Trusted AI

From customer lifecycle management including KYC/SOW agents and fraud detection to credit scoring and financial and regulatory reporting, AI is already delivering tangible value for Hong Kong banks with quantifiable benefits through cost, operational excellency and client / workforce enablement. However, as more core processes are augmented using AI, it is imperative that banks adequately address concerns around governance, risk, and trust. Building trusted AI systems is now essential for maintaining public confidence and ensuring the long-term sustainability of Hong Kong’s banking system.

Globally, regulators are paying closer attention to critical risks such as data privacy, intellectual property, model explainability, and algorithmic bias. In Hong Kong, the HKMA has made AI governance a strategic supervisory priority, emphasizing ethical deployment and the protection of customer data.

As AI use cases multiply across front, middle and back offices, banks should have a clear strategic vision and a well-defined risk appetite specific to AI. This starts with fundamental questions: What are we using AI for? Where do we see the greatest value? And what risks are we prepared to accept? Banks should also have a governance framework that aligns with local and global regulatory expectations. Key components of the framework should include:

Integrating AI within the organisation’s strategic plan and clearly defining tolerance for AI-related risks.

Establishing cross-functional committees, including representation from legal, risk, compliance and technology, with direct reporting to the board.

Creating enterprise-wide policies to guide development, testing, deployment and monitoring of AI solutions.

Implementing robust review and challenge processes to assess model performance, bias, and explainability prior to deployment.

Evaluating AI risks across the extended value chain, particularly technologies provided by vendors and partners.

The maturity of a bank’s digital infrastructure will dictate how deeply and quickly it can embed AI into its risk and control frameworks. Institutions further along in their digital journeys may be better positioned, while others may need to address foundational gaps first before scaling their AI initiatives. Either way, the HKMA expects banks to demonstrate that their AI use aligns with their stated risk appetite and internal control frameworks.

With the risk landscape evolving, the board’s role in AI oversight is more important than ever. AI-related risks, such as model bias, lack of transparency, and dependencies on third parties, require active and informed oversight. The HKMA’s 2024 circular on GenAI use calls for boards to establish dedicated committees to oversee GenAI and ensure accountability for algorithmic decisions.

Leading institutions are responding by forming cross-functional committees that bring together expertise from legal, compliance, technology, data, cybersecurity, and core business functions. These groups should report directly to the board, reinforcing the expectation that senior management remains ultimately accountable—even when third parties are involved. We recommend the following key areas of focus for boards:

1. Is AI a regular item on the board agenda?
2. Has an AI governance committee been established?
3. Are policies aligned with local and global regulatory expectations?
4. Are third-party AI tools adequately assessed for risk?
5. Are AI models independently validated?
6. Is there transparency around the bank’s AI use cases and data sources?

Even the strongest governance frameworks will fall short without the right talent and organisational culture, so banks must invest in AI literacy across all levels of the organisation. The HKMA has been active in issuing circulars and guidance urging banks to reskill and upskill employees, enabling them to transition from manual roles to oversight and supervisory functions in an AI-driven environment.

While banks are already making these investments, they must ensure that training extends beyond operational teams. Board members and senior executives need to understand AI’s risks and benefits to provide effective oversight and strategic direction. A workforce that understands and embraces AI will not only contribute to operational efficiency but also to robust risk management and innovation.