Management Summary
- Purpose / Background: The HKMA has introduced the "ART" (Accountability, Resilience, and Trust) Framework to guide Authorized Institutions (AIs) in the responsible adoption of Artificial Intelligence (A.I.), aligning with the “Fintech 2030” strategy. This circular updates supervisory guidance based on GenA.I. Sandbox experiences and international standards from the Financial Stability Board.
- One-line conclusion: AIs must implement the new "ART" framework to govern A.I. adoption, ensuring clear accountability for use cases, proportionate risk management, and evolving human oversight models.
- Key Changes:
- Adoption of the "ART" Framework (Accountability, Resilience, Trust).
- Requirement to designate an "owner" for every A.I. use case.
- Transition from "human-in-the-loop" to "human-on-the-loop" or "human-in-command" oversight models.
- Risk-based, proportionate application of A.I. governance across the full adoption lifecycle.
- Increased focus on the governance of "agentic" A.I. (autonomous systems).
- Key Dates / Deadlines: Published 15 October 2026. AIs should review the guidance and reports immediately for current and upcoming A.I. initiatives.
- Applicability / Impact scope: All Authorized Institutions (AIs) in Hong Kong; applies to all A.I. implementations, specifically those using Generative A.I. and evolving Agentic A.I.
- Recommended management actions:
- Conduct a gap analysis of existing A.I. governance against the new "ART" guidance (Annex A).
- Formalize "ownership" structures for all current and future A.I. use cases.
- Update oversight frameworks to accommodate "human-on-the-loop" and "human-in-command" strategies.
- Review the "Practical Insights Report" (Annex B) to incorporate good practices into ongoing A.I. projects.
- Engage with the HKMA Concept Note (Annex C) regarding agentic A.I. governance in preparation for future regulatory discussion papers.
Detailed Summary
1) Document overview
The circular establishes the HKMA’s supervisory expectations for A.I. adoption under the ART Framework. It aims to foster an A.I.-enabled banking ecosystem that is accountable, resilient, and trustworthy.
2) Main requirements
- Governance: AIs must maintain effective governance, including the designation of an "owner" for every individual A.I. use case to ensure accountability.
- Proportionate Management: Governance and risk management must be commensurate with the assessed risk and materiality of the specific A.I. use case.
- Human Oversight: Institutions must evolve their oversight models beyond simple "human-in-the-loop" mechanisms toward "human-on-the-loop" (monitoring) or "human-in-command" (direct control), depending on system autonomy and risk.
3) Key changes
- Formalization of the "ART" Framework as the core supervisory pillar.
- Shift toward more sophisticated human oversight models to match the maturation of A.I. capabilities.
- Proactive focus on "agentic" A.I. (systems capable of multi-step planning and execution).
4) Important dates & transition
- Published date: 15 October 2026. AIs are expected to transition existing practices to align with these principles as A.I. systems are updated or deployed.
5) Impact and risks
- Operational: Requires formalizing ownership and mapping, which may necessitate changes to existing project management office (PMO) structures.
- Compliance: AIs must demonstrate that risk management is proportionate to the A.I. application's nature.
- IT/Data: Increased scrutiny on the autonomy of agentic systems and the integrity of human-in-command configurations.
6) Compliance action checklist
- [ ] Identify all active A.I. deployments and assign a dedicated owner for each.
- [ ] Assess the "materiality" of current A.I. use cases to ensure governance intensity is proportionate.
- [ ] Review existing oversight procedures to determine if "human-on-the-loop" or "human-in-command" protocols are required.
- [ ] Evaluate the findings of the "Practical Insights Report" against current internal A.I. pilot programs.
7) Appendices/attachments summary
- Annex A (Guidance): Provides the updated supervisory principles based on the ART framework for responsible A.I. adoption.
- Annex B (Practical Insights Report): Summarizes observations and lessons learned from the second cohort of the GenA.I. Sandbox, including cross-references to the Guidance for implementation.
- Annex C (Concept Note on Governance of Agentic A.I.): Outlines preliminary considerations and future-looking regulatory thoughts on managing systems that can autonomously plan and execute tasks.