Over 90% of Hong Kong organisations use AI tools despite training and policy gaps, survey finds

Hong Kong has hit a striking milestone in artificial intelligence adoption: more than 90 percent of companies, schools, and non-governmental organisations now use AI tools in their daily operations. A survey of 800 organisations found that 94 percent had deployed some form of AI. Yet beneath this headline figure lies a governance vacuum that is exposing the city’s institutions to serious compliance and security risks. The survey, conducted by the Hong Kong Internet Registration Corporation, reveals a troubling disconnect between usage and oversight. Nearly two-thirds of organisations—63 percent—have not established any internal AI usage policy for employees. Even more striking, 68 percent have not conducted any AI training. Employees at almost half of the surveyed organisations have used unauthorised AI tools, a practice that can expose sensitive data to unknown third-party servers. The risks are not theoretical. An earlier survey by the Hong Kong Computer Emergency Response Team Coordination Centre found that roughly 35 percent of businesses using AI admitted to feeding company information into AI tools. This includes proprietary data, customer records, and strategic documents. Once entered into public or semi-public AI models, that information can be used for training, effectively leaking it beyond the organisation’s control. At a joint press conference on cybersecurity, officials from the Digital Policy Office, the Hong Kong Police Force’s Cyber Security and Technology Crime Bureau, and the HKCERT gathered to sound the alarm. The campaign they announced will assist organisations in plugging governance gaps through training, AI strategy and policy formulation tools, and advisory services. The message was clear: adoption without guardrails is a liability. What the casual observer might miss is the legal dimension. Hong Kong’s Personal Data (Privacy) Ordinance imposes strict requirements on data handling, and feeding personal data into an unvetted AI tool could constitute a breach. For schools handling student records or NGOs managing beneficiary information, the exposure is acute. The regulatory framework has not kept pace with the technology, leaving organisations to navigate a grey zone. The survey also highlights a cultural challenge. Hong Kong’s workforce is known for its efficiency and eagerness to adopt new tools, but that same drive can bypass formal approval processes. Employees use AI to draft emails, summarise documents, and generate code—often without their IT departments knowing. This bottom-up adoption creates blind spots that traditional cybersecurity measures cannot address. The joint initiative aims to shift the conversation from adoption to accountability. Training programmes will focus on risk awareness, while policy templates will help organisations draft usage guidelines tailored to their sectors. The advisory services will offer audits of current AI deployments, identifying where sensitive data may be at risk. Hong Kong’s AI penetration rate is among the highest globally, but that lead will mean little if the governance gap widens. The next phase will test whether the city’s institutions can match their enthusiasm for the technology with the discipline to use it safely.

More than 90 per cent of Hong Kong companies, schools, and NGOs have incorporated artificial intelligence (AI) into their workflows, according to a survey.

Hong Kong’s near-universal AI adoption, with weak training and policy frameworks, creates urgent compliance and security risks for the sector.

The development adds to a wider Hong Kong ai & machine learning story in which companies are being judged on execution, capital access, regulatory fit and the credibility of their regional expansion plans.

For business readers, the important question is whether this becomes an isolated announcement or part of a more durable operating pattern across customers, financing channels, partners and public-market expectations.