As concerns over the risks of AI grow, strengthening governance emerges as a way for Hong Kong to harness the technology safely. Experts call for a unified regulatory standard with clear risk classification, robust privacy protection, and transparency, backed by a dedicated AI oversight body, to position the city as a leader in responsible AI development. Oswald Chan reports from Hong Kong.

As more people adopt artificial intelligence at work and for personal use, the technology is fast becoming as essential and ubiquitous as electricity and running water.

Many believe that using AI regularly would mean the pros outweighing the cons.

The University of Melbourne and global professional services firm KPMG surveyed 48,000 people in 47 countries between November 2024 and January this year, and found that they used the technology complacently.

According to the poll, 66 percent of the respondents relied on AI output without evaluating its accuracy, while 56 percent made mistakes at work using AI. Almost half of them uploaded sensitive company information onto public AI tools like ChatGPT, creating complex risks for organizations.

The study also showed that although 66 percent of those surveyed were already using AI — some regularly — just 46 percent are willing to trust AI systems, reflecting apprehension over its obvious benefits and perceived risks. Such thinking should be addressed with a sound AI corporate governance framework, or else people could lose faith in this burgeoning technology. Without a sound governance method, it could mean loss of trust and reputation, stifled innovation, impeded investment, and a talent drain.

"Good AI governance at the corporate level makes Hong Kong companies more competitive. At government level, good AI governance offers certainty, attracts market investment, boosts the city's global reputation as a reliable AI hub, and ensures that society is ready for collective AI competitiveness," says Roman Fan Wei, managing partner of the Deloitte China AI Institute.

The Hong Kong Special Administrative Region's common law system, expertise in financial regulation and abundant cross-border knowledge exchange channels are the strengths it can leverage to buttress AI governance. Hong Kong can make up ground by introducing a comprehensive development blueprint, bringing adequate technical expertise in the field into regulatory bodies, strengthening public engagement in discussions about its social and ethical aspects, and creating a cross-border AI governance framework within the 11-city Guangdong-Hong Kong-Macao Greater Bay Area.

Multifaceted strategy

Legal experts and business advisory leaders say Hong Kong must improve in four aspects — regulation, risk classification, privacy protection, and transparency.

At present, the SAR has no dedicated legislation on AI, with existing laws and regulations — particularly those relating to data protection, intellectual property, anti-discrimination and cybersecurity — applying to AI applications by default.

There are also concerns about whether Hong Kong's existing intellectual property laws adequately regulate AI usage, particularly regarding copyright protection for AI-generated works.

Nick Chan Hiu-fung, a partner at international law firm Squire Patton Boggs and a Hong Kong deputy to the National People's Congress, suggests that Hong Kong should mull a stand-alone AI ordinance based on the principles of accountability, traceability, fairness, ethical practice, privacy, safety and human oversight.

"On one hand, the proposed AI legislation should be people-centric to encourage AI development by reducing illusions and biases created by AI. At the other end, such legislation should not restrain development of the AI industry and technology," he tells China Daily.

In addition, Peter Kwon Chan-doo, a Hong Kong-based partner at global law firm RPC, says it is important for regulators to ensure that guidelines and legislation are consistent to help enterprises conduct business planning and budgeting in AI deployment.

There is no dedicated government department in Hong Kong overseeing AI governance. Instead, the regulatory framework is embedded in sector-specific regulations enforced by multiple bodies, including the Digital Policy Office, the Office of the Privacy Commissioner for Personal Data, the Hong Kong Monetary Authority, and the Securities and Futures Commission. Effective governance requires coordination among these agencies to prevent regulatory gaps.

"As AI technology is complex and evolving rapidly, having a dedicated AI regulatory body, comprising government regulators, industry leaders, academic researchers, cybersecurity professionals, public representatives and legal experts is absolutely important for strengthening international alignment and the city's status as a global AI hub," says Fan.

Deloitte China Trustworthy AI Partner Silas Zhu Hao believes that forming systems and organizational structures should be the priority of the proposed AI governance body. "It should provide a reliable framework to help organizations set up AI regulatory principles by customizing those precepts into detailed procedures, processes or interpretations to formulate a risk-based approach for AI governance," Zhu says.

