Why This Article Exists

AI is transforming how businesses operate. But most Hong Kong companies are using AI tools like ChatGPT, Copilot, and Gemini without any formal rules. No policy. No guardrails. No awareness of the risk.

As a company secretary, you to uphold a duty to protect your Hong Kong company from avoidable risk. An AI Use Policy is now essential, not optional.

A Realistic Case Example

Consider a Hong Kong e‑commerce team using ChatGPT to draft customer service replies. The AI produced friendly responses quickly — but occasionally added details that weren’t in company policy, such as extended return periods or free shipping promises.

Customers began quoting these AI‑generated replies back to the company. The founder had to honor some of these unintended commitments, costing time, money, and goodwill.

This isn’t science fiction — it’s a common pattern we see across Hong Kong SMEs. Teams adopt AI informally, without rules, and only discover the risks when customers, regulators, or investors push back.

What is an AI Use Policy (And Why Do Hong Kong Companies Need One?)

An AI Use Policy is a simple document that sets the rules for how your team uses AI tools at work.

It answers three questions:

1. What AI tools are allowed?
2. What can they be used for?
3. Who is responsible when something goes wrong?

Founder Translation: “Think of it as a seatbelt for AI. You don’t wait for a crash to put one on.”

Why Now?

The numbers are staggering.

According to a June 2026 survey of 800 organisations by the Hong Kong Internet Registration Corporation Limited (HKIRC):

• 94% of Hong Kong organisations now use AI tools in their workflows.
• 63% have NOT established an internal AI usage policy for employees.
• 68% have NOT conducted any AI training.
• 35% of businesses using AI admitted to feeding company information into AI tools.

This creates a massive governance gap. The tools are everywhere — but the rules are not.

Founder Translation: “94% of Hong Kong companies are using AI. But 63% have no rules. That means most teams are flying blind.”

This creates real risk:

• AI hallucinations can send false information to customers
• Sensitive data (HKID & Passport numbers, financial records) can be pasted into AI tools
• AI-generated content may contain errors that violate the PDPO

AI Hallucination Examples: Real Cases from Hong Kong and Abroad

Hong Kong Law Firm AI Incident (2024)

A Hong Kong law firm used AI to draft legal documents without verifying the AI-generated content. The documents contained fabricated case citations like fake legal precedents that didn’t exist.

When the error was discovered, the court reprimanded the firm. The lawyer faced disciplinary proceedings from the Law Society of Hong Kong.

Hong Kong Institute of CPAs Warning (2024)

The HKICPA issued formal guidance warning accountants about the risks of using AI tools. The guidance emphasized that AI tools cannot replace professional judgment.

Key message: Accountants must verify all AI-generated data before using it in financial statements, tax filings, or audit reports.

US Lawyer ChatGPT Scandal (Mata v. Avianca, 2023–2024)

A New York lawyer used ChatGPT to prepare a court filing. The AI fabricated multiple legal cases that did not exist. When the judge discovered the fake citations, the lawyer was fined $5,000 and faced disciplinary action.

Australia Accountant AI Error (2024)

An Australian accountant used AI to perform tax calculations. The AI incorrectly interpreted tax legislation, resulting in incorrect tax filings for multiple clients. The tax authority reassessed the clients and imposed penalties.

UK Company Secretary AI Incident (2024)

A UK company secretary used AI to prepare annual return documents. The AI incorrectly calculated shareholder equity figures. The Companies House rejected the filing and flagged the company for potential compliance issues.

Can My Hong Kong Employees Use ChatGPT at Work?

AI Policy Basics: Protecting Data While Boosting Speed

AI is now part of daily operations in Hong Kong companies. The question isn’t whether employees should use tools like ChatGPT — it’s how to use them safely. A clear AI Use Policy sets the guardrails:

• Protect client data — Employees must never paste sensitive information into public AI tools. Confidentiality is non‑negotiable.
• Boost speed with AI — Use AI for drafting, summarizing, and repetitive tasks. It accelerates workflows without replacing professional judgment.
• Human delivers the service — Final review, approval, and communication must remain human‑led. This ensures accuracy, accountability, and trust.

Founder Translation: “AI speeds up the work, but humans own the service. The policy protects client data while letting your team move faster.”

At GetStarted.hk, we help founders implement policies that balance efficiency with compliance — so AI becomes an asset, not a liability.

Is My Hong Kong Company Liable if AI Gives Wrong Information?

