HKMA ART Framework: Nine AI Principles Replace the 2019 Guidance

On 15 October 2026 the Hong Kong Monetary Authority sent circular B1/15C, “Responsible Adoption of Artificial Intelligence”, to the chief executives of all authorized institutions. Its Annex A is the supervisory core of the HKMA ART Framework: nine principles grouped under Accountability, Resilience and Trust, which supersede the HKMA’s “High-level Principles on Artificial Intelligence” dated 1 November 2019.

The Guidance carries no compliance date. It says institutions “should take appropriate steps to uplift their policies, procedures and controls in line with the new guidance in a timely manner”, applying the principles proportionately and drawing on existing governance and risk management arrangements. That leaves governance and compliance teams to set the pace themselves, against expectations now written in the present tense: a board-approved AI strategy, a named owner for each deployed use case, an inventory that includes third-party and embedded AI, and a kill switch or equivalent for the more material or higher-risk cases.

Two further annexes travel with the Guidance, a sandbox practical-insights report and a concept note on agentic AI. Neither carries the weight of Annex A, and separating the three documents is the first piece of work.

Related reading: FSB AI Sound Practices Final Report: A Governance Gap Analysis

Circular B1/15C sends three annexes with three different weights

The covering circular presents the package as progress under the HKMA’s “Fintech 2030” strategy and its Fintech Promotion Blueprint of 3 February 2026. It says the updated Guidance draws on practical experience from the Generative AI (GenA.I.) Sandbox and on the latest guidance from international bodies, including the Financial Stability Board’s report “Sound Practices for Responsible Adoption of Artificial Intelligence (AI)”, issued the same day. Each attachment’s status comes from its own wording:

Annex A also asks institutions to read the principles together with Annex B and with “other prevailing supervisory and regulatory requirements”. The sandbox report is reference material for implementing the principles. The concept note signals where future requirements on agentic AI may go.

The abbreviation trap in the HKMA text

In the circular and in Annexes A and C, the HKMA generally writes “AI” without full stops for an authorized institution and “A.I.” with full stops for artificial intelligence. Annex C slips once, in the phrase “Agentic AI applications”. Annex A’s testing expectation reads “An AI should conduct end-to-end testing and reviews of an A.I. use case”. Extracts pasted into internal standards, or run through search and summarisation tools that strip punctuation, can lose the distinction. From here on, “AI” means artificial intelligence and institutions are named in full.

Dates that frame the change

What the HKMA ART Framework supersedes, and what stays in force

The 2019 letter set out 12 principles in three groups: governance, application design and development, and on-going monitoring and maintenance. Banks were expected to take them into account when designing and adopting AI and big data analytics applications, and could apply them proportionately. Annex A replaces that set with nine principles. Three sit under Accountability (strategy and governance, use-case owners and human oversight, the inventory). Three sit under Resilience (materiality-based lifecycle management, risk management for data, third-party and cyber risk, and resources). Three sit under Trust (output quality, explainability, and ethical and fair treatment of customers).

The supersession sentence names one document only. The consumer protection circulars of 5 November 2019 and 19 August 2024 are not mentioned in it, and Principle 9 states that “existing consumer protection expectations, including around disclosure and opt-out arrangements where applicable, continue to apply”. The 2024 circular had pointed readers to the 2019 High-level Principles for risk management guidance on AI, describing them as guidance that “will be updated from time to time”. I read Annex A as that update, sitting alongside the two consumer protection circulars.

One housekeeping point matters for policy libraries. When this article was researched on 19 October 2026, the HKMA’s Banking Regulatory Document Repository still listed the 1 November 2019 circular with the status “Current” and showed no superseding document against it. The supersession is stated in Annex A itself. A library that takes document status from the repository flag would keep the 2019 principles live.

The table below sets out selected changes. The pairing of old and new principles is my mapping; neither the circular nor Annex A includes a correspondence table.

