Strategy and governance
Set an organisational AI strategy, procurement controls, accountable governance body, policies, training, and internal responsibilities.
Hong Kong AI governance guide
What governance does a Hong Kong enterprise need before deploying AI?
Start from the affected workflow and personal-data boundary. Then assign accountability, classify risk, set human authority, test the complete system, and keep evidence after launch.
By Onyx Devs Lab · Published · Updated
Governance ownerNamed authority and escalation
Risk-based controlOversight follows consequence
Lifecycle evidenceTest, monitor, and communicate
Four governance duties
The Hong Kong PCPD Model Framework groups its recommendations into four operational areas.
Risk assessment and human oversight
Assess likely benefits and harms, classify risk, choose mitigation, and define when a person reviews, overrides, or stops the system.
Implementation and lifecycle management
Control data preparation, model customisation, validation, security, deployment, monitoring, incidents, and retirement.
Communication and engagement
Give employees, suppliers, affected people, and regulators timely information and channels for questions, feedback, and incidents.
Turn principles into delivery evidence
A policy is only useful when teams can show how it changes the system and workflow.
Data and purpose register
Record the intended use, personal data involved, provenance, retention, access, cross-border movement, and prohibited uses.
Decision and authority map
Separate advice, drafting, approval, and execution; name the accountable owner and escalation route for each consequential action.
Release and monitoring record
Keep test cases, risk-tier thresholds, failures, mitigations, approvals, versions, drift signals, incidents, and review dates.
Delivery method
Define one use case
Name the users, purpose, affected people, data, systems, expected benefit, and consequence of error.
Assign risk and authority
Choose controls and human oversight based on impact rather than treating every AI feature alike.
Validate end to end
Test data handling, retrieval, outputs, tools, permissions, fallbacks, notices, and human handoff with realistic cases.
Operate an evidence loop
Monitor performance and incidents, collect stakeholder feedback, review material changes, and preserve decisions.
Regulatory sources and scope
These are the primary regulator materials used by this implementation guide. This page is not legal advice.
Frequently asked questions
Is this checklist legal advice?
No. It is an implementation guide grounded in public regulator materials. Organisations should obtain legal, privacy, security, and sector-specific advice for their facts.
Does using a third-party model transfer accountability to the vendor?
No. Procurement should clarify responsibilities, but the deploying organisation still needs governance for its purpose, data, workflow, users, and consequences.
Is a chatbot disclaimer enough human oversight?
No. Oversight must match risk and include meaningful authority, information, timing, escalation, and the ability to intervene.
Start with one concrete operating problem.
We will first clarify the workflow, evidence, data boundary, and outcome standard before recommending the next step.
Contact Onyx