Yes. Under Hong Kong law, your company is responsible for all communications sent to customers  regardless of whether they were written by a human or generated by AI.

If AI sends false information, your Hong Kong company bears the consequences:

• Consumer complaints to the Consumer Council
• Potential legal claims for misrepresentation
• Regulatory penalties for inaccurate filings

Founder Translation: “The AI didn’t send that email. Your company did. You’re on the hook.”

AI Policy SOP: Tailoring Permitted Use to Your Business

AI is not one‑size‑fits‑all. Whether your Hong Kong company should use AI for drafting depends on your business nature and risk profile. A clear SOP defines what’s permitted and what’s prohibited.

What’s Permitted (Depending on Business Nature)

• Internal processing — AI can safely handle quick data matching, reconciliations, formatting, and summarizing reports.
• Efficiency tasks — Translation, template generation, or brainstorming are low‑risk uses that save time.
• Drafting support with review — For complex or repetitive communications, AI may prepare drafts — but only if reviewed before sending. For simple client‑facing replies, human drafting may remain the better choice.[MOU1] 

What’s Prohibited

• Sending AI-generated content to clients without human review
• Pasting HKID, Passport numbers, or financial records into public AI tools
• Using AI for final professional judgments (tax advice, legal opinions, audit conclusions)

What Should Be Inside an AI Use Policy? (Hong Kong)

A comprehensive AI Use Policy for Hong Kong companies should include:

Founder Translation: “Four simple pillars. Follow them and you’re 90% protected.”

AI Misuse Penalties in Hong Kong

• What happens if AI causes harm through your Hong Kong company?
• Consumer Council complaints and investigations
• Legal claims for misrepresentation or breach of contract
• PDPO (Personal Data Privacy Ordinance) breaches for data leaks
• Professional disciplinary action against company secretary or directors

Founder Translation: “The penalties aren’t theoretical. They’re happening now in Hong Kong and around the world.”

AI Use Policy Mistakes and Red Flags

A consumer opened the customer complaint email and read: “Your chatbot promised me a lifetime warranty. I have screenshots.” That single email started a crisis and a bill for HK$180,000.

How to Create an AI Use Policy for Your Hong Kong Company (Step-by-Step)

Exceptions and Edge Cases

• Not every Hong Kong company faces the same level of risk:
• Companies with no customer interaction lower risk, but still need a basic AI Use Policy
• Dormant companies: minimal risk, but should have a policy in place
• Companies using only internal AI tools have lower risk than public tools, but still need rules
• Outsourced customer service: you’re still liable for what third parties send on your behalf

Founder Translation: “Even if you think you’re too small or too quiet to need a policy, you’re wrong.”

Frequently Asked Questions

1. Can AI create legal liability for my Hong Kong company?

Yes. Your company is legally responsible for all communications sent to customers, regardless of whether they were written by AI or a human.

2. Is my company responsible for what AI tells customers?

Yes. Under Hong Kong law, the company, not the AI, bears responsibility for customer communications. 

3. Can AI be used for accounting in Hong Kong?

AI can assist with accounting tasks, but all outputs must be verified by a qualified accountant to ensure compliance and accuracy.

4. What should an AI Use Policy include for Hong Kong SMEs?

At minimum, your policy should cover: approved AI tools, human review procedures, data protection measures, methods for verifying accuracy, and incident reporting procedures.

5. How often should we update our AI Use Policy?

At least annually. AI technology evolves quickly, and new risks emerge regularly, requiring ongoing review.

What Should You Do Right Now?

In 2026, nearly every Hong Kong company relies on AI tools. If yours does too, here are the steps you should implement immediately:

• Check if you have an AI Use Policy: If not, create one today
• Review how your team uses AI: Are they pasting sensitive data into ChatGPT?
• Implement the Human Review Rule:  AI drafts, humans send

GetStarted.hk

Your Trusted Partner for Hong Kong Business Services
WhatsApp: (+852) 5541 0778
Phone: (+852) 2813 7600
Email: info@getstarted.hk
Office: Central, Hong Kong

References

• Hong Kong Internet Registration Corporation Limited (HKIRC). Survey on AI Adoption in Hong Kong Organisations (June 2026).
• Hong Kong Institute of CPAs (HKICPA). Practice Note on AI in Accounting (2024)
• Personal Data Privacy Ordinance (PDPO), Cap. 486
• Mata v. Avianca Inc., No. 22-cv-1461 (S.D.N.Y. 2023)
• Companies Ordinance (Cap. 622)

Image Source: Magnific