Accountability starts with a board-approved AI strategy

Principle 1 asks the board to approve an AI strategy that sets out the institution’s approach and risk appetite for adopting AI across its operations. A governance framework should allocate roles across the three lines of defence for assessing and approving a use case before deployment, and for monitoring and managing its risks afterwards. Senior management should regularly review whether the strategy and framework remain suitable as risks change, and make prompt adjustments with the board’s approval where warranted.

Principle 2 adds the owner. Each deployed use case gets one, responsible for defining the system’s authority, overseeing the effectiveness of controls and monitoring, and making sure issues are escalated and remediated promptly. Human oversight can take the form of “human-in-the-loop”, “human-on-the-loop” or “human-in-command” arrangements, supported by AI where appropriate, with risk-based triggers for human approval or intervention. The people doing that review should have “sufficient competence, information, time and authority to challenge, override or stop the A.I. system”. Institutions should obtain assurance that the oversight works, for example through testing, and make sure staff exercise independent judgement when considering AI outputs.

Appointing an owner leaves ultimate accountability where it was. Principle 2 closes by restating that the board and senior management “remain accountable for the outputs generated”, so the owner holds an operating responsibility inside that chain. Annex C adds a pointer for agentic systems: the business function responsible for the underlying business intent “would generally be expected to be accountable for the agent’s outcomes”, and technology functions “may not always be the accountable owners”. For institutions that place AI tools under the technology department by default, that sentence is the one to test the operating model against, even though Annex C is not yet a requirement.

Principle 3 puts embedded and third-party AI in the inventory

Principle 3 expects an up-to-date inventory of the AI use cases approved for deployment, and restricts use of solutions that are not in it. The inventory should give the institution full visibility of its AI use, “including solutions that are internally developed, provided by third parties or embedded”. Annex A says the inventory should generally cover each use case’s:

• purpose;
• owner;
• provider and model;
• risk classification;
• lifecycle and approval status;
• dependencies; and
• key controls around risk management, access and monitoring.

Annex A lists three set-up tasks for effective stock-taking: a definition of what counts as “A.I. use”, a standard set of recorded attributes, and clear responsibility for keeping entries current. Institutions should also tell staff what is expected of them, the Guidance’s examples being no adoption of unapproved tools and no use of approved tools for unapproved purposes, and should put controls around “shadow A.I.” adoption. Footnote 4 adds that for third-party solutions an institution should ensure compliance with contractual and licensing terms and implement controls against circumvention.

A model inventory built for model risk management is a natural starting point, but it is organised around models. Annex A is organised around use cases and names embedded solutions. A licensed software product that gains an AI feature through a vendor release would sit outside a list scoped to in-house models, yet inside the Annex A inventory once the institution’s definition of “A.I. use” captures it. On my reading, the same underlying model used for two business purposes would also produce two entries, each with its own owner and risk classification.

Human oversight moves on from the 2024 human-in-the-loop expectation

The 19 August 2024 circular on generative AI said that during the early stage of deploying customer-facing GenAI applications, authorized institutions “should adopt the ‘human-in-the-loop’ approach”, keeping a human in control of the decision-making process so that model outputs are accurate and not misleading. For that same early stage, it also asked that customers be offered, as far as practicable, the option to opt out of GenAI and request human intervention, with channels to request review where an opt-out cannot be provided, and it accepted other measures with the same effect as an opt-out.

Footnote 3 of Annex A quotes that sentence and then states that the HKMA “recognises that as A.I. development advances, a ‘human-on-the-loop’ or ‘human-in-command’ arrangement could be more appropriate for some use cases”. In deciding the oversight arrangement for customer-facing AI applications, institutions “may follow the guidance set out in this circular”. I read “this circular” as the 15 October 2026 circular and its Annex A, which ties the choice of oversight mode to risk-based triggers and to reviewers who can challenge, override or stop the system.

Moving a chatbot from human-in-the-loop to human-on-the-loop changes who reviews outputs and when. The 2024 opt-out and review-channel arrangements are a separate question, because Principle 9 keeps existing disclosure and opt-out expectations in place “where applicable”. A use-case file that records the oversight change without revisiting the opt-out position has answered only half the question.

