025 legal overview. However, organisations still need to consider the DPO’s 2025 GenAI guideline, PCPD privacy guidance and existing PDPO requirements where personal data is involved.

What does the DPO’s 2025 GenAI guideline cover?

The Digital Policy Office released the Hong Kong Generative Artificial Intelligence Technical and Application Guideline on 15 April 2025. Government news said it covers the scope and limitations of GenAI applications, potential risks and governance principles, and provides practical operational guidance for technology developers, service providers and users.

Should every company have an AI use policy?

The DPO guideline says organisations adopting GenAI services should develop internal policies or guidelines covering matters such as approved tools, permitted uses, input information, output use and output storage. The PCPD’s employee checklist was also published to help organisations develop workplace GenAI policies or guidelines while complying with the PDPO.

Can employees use public GenAI tools at work?

That depends on the organisation’s policy. The DPO guidance says internal policies may define permitted tools, permitted uses and the types and amounts of information that may be entered into GenAI systems. The PCPD has also said AI policies should identify permitted devices and categories of employees allowed to access GenAI tools.

Bottom line

The best summary of Hong Kong’s 2025 AI position is: no single AI Act, but not a free-for-all. Official GenAI guidance, PCPD privacy materials and the PDPO already create a practical compliance framework for organisations using or deploying AI.

For businesses, the first move should be concrete rather than theoretical: define approved tools, permitted uses, input limits, output handling, storage rules, employee and device access, and privacy review. That is the foundation for safer GenAI use in Hong Kong today.

This article is a source-based information summary and does not constitute legal advice. Organisations planning high-risk AI deployments, handling personal data at scale or operating in regulated sectors should review the official materials and seek professional advice.