Chan also advocates for creating an AI governance body to oversee the technology's development and use, as AI companies would benefit from a unified regulatory framework for governance. "The administration can consider establishing an AI policy office within its organizational structure as a new AI policy mechanism. Hong Kong can consider setting up an AI court to deal with legal cases involving AI technology," Chan says.

The Commerce and Economic Development Bureau and the Intellectual Property Department have proposed introducing a copyright infringement exception in the Copyright Ordinance, allowing reasonable use of copyrighted works for text and data mining, and computational data analysis and processing, for the training of AI models.

Chan says he backs refining the Copyright Ordinance to encourage international AI companies to settle in Hong Kong, and local AI companies to expand globally.

As for classifying risks, Hong Kong adopts a risk-based approach in AI governance by requiring that the types and extent of risk mitigation measures are proportionate to the risk levels.

With the unlimited potential upside and downside of AI, Zhu emphasizes the need for adequate risk controls. "With limited resources, it requires careful allocation to achieve the best outcomes in AI control. We could use AI to validate other AI models, but we also need to balance the costs and benefits relating to AI control," Zhu says.

"For high-risk AI systems whose outputs may significantly impact individuals, companies should adopt a human-in-the-loop approach to ensure human operators control the decision-making process to mitigate potential errors or improper outputs from AI models," says Kwon.

Strong data privacy protection is the third element in improving AI governance. AI models may use publicly available texts, including personal data, and this is in conflict with the data minimization principle. Furthermore, there is a data subject rights issue. When users unintentionally feed personal data into some generative AI models, the information becomes embedded in large language models and cannot be easily erased.

"Hong Kong's data remains largely open to global access, with few restrictions on cross-border data flows. Such level of exposure necessitates a robust risk management framework," suggests Zhu.

The Deloitte partner says that as Hong Kong companies can access international and local AI models, apps and agents, it could allow malicious actors to exploit AI tools and data, potentially increasing the risk of privacy violations and deepfake-related crimes.

Kwon believes that from a data protection perspective, companies should carefully assess the risks associated with AI systems at the outset.

The overarching law governing data protection in Hong Kong is the Personal Data (Privacy) Ordinance. Enterprises and organizations are expected to erase personal data in an AI system when it is no longer needed for AI development or use, in compliance with the data protection principles under the ordinance.

In April, the Digital Policy Office issued the Hong Kong Generative Artificial Intelligence Technical and Application Guideline to address risks such as data leakage, model bias and misinformation. It introduced the Ethical Artificial Intelligence Framework in 2023, which requires government bureaus and departments to incorporate ethical elements when adopting AI and big data analysis to plan, design and implement information technology projects or services.

Last year, the Office of the Privacy Commissioner for Personal Data published Artificial Intelligence: Model Personal Data Protection Framework. Based on general business processes, the framework provides recommendations to help organizations procure, implement, and use AI systems that involve personal data.

Bridging AI standards

Internationally, there is still no unified standard for governing AI.

Experts say Hong Kong should proactively formulate global AI governance standards by stepping up its engagement with global organizations and promoting AI conferences in Hong Kong.

In Fan's view, Hong Kong should actively participate in activities launched by multilateral organizations like the Organization for Economic Cooperation and Development and the United Nations through bilateral partnerships to help the city stay ahead on best practices, data flows, and research initiatives.

Hong Kong could leverage international mechanisms like the Asian-African Legal Consultative Organization, which has established a regional arbitration center in the city, to engage Global South countries and others to achieve a consensus on AI governance, says Chan.

Hong Kong has legal experts who are familiar with common law, continental law and the Islamic legal system who could help draft an AI regulatory standard that would be recognized internationally, he says.

Zhu affirms that Hong Kong's unique position makes it an ideal contributor to international AI governance efforts. "By combining the advantages of Western technological frameworks and Chinese regulatory standards, the city could play a contributing role in shaping global AI standards," Zhu says.

Contact the writer at oswald@chinadailyhk.com