Annex A names the three oversight modes, and its only description of any of them is the 2024 human-in-the-loop wording quoted in footnote 3. The covering circular describes the shift as a move from “human-in-the-loop” to “human-on-the-loop” or “human-in-command” arrangements “depending on the nature and risks of the concerned use case”. Where an institution draws the line between modes, and what evidence shows the chosen mode works in operation, is left to its own framework and its testing.

Resilience: the materiality assessment sets the depth of control

Principle 4 asks each institution to establish a framework to assess the materiality and risks of every AI use case under consideration. That initial assessment determines how rigorous the review and approval must be before deployment. Use cases assessed as material or higher risk face more stringent requirements, including senior management sign-off and oversight. Annex A adds, in a separate sentence, that control and audit functions “should demonstrate effective challenge”.

Footnote 5 lists the factors the assessment should generally weigh. The first is purpose: what data will be used and what outcomes or actions the use case generates. The second is the impact of failure, including potential harm to customers and the consequence for operations if the institution relies on the use case heavily. The third is maturity, meaning technological complexity, whether fit-for-purpose models with a proven track record exist, and how novel the use case is relative to the institution’s own competence and experience.

The assessment then carries through the lifecycle:

Monitoring is tailored to the use case. For use cases that take actions, the Guidance expects risk-proportionate controls over the entire process, including intermediate steps leading up to final outcomes. Where one AI system tests or monitors another, an arrangement the Guidance calls “A.I. versus A.I.”, institutions should allow for weaknesses or biases in both systems and keep human oversight and corroborating checks in place. Footnote 6 describes an effective monitoring plan as covering roles and responsibilities, indicators and escalation thresholds, response actions and review frequency, with attention to data or model drift, misuse, safeguard failures, and material security and conduct risks, including inappropriate bias and unfair outcomes.

Footnote 7 shows how far the record-keeping can reach. Examples of records include sources, references, models and model versions, model configurations and inputs and, where applicable, including for generative AI use cases, prompts and evidence supporting the reasoning behind material outputs. Those records sit under the institution’s existing data protection, confidentiality and retention requirements.

On incident reporting, Annex A points back to the existing rules: “Significant incidents should be reported to the HKMA in accordance with prevailing supervisory requirements.” The trigger and the channel are those that already apply to the institution, and the Guidance introduces no AI-specific return. Annex A also expects the materiality and risk assessments to be revisited regularly as risks change, so on my reading a use case classified as low risk at launch can move into the stricter column later in its life.

Principle 5 on data, vendors and cyber attacks

Principle 5 asks for risk management frameworks that cater for the specific needs of AI, and names three areas for particular attention.

Data governance comes first. Data used for AI should be fit for purpose and subject to appropriate safeguards, with a framework setting out which types of data may be used, for which purposes, and with which controls, scaled to the materiality of the use case. Data use “should not go beyond these established and approved parameters”. Personal data needs full compliance with the Personal Data (Privacy) Ordinance. Institutions should also put contractual safeguards in place to stop AI service providers re-using customers’ personal data or the institution’s other confidential information for model training or improvement, unless the institution specifically authorises it and applicable requirements permit it, and should minimise exposure through measures such as masking or pseudonymous identifiers.

Third-party risk is the second area. Where an institution relies on external AI service providers, it “remains responsible for all A.I.-generated outcomes” and for the soundness of the arrangement, including the implications for its operational resilience. Providers should go through due diligence and risk assessment before selection, be bound by formal contractual safeguards, and face ongoing monitoring and performance reviews. Footnote 8 lists what the contract should generally cover, subject to the use case: the provider’s responsibilities, audit rights, data protection, notification of material changes and incidents, and response and recovery. Institutions should also assess concentration, continuity, substitutability and exit risks, with particular attention to material and higher-risk use cases “that may depend on a small group of dominant players”. For the wider third-party lifecycle these AI-specific points sit within, see our explainer on the Basel Committee’s third-party risk principles.

