The same obligations as a global bank. None of the infrastructure.

A Hong Kong asset manager with thirty-eight staff carries the same statutory obligations as a global bank. It must obtain consent before marketing to an individual, must not repurpose personal data collected for another reason, must evidence that its clients are qualified for the products it discusses with them, and must demonstrate all of this to a regulator on request. It has a compliance consultant two days a month and no security function.

The governance literature assumes infrastructure these firms do not have: model-risk committees, runtime monitoring, red teams, validation pipelines. Where AI governance for smaller firms has been addressed at all, it has been addressed in principle rather than by measuring what actually happens.

That gap is the entire reason this firm exists.

Consent before direct marketing: Personal Data (Privacy) Ordinance (Cap. 486), Part 6A, s. 35E. No repurposing of personal data: PDPO, Schedule 1, Data Protection Principle 3. Client suitability: SFC Code of Conduct, paras 5.1 and 5.2. Producing records on request: Securities and Futures Ordinance (Cap. 571), s. 180. Hong Kong e-Legislation and SFC, accessed September 2026.

Small and mid-sized firms in Hong Kong that are already using AI, and are starting to be asked about it. SFC-licensed asset managers, professional services firms, Hong Kong operations of international groups, and AI-enabled startups facing investor or customer due diligence.

Use your law firm when you need a legal opinion you can rely on, privilege over a sensitive finding, contract terms negotiated with an AI vendor, or representation if a regulator opens a file. Those are their strengths and we do not compete with them.

Use us when the problem is operational rather than legal. Your law firm will tell you what the PDPO requires. It will not sit with your operations team to build the tool register, run the workshop that gets your staff to follow the policy, test what your agent does when a client asks it something unexpected, or tell you which of your controls fail under pressure.

There is also a cost structure difference. Legal advice is billed hourly against open scope. Our engagements are fixed-fee and fixed-duration, so you know the number before you start.

In practice these are complements. Several of our engagements end with a recommendation to take a specific question to counsel — and we tell you when that point has been reached.

Because the obligations already bind you. Hong Kong has no dedicated AI statute, but the PDPO applies in full to any AI system touching personal data, the Data Protection Principles were not suspended pending an AI law, and the PCPD has already published its expectations. If you are SFC-licensed, your existing technology risk and oversight obligations already cover AI use. None of this is waiting on new legislation.

Second, the commercial pressure is arriving faster than the legal pressure. Client due-diligence questionnaires and vendor onboarding forms now ask how you govern AI. Those questions are being asked today, and “we're waiting for the law” is not an answer that wins mandates.

Third, retrofitting costs more than building. Governance introduced after an incident is done under time pressure, under scrutiny, and usually under someone else's terms. Everything a future AI law will require — knowing what tools you use, what data goes into them, who is accountable for outputs — is work you will have to do regardless. Doing it now is simply doing it cheaply.