Management Summary
- Purpose / Background: This document establishes the HKMA’s updated supervisory expectations for the responsible adoption of Artificial Intelligence (A.I.) by Authorized Institutions (AIs). It supersedes the 2019 "High-level Principles on Artificial Intelligence," incorporating lessons learned from the GenA.I. Sandbox and international standards from the Financial Stability Board to ensure A.I. innovation is balanced with robust, risk-based management.
- One-line conclusion: AIs must implement the "ART" (Accountability, Resilience, Trust) framework to govern A.I. adoption, ensuring full board/senior management oversight, lifecycle risk management, and ethical, transparent use of A.I. solutions.
- Key Changes:
- Transition to the "ART" principle framework (Accountability, Resilience, Trust).
- Shift toward a risk-based proportionality approach for A.I. governance.
- Explicit requirements for "human-in-the-loop/on-the-loop" oversight for customer-facing A.I.
- Requirement to maintain a comprehensive, up-to-date A.I. use-case inventory to combat "shadow A.I."
- Mandatory "kill switch" or suspension capabilities for material or high-risk A.I. use cases.
- Enhanced focus on third-party risk management and contractual protections against model training using bank/customer data.
- Key Dates / Deadlines: Immediate applicability; AIs are expected to uplift policies and controls in a "timely manner."
- Applicability / Impact scope: Applies to all Authorized Institutions (AIs) in Hong Kong; impacts IT, Risk Management, Compliance, Board/Senior Management, and Data Governance functions.
- Recommended management actions:
- Conduct a gap analysis of existing A.I. governance against the ART principles.
- Formalize an A.I. inventory and establish clear ownership for every deployed use case.
- Update risk management frameworks to include AI-specific risks (e.g., data poisoning, model drift, hallucinations).
- Revise third-party contracts to ensure data protection and audit rights.
- Define and test incident response "kill switch" procedures for high-risk models.
- Provide role-specific training to ensure staff can exercise independent judgment on A.I. outputs.
Detailed Summary
- Document Overview:
- Nature: Supervisory Guidance.
- Purpose: To provide a structured, practical approach to A.I. adoption that promotes innovation within safe, risk-managed boundaries.
- Scope: All A.I. use cases, whether internally developed, third-party, or embedded.
- Main Requirements (The "ART" Principles):
- Accountability: Board/Senior management must set A.I. strategy and appetite. Every use case requires a designated owner, clear governance, and human oversight (human-in-the-loop/on-the-loop). A centralized, up-to-date inventory is mandatory.
- Resilience: Risk management must be commensurate with materiality. This requires end-to-end testing, independent validation for high-risk systems, ongoing monitoring, and robust response/recovery (including kill switches). Auditable records of the full lifecycle (from selection to decommissioning) must be maintained.
- Trust: AIs must ensure output quality, mitigate "hallucinations," and maintain explainability. Use cases must be ethical, non-discriminatory, and transparent; consumers must be informed when A.I. is used.
- Key Changes (vs. 2019 Principles):
- Moves from high-level guidance to operational "ART" pillars.
- Formalizes requirements for "shadow A.I." control and inventory management.
- Integrates specific lessons from the GenA.I. Sandbox (e.g., specific human oversight models).
- Greater emphasis on third-party reliance, concentration risk, and cybersecurity (data poisoning/prompt injection).
- Important Dates & Transition:
- Guidance is effective immediately. No explicit "grandfathering" period; AIs are expected to move toward compliance promptly.
- Impact and Risks:
- Operational: Increased burden for inventory maintenance and lifecycle documentation.
- Compliance: Need for stricter oversight of external vendors and data usage contracts.
- IT/Data: Enhanced requirements for data governance, ensuring data used is fit-for-purpose and masked where possible.
- Cyber: New threats like prompt injection require layered security beyond standard model filters.
- Compliance Action Checklist:
- [ ] Establish/Review Board-approved A.I. strategy and risk appetite.
- [ ] Build and document an enterprise-wide A.I. use-case inventory.
- [ ] Define "materiality" thresholds to trigger independent validation/testing.
- [ ] Audit third-party service provider contracts for data privacy/model training clauses.
- [ ] Implement "human-in-the-loop" triggers for customer-facing applications.
- [ ] Establish a formal incident response plan including "kill switch" capabilities for high-risk models.
- Appendices/Attachments Summary:
- The document references the "Practical Insights from the Second Cohort of the GenA.I. Sandbox" as a supplementary guide for applying ART principles. AIs should use this report as a non-exhaustive example set for implementation.