Cyber risk is the third. The Guidance expects layered cybersecurity and access controls against attacks that try to manipulate AI outputs, such as data poisoning, or to reach data held by AI systems, such as prompt injection and safeguard bypass. Controls should keep pace with emerging tactics and technology developments, frontier AI among them. The sentence with the most direct design consequence is the last one, which states in general terms that institutions “should not rely solely on model instructions or filters to obtain assurances in this regard.” On my reading, a system prompt telling a model not to disclose customer data counts as a model instruction, so it can be one layer, and the assurance has to come from access controls and the other layers around it.

Principle 6 covers people. Senior management should commit adequate resources to deliver the AI strategy and plan capacity with a forward-looking view. Organisation-wide communication and exposure to AI should scale with the degree of AI use, and specialist skills should be maintained through role-specific training.

Trust covers outputs, explainability and the customer’s route to review

Principle 7 makes institutions accountable for “A.I.-generated outputs, including actions”, and for assuring their quality. Safeguards should match how outputs are used and what follows from them. Institutions should stay alert to inaccurate or incomplete outputs, including plausible but fabricated ones (“hallucinations”). Where an output may have material impact, for example on a customer, it should face more stringent review and controls, such as a requirement to be anchored in reliable reference sources, and/or human validation. Each institution should define when outputs must be withheld, referred for review, or restricted from triggering actions because reliability or safety standards are not met.

Principle 8 asks institutions to understand and document how explainable each use case is and where its explainability stops, with the depth of documentation and any mitigating measures matched to the use case’s assessed materiality and risks. Stakeholders inside and outside the institution should receive information on the system’s purpose, functions, limitations and the basis for material outcomes, as applicable. Where a use case’s objectives can still be met, institutions should prioritise AI arrangements that are more explainable. The 2019 text demanded explainability with “no black-box excuse”; the 2026 text drops that phrase and works through documented limits and a stated preference, which I read as a standard that accepts documented limits where they are proportionate to the use case.

Principle 9 deals with ethics and fair treatment. AI-driven decisions should not discriminate or unintentionally show bias against any group of consumers. Where outputs may have actual consequences for customers, institutions should monitor regularly, benchmark and assess the reasonableness of outputs, for example through sample review, and take mitigating action when anomalies appear. Affected parties should be able to seek clarification, review or re-assessment, and human reviewers should be empowered to challenge and correct outcomes. Before providing an AI-powered service, an institution should clearly inform consumers of the use of AI and the relevant risks. That before-service disclosure carries over from Principle 8 of the 2019 set, which asked banks to make the same point clear before service provision.

Agentic AI: Annex A applies today and Annex C previews what may follow

The sandbox evidence explains why agentic AI gets its own annex. The second cohort of the GenA.I. Sandbox, announced on 15 October 2025, involved 20 banks and 14 technology partners working on 27 use cases. The HKMA’s 15 October 2026 press release says more than 60% of those use cases explored agentic AI. GenA.I. Sandbox++ is run by the HKMA, the Securities and Futures Commission, the Insurance Authority and the Mandatory Provident Fund Schemes Authority in collaboration with Cyberport. Its first cohort, announced on 27 August 2026, selected 36 use cases from nearly 100 proposals, involving 30 financial institutions and 27 technology partners, with a focus on agentic applications and technical trials starting later in 2026.

Annex C sets out four governance concepts:

• Intent-anchored accountability: link each agent’s actions to the business intent that defines its authorised scope of autonomy and the person or function accountable for it.
• Visibility over material AI agents: an inventory of material agents as a basis for continuous monitoring, and clear “component lineage” across the models, data, tools, infrastructure and third-party services an agent relies on.
• Human oversight and intervention: an approach the note describes as moving from “human in the loop” to “human on the loop”, with intervention measures such as suspending an agent’s access to particular tools or systems, an emergency stop such as a “kill switch”, and intervention points before actions with material customer implications.
• Operating boundaries and safeguards: clearly defined tools, systems and data an agent may access or invoke, which a “risk-integrated agent harness” may help translate into practical constraints.

