On 15 April 2025, Hong Kong’s Digital Policy Office (“DPO”) took a significant step in shaping the future of artificial intelligence (“AI”) governance with the release of the Generative Artificial Intelligence Technical and Application Guideline (the “Guideline”). Developed in collaboration with the Hong Kong Generative AI Research and Development Center, this framework aims to balance innovation with accountability, offering a roadmap for businesses to adopt generative AI responsibly.
Five Dimensions of Governance
The Guideline emphasizes five pillars of ethical AI governance:
- Personal Data Privacy: Key aspects of privacy in AI include data collection, accuracy, retention, usage, security, transparency, and access. Ensuring privacy and security throughout the AI lifecycle is crucial for protecting individual rights, maintaining public trust, and supporting the sustainable development of the AI industry.
- Intellectual Property Protection: The rapid development of generative AI presents both opportunities and challenges to intellectual property systems, particularly concerning the use of copyrighted materials for AI training.
- Crime Prevention: Generative AI enhances crime prevention and control but also introduces governance challenges, such as the misuse of deepfakes for fraud and misinformation. Effective implementation requires ethical considerations, transparency, and public trust to align with societal values.
- Reliability and Trustworthiness: The credibility of generative AI hinges on its ability to consistently produce accurate and reliable results, with a robust framework ensuring accountability for developers, operators, and users. However, the complexity and opacity of its technical architecture pose significant challenges to maintaining trustworthiness and effectively addressing issues like algorithmic biases and erroneous outputs.
- System Security: System security in generative AI is crucial to prevent unauthorized access and data compromise, but risks like reverse attacks and data poisoning pose significant risks. Implementing strict data verification, anomaly detection, and secure transmission channels can help mitigate these threats and ensure safe and stable AI operations.
Practical Guide for Stakeholders
The Guideline categorizes obligations for three key groups:
Technology Developers
- Establish a well-structed generative AI development team, including a data team, an algorithm engineering team, a quality control team, and a compliance team.
- Develop policies on when to accept AI-generated content, such as requiring users to doublecheck AI-generated materials, verify references, and ensure correctness before usage.
- Follow higher standards and apply independent evaluation mechanisms from the development stage.
Service Providers
- Establish a responsible service framework to ensure service compliance, data security, system security and system credibility.
- Develop responsible processes, including clear financial and service security agreements, comprehensive risk assessments at various stages of service development, small-scale pilot projects before rolling out services on a large scale, continuous service improvement and transparent communication with stakeholders.
Service Users
- Use generative AI services in a legal and regulated manner while maintaining independent discretion.
- Understand responsibilities and obligations such as privacy, security, and legal compliance before engaging with generative AI services. Explicitly indicate whether generative AI has been used in content generation or decision-making to ensure transparency and accountability.
- Familiarize themselves with the privacy policies of generative AI services regarding data protection, use and sharing before using the services. Assess and be responsible for the content produced by generative AI and disclose its source when making it public.
- Respect intellectual property rights and apply necessary technical measures to avoid generating content that constitutes the whole or substantial copying of copyrighted works to prevent copyright disputes.
The Guideline aims to strike a balance between fostering AI innovation and ensuring responsible deployment. It establishes a governance framework tailored to Hong Kong’s unique environment, addressing potential risks while encouraging the widespread adoption of generative AI. Businesses operating in Hong Kong should take note of the Guideline to ensure compliance and capitalize on the opportunities presented by AI technologies.
While the Guideline does not have the force of law, it serves as a timely reminder that the deployment and use of AI tool carries with it a number of legal and ethical risks. In most jurisdictions currently, AI is lightly regulated or completely unregulated. As a fast-developing phenomenon, AI risks are different to predict, given its broad range of potential applications. Nonetheless, the Guideline is a useful first step in laying out some fundamental principles to adopt in deploying or using AI tools.
If you need any advice or help with AI regulatory matters, please contact us today.