Hong Kong's Enterprise AI Market: Sandboxes, Supercomputing, and an Unfinished Data Law

Hong Kong’s approach to enterprise AI is distinctive among Asian financial hubs: rather than legislating first, its regulators have spent the last two years running structured sandboxes, publishing consumer-protection principles, and subsidizing compute — while leaving core data-transfer law technically unfinished. For enterprise buyers evaluating AI vendors or build partners here, that combination creates a specific kind of complexity: the guidance is unusually concrete for a “principles-based” regime, but a chunk of the compliance perimeter is still governed by non-binding recommendation rather than statute. Below is what the primary sources actually say, and what it implies for how AI systems should be architected for this market.

The regulator’s tool of choice: sandbox before rulebook

The Hong Kong Monetary Authority (HKMA) has run enterprise AI adoption through a deliberately staged sandbox rather than blanket rules. The GenA.I. Sandbox, launched with Cyberport in 2024, put its inaugural cohort of 15 use cases from 10 banks and four technology partners through supervised testing. The second cohort, announced in October 2025, scaled to 27 use cases across 20 banks and 14 technology partners — selected from over 60 proposals — with a new “GenA.I. Sandbox Collaboratory” designed to convert bank problem statements into testable use cases earlier. By March 2026 the model was extended into GenA.I. Sandbox++, a joint initiative with the Securities and Futures Commission, Insurance Authority, and Mandatory Provident Fund Schemes Authority that pushes the same sandbox mechanic across securities, asset and wealth management, insurance, and MPF/SVF providers — signalling that Hong Kong intends the sandbox, not a single cross-sector AI act, to remain its primary adoption instrument.

Alongside the sandbox, the HKMA has published binding-in-substance expectations. Its Consumer Protection Principles on Generative AI (November 2024) require authorized institutions to maintain board-level accountability for AI-driven decisions, test for discriminatory bias, disclose GenAI use and limitations to customers, and — notably — let customers opt out of GenAI-mediated decisions in favour of human review. A separate November 2025 paper on Supporting AI Adoption in AML/CFT reports that 48 authorized institutions have already assessed AI for transaction monitoring, with use cases spanning anti-fraud and deepfake detection.

Data protection: concrete guidance, unfinished statute

The Privacy Commissioner for Personal Data (PCPD) published Hong Kong’s first AI-specific compliance document, the Artificial Intelligence: Model Personal Data Protection Framework, in June 2024, aimed squarely at organizations procuring, building, and operating AI systems under the Personal Data (Privacy) Ordinance (PDPO). It followed up in 2025 with a Checklist on Guidelines for the Use of Generative AI by Employees, and expanded its compliance-check programme from 28 organizations (2023–24) to 60 organizations across sectors in 2025 — an indication the PCPD is actively auditing, not just publishing.

The more consequential gap is structural: Section 33 of the PDPO, which would restrict transfer of personal data outside Hong Kong absent specific safeguards, has never been brought into force. The PCPD’s 2022 Recommended Model Contractual Clauses fill the gap as non-binding best practice, and a separate Standard Contract governs cross-boundary flows within the Greater Bay Area under mainland China’s PIPL framework. For any AI system that routes data through overseas model APIs, inference endpoints, or training pipelines, this means the enforceable baseline today is contractual and reputational, not statutory — a state that can change with limited notice once Section 33 is activated.

Adoption is already ahead of the guidance

Hong Kong’s banks aren’t waiting for full regulatory clarity. A FICO survey found AI integration among surveyed banks reached 75%, up from 59% in 2022, with 75% having implemented or actively implementing at least one generative AI use case. On AML specifically, 83% of respondents believe AI will strengthen money-laundering detection, yet 91% still rely on rules-based systems and a third cite accurate detection as an ongoing struggle — a gap between confidence in AI and operational readiness to deploy it that mirrors the HKMA’s own April 2025 report on responsible GenAI adoption.

Public infrastructure is being built to match ambition

The government is backing adoption with compute, not just policy. Cyberport’s AI Supercomputing Centre began first-phase operation in December 2024, offering 3,000 PFLOPS of capacity; a subsequent SCMP report notes utilization above 90%. The 2024–25 Budget allocated HK$3 billion to a three-year AI Subsidy Scheme funding institutions, R&D centres, and AI start-ups drawing on that capacity. HKSTP runs parallel InnoHK clusters — Health@InnoHK and AIR@InnoHK — plus its own commercial AI HPC cluster at Tseung Kwan O, and has an MOU with SenseTime for a further AI data centre.

What this means for enterprise buyers

Hong Kong rewards teams that treat governance as a design constraint, not a retrofit. The HKMA’s opt-out and human-review requirements, and the PCPD’s model framework, both assume fairness testing, disclosure, and accountability are built into the system before deployment — sandbox participation itself functions as a pre-vetting signal regulators and counterparties will ask about. At the same time, the dormant Section 33 means data-residency and cross-border inference architecture should be built to the stricter future standard now, using the PCPD’s model contractual clauses as a floor, rather than assuming today’s non-enforcement is permanent. For regulated buyers — banks, insurers, and increasingly government and healthcare bodies drawing on the same AISC and HKSTP compute — the practical question isn’t whether to adopt AI, adoption is already running ahead of the rules, but whether the underlying system was engineered to survive the day enforcement catches up.