A registry for material AI agents appears in Annex C only as an idea under exploration. Annex C says the HKMA “is also exploring the possibility of an industry-level registry for material A.I. agents deployed by AIs”, and the note as a whole “does not constitute specific supervisory requirements at this stage”. The concrete next step is a discussion paper. The HKMA will issue one that references the concept note, sets out options for possible supervisory requirements on agentic AI governance, and seeks views from institutions and other stakeholders. Until then, none of the circular, Annex A or Annex C gives the registry a template, field list, threshold or start date. The article’s account of Annex B relies on the circular’s and Annex A’s descriptions of it.

Agentic deployments already fall under Annex A, though. Principle 4 expects controls over “the entire process (e.g. intermediate steps leading up to final outcomes)” for use cases that take actions. Principle 7 makes institutions accountable for outputs “including actions”. The kill-switch expectation applies to more material or higher-risk use cases whatever their architecture. An institution running an agentic pilot today is working to Annex A, with Annex C indicating the direction of travel.

Two regulators, two clocks: the ART Guidance next to MAS and the FSB

The FSB published its final report on 12 sound practices for responsible AI adoption on 15 October 2026, the same day as the HKMA circular. The FSB groups them into a first set on organisation-wide AI governance, including the role of the board and senior management and the documentation of AI use, and a second set on the AI lifecycle covering materiality assessment, technology choice, data governance, explainability, performance evaluation, human oversight, AI-related cyber and ICT risk, and third-party AI dependencies. Annex A states that it has incorporated the latest guidance from international bodies including the FSB, and the circular says the HKMA drew on that guidance. Neither document maps the 12 FSB sound practices to the nine Annex A principles, so that comparison is left to the institution.

Singapore runs on a fixed timetable. The Monetary Authority of Singapore issued its final Guidelines on Artificial Intelligence Risk Management on 7 October 2026. They take effect on 7 October 2027, and MAS states that financial institutions may implement them in phases, meeting the expectations in Sections 3 to 4 from 7 October 2027 and Sections 5 and 6 by 7 October 2028. Our guide to the MAS AI risk management guidelines covers that phasing. Annex A has no equivalent date, only “in a timely manner”. A group with authorized institutions in Hong Kong and regulated entities in Singapore therefore has one dated programme and one undated one, and the Hong Kong target date becomes an internal governance decision.

Institutions with EU operations face a third model. The EU AI Act is legislation that covers the AI value chain, including providers and deployers of AI systems, as IOSCO’s May 2026 supervisory toolkit report summarises. Our EU AI Act compliance guide for financial institutions sets out those obligations. Annex A is supervisory guidance issued by circular, phrased in “should” and “are expected to”, and it cites no statutory basis for the expectations themselves.

Frequently Asked Questions

Does the ART Guidance apply to stored value facility licensees or licensed stablecoin issuers?

The circular is addressed to “The Chief Executive, All Authorized Institutions”, and Annex A’s purpose statement refers to authorized institutions. Neither document mentions stored value facility licensees or issuers licensed under the Stablecoins Ordinance (Cap. 656), which the HKMA keeps on separate registers, but authorized institution status can overlap with SVF or stablecoin issuer licensing. Licensed banks are regarded as SVF licensees, and The Hongkong and Shanghai Banking Corporation Limited is both an authorized institution and a licensed stablecoin issuer, so such institutions remain within the circular’s scope in their capacity as authorized institutions. A non-bank entity is not brought into scope solely by holding an SVF or stablecoin issuer licence, although group-wide AI policies may also apply. Our article on the first HKMA stablecoin issuer licences covers that separate regime.

Our customer chatbot launched under the 2024 human-in-the-loop expectation. Can it move to human-on-the-loop now?

