What Are the PCPD's AI Compliance Checks?
Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD) examined 60 organisations across 16 sectors this year and found zero contraventions of the Personal Data (Privacy) Ordinance. Yet the same report shows the proportion of organisations with formal AI policies fell from 63% to 50%, and board-level AI discussions dropped by roughly 25 percentage points. The clean compliance record is concealing a governance problem.
The PCPD's AI compliance checks are an annual regulatory exercise in which Hong Kong's privacy regulator assesses how organisations collect, use and process personal data through AI systems under the PDPO. The 2026 round, published in May 2026, reviewed 60 organisations and measured their implementation of the PCPD's AI Model Personal Data Protection Framework and its Checklist on Guidelines for the Use of Generative AI by Employees.
This is the third consecutive round, following exercises in 2024 and 2025. The 2026 checks widened the net beyond banking, insurance, education and retail to add accounting, food and beverage, innovation and technology, logistics, and property management. Half of the organisations reviewed employ more than 500 people, which makes the findings directly relevant to mid-market and enterprise leaders.
The 2026 exercise was expressly framed to align with the National 15th Five-Year Plan and the Hong Kong Government's AI Plus policy direction. That framing matters: it signals that AI oversight in Hong Kong is not a one-off review but a sustained regulatory programme with political weight behind it.
What Did the 2026 Checks Find About AI Adoption in Hong Kong?
The PCPD found that 95% of the 60 organisations reviewed use AI in day-to-day operations, up 15 percentage points from 80% in 2025. Around 79% have used AI for over a year and 51% run three or more AI systems. Adoption is now embedded infrastructure in Hong Kong business, not an experiment.
The application areas will look familiar to any operations leader: administrative support, customer service, research and development, marketing, and compliance and risk management. These are precisely the functions where personal data concentrates, which is why the regulator is watching them.
Independent research points the same direction. The Deloitte-HKU AI Adoption Index 2026 similarly found near-universal AI usage among Hong Kong organisations, but reported that only 23% have achieved operational deployments with measurable financial impact. Adoption is wide; maturity is thin.
For a department head, that gap is the strategic headline. Your competitors almost certainly use AI somewhere. Far fewer have connected it to governed data, documented processes and measurable outcomes. The organisations that close that gap first convert AI from a talking point into an operating advantage.
Where Are Hong Kong Enterprises Reducing Their Data Risk?
The most striking 2026 finding is a deliberate shift to data-light AI. Organisations retaining personal data collected through AI fell from roughly 79% in 2025 to 29% in 2026, a drop of about 50 percentage points. Enterprises are increasingly processing data transiently, anonymising it, or keeping it out of AI systems entirely.
The supporting numbers confirm the pattern. Among the 24 organisations that collect or use personal data through AI, around 63% now use anonymised or pseudonymised data, and 33% have adopted privacy-enhancing technologies such as synthetic data and federated learning.
Security controls held at a high standard. All 24 organisations implemented access control, encryption and penetration testing, and around 21% added AI-specific security alerts and red-teaming drills. Roughly 79% adopted a human-in-the-loop model in which people review AI outputs before they take effect.
There is one transparency gap worth noting. Every organisation that collects personal data through AI issued a Personal Information Collection Statement, but only 29% actually mentioned AI in it. A privacy statement that is silent on AI may not support feeding that data into AI systems, which leaves a quiet legal exposure sitting inside otherwise compliant paperwork.
Why Did AI Governance Slip While Adoption Accelerated?
Two governance indicators moved backwards in 2026. Organisations with formulated AI policies fell from about 63% to 50%, and those holding board-level discussions on AI dropped by around 25 percentage points, to 54%. Adoption accelerated while the structures meant to steer it weakened, and the PCPD flagged this divergence as a concerning trend.
The likely cause is familiar to anyone who has led a transformation programme. When a technology moves from pilot to daily use, urgency shifts to deployment and the governance workstream quietly loses its sponsor. Policy drafts stall in legal review. The board item slips off a crowded agenda.
The risk is asymmetric. Undocumented governance does not hurt until the day an incident, a complaint or a regulator's letter arrives. At that point, the burden of explanation lands on management, and the absence of a policy reads as an absence of oversight.
Consider how this plays out in a regulated sector. A financial services firm that deploys an AI customer-service assistant without a documented policy may operate flawlessly for a year. Then one complaint about an AI-generated response reaches the regulator, and the first document requested is the AI policy that does not exist. The technology performed; the governance failed.
There is also a competitive reading. If only half of the organisations in the PCPD's sample have an AI policy, and just 54% discuss AI at board level, then a leader who brings a documented AI governance position to the board is immediately ahead of roughly half the market. Governance, in this moment, is a differentiator rather than overhead.
