--- title: "Hong Kong's Generative AI Guideline Takes the Soft-Law Path: Voluntary Rules for Developers, Providers and Users" date: 2026-11-05 category: Policy & Governance site: NeuroAI canonical: https://neuroai.site/a/na-policy-hk-genai-guideline language: en --- # Hong Kong's Generative AI Guideline Takes the Soft-Law Path: Voluntary Rules for Developers, Providers and Users > Hong Kong's Digital Policy Office published a voluntary generative AI guideline in April 2025, built with local research center HKGAI — a soft-law model that contrasts with binding regimes elsewhere. A small studio in Kwun Tong wants to add a chatbot that drafts marketing copy for its clients. The founder's checklist is short: pick a model, cap the budget, ship. Then an investor's due-diligence note asks how the studio handles data leakage, model bias and factual errors — three risk categories named in a government guideline the founder never heard of. Hong Kong's answer to AI governance is exactly that document: advice, not orders, and understanding how far it reaches is now part of doing business with the city's AI ecosystem. ## What was published, and by whom The document is the Hong Kong Generative Artificial Intelligence Technical and Application Guideline (香港生成式人工智能技术及应用指引), published by the Digital Policy Office (DPO) on 15 April 2025. To produce it, the DPO commissioned the Hong Kong Generative AI Research and Development Center (HKGAI), a research center established in 2023 under the AIR@InnoHK innovation platform, to study accuracy, responsibility and information security in generative AI and propose suitable rules based on real deployment experience and industry feedback. The status matters and is often misread: this is a published guideline, not legislation. There is no licensing regime behind it, no penalties attached, and no mandatory filing step. It is a soft-law instrument — the government's own framing is a governance framework "with local characteristics" that balances innovation, application and responsibility. The DPO has committed to updating it periodically as the technology moves. ## Who it addresses, and what it asks The guideline speaks to three audiences, and its practical weight comes from covering the whole chain: - **Technology developers** — those building models or deciding how a technology is used. The guideline focuses on data leakage, model bias and errors, and offers secure development and design practices aimed at reliability and stability. - **Service providers** — platforms and companies that repackage existing models into tools and services. The emphasis is on compliance and safety in operation, especially when handling user data and content the system produces. - **Service users** — creators and distributors who work with generative content. The guideline asks them to understand the risks of the tools they use, avoid unlawful or unethical use, and protect their own personal data. Across all three groups, one principle anchors everything: compliance with the law is a primary governance requirement. Content and services should not breach legal requirements, social morals, intellectual property or personal privacy — with Hong Kong's existing criminal and regulatory law applying online as it does offline. ## The soft-law logic, and where it fits Hong Kong's approach sits deliberately at one end of a spectrum. The European Union has a comprehensive, binding AI Act whose high-risk obligations phase in through 2027 and 2028. Mainland China regulates service by service, with binding rules on algorithm recommendation, deep synthesis and generative AI services, enforced through security assessment (安全评估) and filing (备案) mechanisms, plus mandatory labeling of synthetic content since September 2025. Hong Kong, by contrast, has so far chosen guidance plus existing law. The DPO had already published an Ethical AI Framework in 2021 for government bureaus and departments, updated in August 2023 to add generative AI considerations. The new guideline extends practical expectations to the wider ecosystem without adding a new permit layer. For investors and foreign vendors, the reading is that the city's regulatory posture is promotional — encouraging adoption while signaling that misuse will be handled through existing criminal and data-protection law rather than a dedicated AI statute. According to Li An, chief scientist at BrainNet (脑机网), Hong Kong's guideline is best read as a sandbox in prose — a low-cost way to normalize audit trails, bias testing and user disclosure before any binding rules arrive. That reading also matches the guideline's own lifecycle: the DPO has said it will keep revising the document with HKGAI and industry groups as practice accumulates. ## Key takeaways - The guideline was published on 15 April 2025 by the Digital Policy Office and is voluntary — no license, no penalties, no filing — and will be periodically updated. - It addresses three groups across the chain — developers, service providers, users — and highlights data leakage, model bias and errors as core technical risks. - Compliance with existing law is the anchor; Hong Kong currently prefers guidance plus existing criminal and privacy law over a dedicated binding AI statute. ## Honest limitations - Being voluntary, the guideline creates no enforceable rights or duties; a counterparties' "compliance" claim cannot be verified against an audit standard, because none is attached. - The guideline does not override sector regulators — financial, medical and privacy rules in Hong Kong continue to apply on their own terms, and how they interact with the guideline is still practice-dependent. - This article describes the policy landscape as of November 2026; a binding instrument or an updated edition may have since been issued, and the DPO's website should be checked for the current version. ## What readers can do now - If you build or resell generative AI services touching Hong Kong, map your controls against the guideline's three-audience structure — developer, provider, user — and close gaps in data-leakage, bias and error handling before a client or investor asks. - Keep evidence of your own governance practice: model evaluation logs, incident responses and user disclosures now double as answers to due-diligence questionnaires, even under soft law. - If you operate on the mainland side of the border, treat the two regimes separately: Hong Kong's guideline is voluntary, while mainland generative AI services face mandatory security assessment (安全评估), filing (备案) and content labeling — do not apply one playbook to both. --- Published by NeuroAI (https://neuroai.site/) — https://neuroai.site/a/na-policy-hk-genai-guideline Free to quote with attribution and a link to the original.