Hong Kong SFC Issues AI-Era Cybersecurity Circular for Licensed Firms
Hong Kong SFC-licensed entities must reassess cyber controls now that the regulator has issued formal AI-era resilience expectations.
The Securities and Futures Commission has published a circular setting out heightened cybersecurity expectations for licensed corporations operating in Hong Kong, with explicit guidance on risks introduced by artificial intelligence. Key takeaways include the need for board-level oversight of AI usage, robust third-party and cloud risk management, incident reporting protocols, and controls addressing AI-specific threats such as model manipulation and data poisoning. Firms should map AI deployments across the enterprise, update cybersecurity policies, and ensure senior management accountability. The circular signals closer supervisory scrutiny and likely follow-up through on-site inspections and thematic reviews, making prompt gap analysis and remediation essential for compliance.