What the checks found: AI is part of daily operations
On 19 May 2026 the Office of the Privacy Commissioner for Personal Data (PCPD) published the results of its latest round of AI compliance checks. The round began in January 2026 and covered 60 organisations from sectors such as banking and finance, education, insurance, medical services, retail, telecommunications and transport. This year it was also expanded to accounting, food and beverage, innovation and technology, logistics and property management. The PCPD also looked at whether organisations applied its Model Personal Data Protection Framework for AI and its Checklist on Guidelines for the Use of Generative AI by Employees.
Of the 60 organisations, 57 (95%) used AI in day-to-day operations, up 15 percentage points from the 2025 checks. Forty-five (about 79%) had used AI for more than a year, and 29 (about 51%) used three or more AI systems. Typical uses were administrative support, customer service, research and development, marketing, and compliance and risk management. The PCPD said it identified no contravention of the Personal Data (Privacy) Ordinance during the exercise.
One caution on interpretation: 30 of the 60 organisations (50%) had more than 500 employees, and eight (about 13%) had between 100 and 500. The figures describe the organisations reviewed and should not be read as the average for all Hong Kong small and medium-sized businesses.
Behind the numbers: strengths and gaps
Among the 57 AI users, 24 (about 42%) collected and/or used personal data through AI systems. These 24 did well on the basics. All of them gave Personal Information Collection Statements, implemented security measures and carried out risk assessments. Twenty-three (about 96%) tested AI systems before deployment, 19 (about 79%) ran privacy impact assessments and used a human-in-the-loop approach, and 20 (about 83%) provided AI-related training.
The same data also shows gaps. All figures below are out of those 24 organisations:
Only 7 (about 29%) said in their collection statements that AI tools are used to process personal data.
Only 5 (about 21%) had AI-related security alerts and ran red-teaming drills.
Twenty-two (about 92%) had data breach response plans, but only 9 (about 41%) specifically covered AI-related incidents.
Twelve (50%) had formulated AI-related policies, about 13 percentage points fewer than in 2025; another 10 (about 42%) planned to.
Thirteen (about 54%) had board-level discussions on AI, about 25 percentage points fewer than in 2025.
AIPPA's reading is that AI use is moving faster than policy documents, incident preparation and management attention. Once AI shifts from pilot to everyday tool, these management gaps are more likely to become a source of risk than the technology itself.
Agentic AI: grant the minimum access
The PCPD's recommendations single out agentic AI, meaning AI that can take multi-step actions toward a goal, operate software or reach data. When organisations use it to collect, use or process personal data, the PCPD says they should consider carefully the nature and sensitivity of the data and grant only the minimum access rights needed for the task.
It also advises downloading the latest version from official channels, being cautious when installing and using plugins or skills, putting adequate system and data security measures in place, and assessing the risks continuously. In practice, a new AI tool should be introduced like any other new software: ask what files, mailboxes or accounts it can read, and how it can be stopped and traced if it goes wrong.
Six actions businesses can take now
After the checks, the PCPD made a set of recommendations to all organisations that develop or use AI. Combining them with AIPPA's practical view gives this checklist:
Set strategy, structure and training. Formulate an overall AI strategy, set up an internal AI governance structure such as a committee or named owner, train relevant staff and prepare an AI incident response plan.
Give staff a policy. Cover generative AI and AI agents, state permitted uses, personal data protection, data security and the consequences of breaches, and review it regularly.
Assess risk and match oversight. Carry out comprehensive risk assessments, including privacy impact assessments; the higher the risk, the stronger the human oversight.
Audit regularly. Run internal audits, and independent assessments where necessary, to confirm AI systems stay secure and consistent with company policy.
Update external disclosure. Review collection statements and privacy policies so they explain the role of AI in handling personal data, one of the areas where the fewest organisations reported action.
Talk to stakeholders. Keep communication open to increase transparency and adjust systems in response to feedback from customers and staff.
AIPPA's takeaway
The checks send two messages. First, AI is already an everyday tool across many Hong Kong sectors. Second, regulators are moving their attention from whether organisations use AI to whether they manage it well. The most practical step now is to inventory which AI tools are in use and which personal data they touch, then fill in policy, incident response and external disclosure. This article is an analysis based on the PCPD's public materials and is not legal advice; regulated industries should confirm specific requirements with their regulators and professional advisers.