Hong Kong gave AI one commissioner and seven unfinished rules

01

WHAT ACTUALLY CHANGED

Chief Executive John Lee's September 16 Policy Address says the Chief Secretary for Administration will coordinate a seven-part AI risk program and that a new Commissioner for AI post will be created inside the Digital Policy Office. The commissioner is meant to assist government bureaux with the work. The address does not name an appointee, appointment date, term, reporting line below that description, dedicated budget, statutory authority, publication duty, or enforcement power.

The first track targets AI-enabled crime. The Law Reform Commission's Cybercrime Sub-committee is reviewing existing law and intends to seek public views on deepfake pornography, scams, and fraud. Separately, the Financial Services and the Treasury Bureau plans a public consultation later this year on expanding the legal framework for detecting and removing fraudulent online content, including content generated through misuse of AI. These are studies and consultations, not enacted offences or live removal powers.

The second track concerns minors. Schools are to receive values-based guidance on prudent AI use, while a dedicated task force under a Department of Justice-led working group will review social-media risks, including AI interaction, and consider legislative or administrative responses. The address does not set an age threshold, verification method, data limit, recommender restriction, design code, complaint route, or standard for when an AI interaction becomes harmful.

The third and fourth tracks use procurement and industry practice. Selected departments will pilot requirements for bidders supplying public-facing AI services to follow Digital Policy Office guidelines and submit safety and ethics compliance declarations. Depending on the pilot, the requirement may expand across government. Industry bodies are also expected to develop sector-specific application guidance, accreditation, and governance frameworks, with financial regulators continuing their own work. A declaration can create accountability only if its claims, evidence, exceptions, failures, and consequences are inspectable.

The remaining tracks address liability, agents, and work. A Department of Justice-led group will examine whether existing law adequately assigns liability for accidents or damage caused by AI products and may consider legislation, regulation, codes, or guidelines. The Digital Policy Office is piloting agents inside government and plans, with the AI research institute, to publish society-wide agent safety-management guidance next year. The Labour and Welfare Bureau says a coming manpower projection update will analyze employment effects. None of these future documents is available yet.

02

WHY THIS MATTERS

A commissioner can reduce the bureaucratic shrug that occurs when a harmful system touches several agencies and each owns only one slice. The office can become a useful front door if it can demand evidence, coordinate incidents, publish disagreements, assign owners, and track corrective action. Without authority and a public record, it may simply become another place where departments forward the email.

The seven headings cover different kinds of harm and need different tools. Criminal fraud calls for investigation, evidence preservation, due process, and rapid disruption. Harm to minors needs age-appropriate design and strong privacy. Product accidents raise duties, causation, insurance, and remedy. Employment change needs economic measurement, training, bargaining, and income support. One slogan about responsible AI cannot do all seven jobs.

Public procurement is a quiet source of leverage. A government buying an AI service can require documentation, security testing, accessibility, human review, incident reporting, audit access, data controls, performance by subgroup, and an exit plan before signing. Hong Kong's proposed declaration pilot could make those requirements normal. It could also become a checkbox unless declarations are specific, verified, and connected to payment, suspension, correction, and public disclosure.

Agent guidance deserves special attention because agents can use tools, retain memory, contact other systems, and act across several steps. A safe response is not enough when the product can also spend money, send a message, change a record, or trigger another service. Useful guidance should define permission scope, confirmation, separation of duties, logs, spending limits, stop controls, rollback, testing, and responsibility after a failed action.

Employment impact cannot be read from adoption totals alone. A tool may remove tasks without eliminating a job, increase monitoring while raising output, shift work to contractors, create new review duties, or change who captures the productivity gain. A credible manpower update should publish occupations, tasks, wages, hours, vacancies, displacement, new roles, subgroup effects, methods, uncertainty, and the actions triggered when a group carries more of the cost.

03

WHERE IT COULD HELP

• Publish one commissioner register naming the officeholder, mandate, powers, budget, conflict rules, responsible bureau for each track, deadlines, progress, missed commitments, complaints, investigations, corrective actions, and outcomes
• Require every public-facing AI procurement to include a model and system record, data map, risk assessment, subgroup tests, human-review design, incident duty, audit rights, accessibility checks, vendor dependencies, exit plan, and enforceable consequence for a false declaration
• Create age-appropriate rules that specify data collection, memory, personalization, recommender behavior, persuasive design, parental involvement, school use, crisis handling, reporting, appeal, and independent evaluation without turning children into identity-verification subjects by default
• Give agent deployments a permission ledger, action preview, confirmation boundary, tool allowlist, spending and rate limits, tamper-resistant logs, stop control, rollback path, named human owner, incident procedure, and tested recovery before real authority is granted
• Link the manpower projection to published thresholds for training funds, transition assistance, worker consultation, income support, procurement changes, and repeat measurement so a labor dashboard leads to an accountable response