Hong Kong did not publish a single AI Act. The HKMA issued a sequence of circulars and high-level principles that accumulate: consumer protection, AI principles, generative AI in banking, and further risk expectations as use cases matured.
Layers, not a monolith
Read chronologically, the set can feel fragmented. Read as layers, it is coherent:
| Layer | What it demands |
|---|---|
| Principles | Accountability, explainability, fairness posture |
| Consumer outcomes | Protection when analytics and AI touch customers |
| Generative AI | Specific controls for foundation-model use in banks |
| Ongoing risk | Monitoring, incidents, and model-risk adjacency |
A bank that treats each circular as a separate project pays nine times. A bank that encodes a shared control taxonomy pays once, then differentials.
Why packs fit Hong Kong
Jurisdiction Packs exist for this pattern. New circulars become pack releases. Policy flows down as signed bundles. Telemetry flows up as redacted metadata. Prompts and responses stay in the client environment.
Hong Kong and Singapore are In build on our roadmap because the instrument density already supports encoding. The nine-circular reading is the product thesis in miniature: incremental supervision, compoundable controls.
Practical next step
Map every AI system that touches customers to the circular layer that binds it. If the map lives only in a deck, you do not yet have an operating model. Observe mode is how the map becomes evidence a supervisor can use.