Aureus Sovereign › AI governance

AI governance for Hong Kong boards

A Hong Kong director does not need to understand how these systems are built. A director does need to be able to answer, in a meeting, what the organisation has deployed, what it is permitted to do without supervision, and where the material it processes goes.

The questions below are the ones that matter first. They are written to be put to a technology function, a vendor or an adviser, and they are ordered so that the answers to the early ones determine whether the later ones matter.

What has actually been deployed

• Which systems are in use, and under whose licence? Including anything adopted by a division without central procurement. This is frequently the longest part of the answer.
• Which of them act without a person approving each step? A system that executes a sequence unsupervised carries a different risk from one that answers a question and stops.
• What is each one permitted to do unsupervised, and who set that boundary? If no one can name the person, the boundary is a default rather than a decision.

Where the material goes

• Which model is behind it, operated in which jurisdiction? The answer determines where material is processed and under whose terms.
• Is anything submitted to it retained, and is it used to train anything? Enterprise terms and consumer terms frequently differ on precisely this point.
• What categories of material have been submitted so far? Personal data, material under privilege, and information subject to a confidentiality undertaking each carry different consequences.
• Would a data subject request, or a regulator's enquiry, be answerable? Hong Kong's Personal Data (Privacy) Ordinance governs personal data handling, and the Privacy Commissioner has published guidance addressed to organisations deploying AI. Whether current practice satisfies it is a question for the organisation's own advisers, and it is a question worth asking before it is asked from outside.

Oversight that survives contact with the working week

• Which role approves, at what daily volume? An approval gate that requires more reading than one person has hours becomes a signature rather than a review.
• What governs the position during absence? Human-in-the-loop review that has no answer for leave is a control on paper only.
• What happens when the system is wrong, and who is accountable? A named role, not a process diagram.
• How is performance measured beyond the demonstration? Behaviour on sustained use, on unusual inputs, and at volume, rather than on the examples prepared for the meeting.

Sector supervision

Financial institutions, licensed corporations and regulated professionals in Hong Kong operate under supervisory expectations that extend to the systems they deploy, and those expectations have been developing quickly. The practical question for a board is not whether a particular circular applies, which its advisers will determine, but whether the organisation could produce, on request, a coherent account of what is deployed, what it is permitted to do, and who approved it.

An organisation that cannot answer the questions on this page for its own systems will not be able to produce that account.

Where restricted material cannot leave the premises

Some matters cannot be submitted to an external service at all: a live transaction, a regulator's file, material under privilege. Where that applies, capable models can be operated on equipment held at the client's own premises with no network path out, so that processing occurs within the room the material is held in. This is not required for most work.

This page states questions, not requirements. It is not legal advice, and what any ordinance or supervisory expectation requires of a particular organisation is a matter for that organisation's own advisers.

The terminology, defined · The programme in detail