Footnote 3 of Annex A allows institutions to follow the 2026 guidance when choosing the oversight arrangement for customer-facing AI. The decision would rest on Annex A’s risk-based triggers and on assurance, for example through testing, that the new arrangement works. Annex A also expects end-to-end testing before material changes to AI systems; whether an oversight change counts as a material change is a judgement for the institution’s framework, and on my reading a conservative framework would treat it as one.

Who at the HKMA answers questions on the Guidance?

The documents give two addresses. The covering circular directs questions to GenAI_sandbox@hkma.gov.hk. Annex A says questions may be directed to the Technology Risk Team at ebanking@hkma.iclnet.hk.

A vendor contract signed before October 2026 lets the vendor use our data to improve its model. What does Annex A expect?

Annex A expects contractual safeguards that prevent AI service providers from re-using customers’ personal data or other confidential information for model training or improvement unless the institution specifically authorises it and applicable requirements permit it. It sets no repapering deadline beyond the general “timely manner” wording. Annex A also expects concentration, continuity, substitutability and exit risks to be assessed for AI service providers, with particular attention to material and higher-risk use cases, so the same vendor falls within that assessment.

Can Annex B good practices be cited as evidence of meeting Annex A?

The circular says Annex B includes cross-references to the Guidance to help institutions implement the principles, and Annex A calls its examples non-exhaustive. On my reading, matching an Annex B practice is supporting evidence, while the Annex A principle itself remains the test. Specific Annex B examples are not summarised here.

Do internal tools such as coding assistants need the full lifecycle treatment?

They belong in the inventory, because Principle 3 covers all AI use, including embedded and third-party tools. The depth of review then follows the materiality assessment in Principle 4, so a low-impact internal tool can carry lighter approval and testing than a customer-facing model. The staff-use rules and shadow AI controls apply regardless of materiality.

Related Articles

• FSB AI Sound Practices Final Report: A Governance Gap Analysis: the twelve FSB sound practices published on 15 October 2026 and how to use them for an AI governance gap analysis.
• MAS AI Risk Management Guidelines: Inventory First, Controls by 2028: Singapore’s final AI risk management guidelines and their phased implementation dates.
• BCBS Third-Party Risk Principles: DORA and Outsourcing Rules: the Basel Committee’s principles on managing third-party risk, including classification, registers and exit planning.
• EU AI Act Compliance for European Financial Institutions: provider and deployer duties, high-risk classification and incident reporting under the EU AI Act.
• HKMA-MAS Banking Supervision MoU: The Cross-Border Picture: the supervisory cooperation memorandum between the Hong Kong and Singapore banking supervisors.

Key Takeaways

• Repoint every internal policy reference from the 1 November 2019 High-level Principles to Annex A of circular B1/15C.
• Board paper needed: an AI strategy stating the approach and risk appetite, with senior management bringing later adjustments back for board approval.
• Inventory tasks: define “A.I. use”, standardise the recorded attributes, assign record-keeping responsibility and cover embedded vendor features.
• Annex A says material or higher-risk use cases should be subject to senior management sign-off and independent validation, a kill switch or equivalent should be built in for more material or higher-risk cases, and records enabling outcome tracing should be maintained as far as practicable.
• Vendor contracts for AI services: check audit rights, data protection, change and incident notifications, response and recovery, and safeguards that stop provider reuse of customer personal data or the institution’s other confidential information for model training or improvement unless the institution specifically authorises it and applicable requirements permit it.
• Any switch away from human-in-the-loop on a customer-facing tool needs a separate check of the 2024 opt-out and review channels.
• No agentic AI registry filing exists yet; the trigger to watch is the HKMA discussion paper, which has no published date.
• Singapore financial institutions in the same group work to MAS dates of 7 October 2027 and 7 October 2028.

