Notes from the Asia-Pacific region: China, Hong Kong advance AI security, data accountability

China's developments include draft security guidelines for AI agents and new policy guidelines promoting technological innovation and the use of advanced technologies across industries. Hong Kong is also developing risk-management guidelines and considering legal responsibility for AI-related harm. 

As the temperature cools, the data and artificial intelligence spaces remain hot in Greater China.

Some recent developments in mainland China and Hong Kong highlight an important trajectory in AI and data governance. Both governments want businesses to make greater use of AI and data, while paying closer attention to security, privacy and accountability.

In mainland China, recent regulatory actions, new AI agent security guidelines, court rulings following the judicial opinions issued by the Supreme People's Court, and a major national policy on technological innovation all point in this direction. Hong Kong has also set out new plans to manage AI risks and clarify legal responsibilities. 

On 18 Sept., China's National Cybersecurity Standardization Technical Committee issued draft Security Guidelines for Intelligent Agent System Development for public consultation, which closed 2 Oct. The draft covers security considerations throughout the development process, including system design, implementation, testing and release. It provides a basis for addressing risks linked to autonomous actions, tool use, system access and data security. 

While the guidelines are not mandatory legislation, they offer useful direction for companies developing or deploying AI agents. In particular, businesses should consider how to limit an agent's permissions, supervise high-risk actions and keep records of its activities. The important question is no longer just whether an AI model produces reliable answers, but whether the business can control what the AI system is allowed to do.

China's latest national policy on developing new quality productive forces adds a broader dimension to AI and data governance. The central government published new policy guidelines 9 Oct. to promote technological innovation and the use of advanced technologies across industries. The policy calls for full implementation of the "AI Plus" initiative, wider adoption of AI in traditional industries and stronger development of intelligent products, including connected vehicles and humanoid robots. 

At the same time, it calls for technology monitoring, risk alerts and emergency response mechanisms to keep AI safe, reliable and controllable. Another important part of the policy concerns data. It seeks to improve the rules on data ownership, data transactions, allocation of benefits and protection of data-related rights. It also promotes a more integrated national data market and calls for more efficient, convenient and secure cross-border data flows.

There have been some interesting judicial developments in mainland China regarding AI disputes, showing how quickly and pragmatically Chinese courts are addressing emerging AI issues. Last month, I discussed the judicial opinions issued by China's Supreme Court on AI. The Tianjin Heping District Court delivered a ruling 9 Oct. applying the Supreme Court's opinions. 

The background to the case is as follows: without permission, the defendant fed the claimant's written work into an AI tool, turned it into an AI comic drama and posted it online. The judge compared the two works sentence by sentence and found them substantially similar. The court held that an AI user who knew, or should have known, of an earlier work is liable for intellectual property infringement if they use AI tools to produce substantially similar content. On that basis, the defendant was ordered to delete all the content, stop distribution and pay damages plus enforcement costs. 

On the enforcement front, personal information protection in apps and mini programs remains a regulatory priority in mainland China. The Cyberspace Administration of China 20 Sept. identified 30 apps and mini programs with personal information compliance problems. These included failing to publish privacy rules, requesting unnecessary permissions, providing incomplete information about data collection and use and failing to offer effective account deletion options. Operators were given 15 working days to address the problems. 

In my experience, businesses often pay more attention to privacy compliance for their main websites and mobile apps. Mini programs, marketing tools and smaller digital applications can receive less scrutiny. Yet these products may collect significant amounts of personal information and rely on third-party service providers. A simpler application does not necessarily mean lower privacy risks. Businesses need to check how their products actually work, not just what their privacy policies say.

Hong Kong is also moving ahead with AI governance, with growing attention to AI agents and legal accountability. The Chief Executive's 2026 Policy Address, announced 16 Sept., sets out seven areas of AI risk governance. These include combating AI-enabled crime, protecting minors, promoting safe AI applications, examining liability for AI-related accidents and developing safety guidelines for AI agents. 

The government plans to publish AI Agent safety-management guidelines for wider use in 2027. It will also review whether existing laws adequately address damage caused by AI products and consider possible legislative or regulatory measures. In addition, Hong Kong plans to work with industry bodies on sector-specific AI guidelines, accreditation and governance frameworks. Financial regulators are also promoting responsible AI adoption and stronger risk management. 

These plans are still being developed, but they raise questions businesses should already be considering. Who is responsible if an AI agent makes an unauthorized transaction, discloses confidential information or causes financial loss? Can the business demonstrate that it has taken reasonable steps to prevent such incidents? 

Mainland China and Hong Kong may be taking somewhat different regulatory approaches, but their direction is increasingly clear. In my view, the next challenge for AI and data compliance is not writing another lengthy policy. It is making sure that businesses can use AI and data effectively, manage the risks and demonstrate that their safeguards work in practice.