HKMA replaces 2019 AI principles with new 'ART' guidance for banks
The Hong Kong Monetary Authority has issued updated supervisory guidance on responsible adoption of artificial intelligence by authorised institutions, superseding its 2019 High-level Principles. Built around three pillars, Accountability, Resilience and Trust, the document sets expectations on governance, use-case inventories, testing, incident response, data and third-party risk, and fair treatment of customers. This segment covers what changed and what firms must now uplift.
- The guidance supersedes the HKMA's High-level Principles on Artificial Intelligence dated 1 November 2019 and is structured around three pillars forming the acronym ART: Accountability, Resilience and Trust.
- Boards must approve an AI strategy and risk appetite, assign an owner to each deployed use case, and maintain an up-to-date inventory of approved use cases while implementing controls against 'shadow AI'.
- Material or higher-risk use cases require independent validation, adversarial testing where appropriate, senior management sign-off, and a built-in kill switch or equivalent for prompt suspension.
- Firms must ensure data use complies with the Personal Data (Privacy) Ordinance and use contractual safeguards to stop AI service providers re-using customer data for model training without authorisation.
- Before offering an AI-powered service, institutions must inform consumers of the use of AI and relevant risks, with existing disclosure and opt-out expectations continuing to apply.