Policy office: HK should bar AI tools that could endanger human safety

Hong Kong’s digital policy body has urged the government to ban generative artificial intelligence (AI) systems that could endanger human safety, along with strict oversight for their use in critical infrastructure, as part of the newly released guidelines.

During a speech at the World Internet Conference Asia-Pacific Summit on 15 April, commissioner for digital policy Tony Wong Chi-kwong said the new guidelines are to strike a balance between AI innovation and responsible usage, creating a governance framework suited to Hong Kong’s unique context and addressing the needs of all stakeholders in the AI ecosystem.

“We hope the guidelines can facilitate the industry and the public in developing and applying generative AI in a safe and responsible manner, while encouraging innovative application of AI, mitigating risk and fostering the widespread adoption of generative AI in Hong Kong," he added.

The office commissioned the Hong Kong Generative AI Research and Development Centre (HKGAI) earlier, to study and suggest appropriate codes and guidelines on the accuracy, responsibility and information security in generative AI technologies and practices, based on practical applications and the feedback collected from the industry.

The proposed AI governance framework establishes a four-tiered risk classification system, creating a proportionate regulatory approach based on potential harm. At the highest level, "Unacceptable Risk" systems that pose existential threats such as uses causing harm or affecting human safety or subliminal manipulation should be prohibited, where developers will need to bear legal liability.

"High Risk" applications deployed in critical infrastructure contexts like healthcare diagnostics or autonomous vehicles require conformity assessments, human oversight, and continuous monitoring. Systems with "Limited Risk" that have moderate societal impact, including recruitment tools or educational AI, must fulfil transparency obligations, provide user opt-out mechanisms, and undergo annual compliance audits.

Finally, "Low Risk" applications such as spam filters or creative tools face minimal regulatory burden, requiring only self-certification. This calibrated approach balances innovation with appropriate safeguards, ensuring regulatory intensity corresponds to the potential severity of harm across the AI ecosystem.

In addition, generative AI models must be packaged as services or products to be brought to market. For example, OpenAI's ChatGPT is essentially a chat service based on large language models. It provides a front-end interactive interface for Service Users, while the back end can employ various models such as GPT-4o, o1, or o1-mini.

To ensure data security, service providers must comply with relevant data protection regulations such as the Personal Data (Privacy) Ordinance (PDPO) when collecting, processing, using, storing, retaining and deleting of user data including personal data. They must fully protect the privacy rights of service users, avoiding excessive collection, misuse, or disclosure of user data.

At the same time, they should strengthen the encryption and desensitisation of sensitive data to ensure the security and privacy of data during its transfer. When necessary, they should work closely with technology developers and conduct data security surveys among Service Users to promptly identify and fix security vulnerabilities.

The DPO will continue to monitor the latest technological and application developments in generative AI, while maintaining close collaboration with HKGAI, relevant academic institutions and industry groups. The office will regularly update the guideline for reference by all sectors.

Related articles:

Survey: 78.3% of youngsters in HK see generative AI as an irreversible trend
Microsoft partners with universities to allow the use of generative AI in school