Sources and References

• HKMA press release, “HKMA announces ‘ART’ Framework to promote responsible A.I. adoption” (15 October 2026): https://www.hkma.gov.hk/eng/news-and-media/press-releases/2026/10/20261015-3/
• HKMA, “Opening Remarks at Finance + A.I. Forum” (16 October 2026): https://www.hkma.gov.hk/eng/news-and-media/speeches/2026/10/20261016-1/
• HKMA, Register of SVF Licensees: https://www.hkma.gov.hk/eng/regulatory-resources/registers/register-of-svf-licensees
• HKMA, Register of Licensed Stablecoin Issuers: https://www.hkma.gov.hk/eng/regulatory-resources/registers/register-of-licensed-stablecoin-issuers/
• HKMA circular B1/15C, “Responsible Adoption of Artificial Intelligence” (15 October 2026): https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20261015-4-EN/20261015-4-EN.pdf
• Annex A, “Supervisory Guidance for Responsible Adoption of Artificial Intelligence” (15 October 2026): https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20261015-2-EN/20261015-2-EN.pdf
• Annex B, “Practical Insights from the Second Cohort of the GenA.I. Sandbox” (15 October 2026), repository entry: https://brdr.hkma.gov.hk/eng/doc-ldg/docId/20261015-3-EN
• Annex C, “Concept Note on Governance of Agentic Artificial Intelligence” (15 October 2026): https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20261015-1-EN/20261015-1-EN.pdf
• HKMA circular, “High-level Principles on Artificial Intelligence” (1 November 2019): https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20191101-1-EN/20191101-1-EN.pdf (repository entry: https://brdr.hkma.gov.hk/eng/doc-ldg/docId/20191101-1-EN)
• HKMA circular, “Consumer Protection in respect of Use of Generative Artificial Intelligence” (19 August 2024), which also summarises the 5 November 2019 BDAI consumer protection circular: https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20241107-1-EN/20241107-1-EN.pdf
• HKMA press release, “HKMA announces second cohort of GenA.I. Sandbox to advance responsible A.I. innovation” (15 October 2025): https://www.hkma.gov.hk/eng/news-and-media/press-releases/2025/10/20251015-4/
• HKMA press release, “First cohort of GenA.I. Sandbox++” (27 August 2026): https://www.hkma.gov.hk/eng/news-and-media/press-releases/2026/08/20260827-3/
• HKMA, Fintech Promotion Blueprint (February 2026): https://www.hkma.gov.hk/media/eng/doc/key-information/press-release/2026/20260203e3a1.pdf
• Financial Stability Board, “FSB finalises sound practices for the responsible adoption of artificial intelligence (AI)” (15 October 2026): https://fsb.org/2026/10/fsb-finalises-sound-practices-for-the-responsible-adoption-of-artificial-intelligence-ai
• Financial Stability Board, “Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Final report”: https://www.fsb.org/2026/10/sound-practices-for-responsible-adoption-of-artificial-intelligence-ai-final-report/
• Monetary Authority of Singapore, Guidelines on Artificial Intelligence Risk Management for Financial Institutions (7 October 2026): https://www.mas.gov.sg/regulation/guidelines/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions
• Monetary Authority of Singapore media release, “MAS Sets Out Supervisory Expectations on Responsible AI Adoption by Financial Institutions” (7 October 2026): https://www.mas.gov.sg/news/media-releases/2026/mas-sets-out-supervisory-expectations-on-responsible-ai-adoption-by-financial-institutions
• IOSCO, “Supervisory Toolkit for AI Use in Capital Markets: Final Report” (FR/02/2026, May 2026): https://www.iosco.org/library/pubdocs/pdf/IOSCOPD823.pdf

The next HKMA ART Framework milestone is the agentic AI discussion paper

The HKMA has committed to a discussion paper on agentic AI governance without giving a publication date. Its 15 October announcement already named a registry of material AI agents among the topics the discussion paper will explore, and the 16 October supervisory remarks said the HKMA will explore whether a centralised supervisory registry could support banks’ resilience work, including mapping their AI dependencies, across the banking sector. The forthcoming paper is expected to develop options for possible supervisory requirements and seek stakeholder views. Until it is published, the Annex A gap analysis is the work that can be finished now. Annex A calls for a board-approved AI strategy and, separately, an inventory that records each use case’s owner, provider and model, and risk classification, among other attributes.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.