What Does the PCPD Say About Agentic AI?
The PCPD singled out agentic AI as a distinct and elevated risk category, both in the 2026 report and in a separate alert issued in March 2026. Unlike a chatbot that drafts text, an agentic AI system holds standing access to files, applications and system resources, and executes multi-step tasks without real-time human involvement.
The regulator's concern is concrete. An agent with elevated default access can expose files, emails, account credentials and browser contents. It can misinterpret an instruction and delete important data. Unvetted plugins or skills can embed malicious code that enables account or system takeover.
The PCPD's recommended controls are specific enough to lift straight into an internal standard: grant only the minimum access rights necessary, download agents only from official channels in their latest versions, segregate the runtime environment from production devices and servers, verify the security of every plugin before installation, run continuous risk assessments, and keep a human in the loop for final decisions.
The strategic implication for 2026 planning: if your organisation is evaluating AI agents for operations, procurement or customer service, the governance design must be part of the deployment plan from day one. Deploying an agent effectively grants a non-human actor standing access to your systems, and the PCPD has now said, in writing, how it expects that actor to be supervised.
How Should Your Enterprise Respond? A Five-Point Framework
The 2026 findings translate into five actions that align your AI deployment with the PDPO, the PCPD Model Framework and the direction of regulatory travel. Together they form a defensible governance baseline you can present to a board or a regulator: policy, transparency, calibrated oversight, operational safeguards, and supply-chain control.
1. Reinstate the policy and the board agenda item. Treat an enterprise-wide AI policy and periodic senior-management reporting as baseline accountability. Align the policy to the PCPD Model Framework so oversight scales as deployment grows.
2. Make AI visible in your privacy documents. Update Personal Information Collection Statements and Privacy Policy Statements to state plainly where and how AI processes personal data. This closes the gap that 71% of AI-using organisations currently leave open.
3. Calibrate human oversight to risk. Reserve genuine human-in-the-loop control for consequential decisions such as credit, hiring and customer outcomes, and apply a stricter control set to agentic AI: least-privilege access, environment segregation and plugin vetting.
4. Operationalise the safeguards you have planned. Regular audits rose 17 percentage points and AI-specific incident response rose 9 points in the PCPD sample. These are becoming the expected standard, so move them from the planning column to practice, and rehearse an AI-specific breach scenario this year.
5. Manage the AI supply chain contractually. With 51% of organisations running three or more AI systems, vendor management is central to compliance. Ensure contracts impose data security, assistance and accountability obligations, and complete due diligence on tools and plugins before deployment.
Sequencing matters as much as the list itself. Points one and two are documentation exercises a capable team can complete within a quarter. Points three to five are operational programmes that need owners, budgets and review cycles. Presenting them to the board as a phased twelve-month plan, rather than a single compliance project, is what turns this framework from a memo into a mandate.
What Are the Common Pitfalls to Avoid?
The most frequent failure is mistaking a clean audit for a durable position: the PCPD found no PDPO contraventions, but its findings on shrinking policy coverage and board engagement show many organisations are compliant on paper while their governance erodes underneath. Three specific pitfalls follow from the 2026 data.
Treating the compliance check as someone else's sector. The 2026 round added logistics, accounting, food and beverage, innovation and technology, and property management. The sector net widens every year, and waiting until your industry is named is planning to be unprepared.
Assuming data-light means risk-free. Not retaining personal data reduces exposure, but transient processing still engages the PDPO at the point of collection and use. The 71% of organisations whose collection statements never mention AI illustrate how easily this is missed.
Letting agent pilots outrun agent controls. Teams adopt AI agents for productivity months before security reviews catch up. The PCPD's March 2026 alert exists precisely because this sequencing is common, and reversing it is cheaper than remediating it.
Conclusion: Govern at the Speed You Deploy
The PCPD's 2026 compliance checks describe a market where AI adoption has reached 95% but formal governance is thinning: fewer policies, fewer board conversations, and a new class of agentic risk arriving faster than control frameworks. The regulator found no breaches this year, and it also told you exactly where it will look next.
For a Hong Kong enterprise leader, the assignment is clear. Close the transparency gap in your privacy statements, put AI back on the board agenda, and hold agentic AI to a stricter standard than the chatbots that came before it. Do this now, while it is a strategic choice rather than a remediation exercise.
None of this requires facing the regulator alone. We understand AI. We understand you. With UD by your side, AI never feels cold.
Is Your AI Deployment PDPO-Ready?
The framework above tells you what good looks like. The next step is knowing where your organisation stands today. UD's AI Ready Check assesses your AI readiness across governance, data protection and deployment, and we'll walk you through every step, from assessment to remediation plan, backed by 28 years of serving Hong Kong enterprises.
