The HKMA’s ART Framework for Responsible AI

This analysis explains published guidance. It is not legal advice, and the HKMA’s text is the authority. “Principle” numbers refer to the nine principles in Annex A; “FN” is a footnote in Annex A; section numbers such as “Annex B, s 4.3” refer to the Practical Insights Report. The HKMA calls the banks it supervises “authorized institutions” and shortens that to “AIs”, which is easy to confuse with AI. We write “banks” instead.

Timeline: 2019 principles to the coming discussion paper (Nov 2019 – next)Hide the timeline →

1 Nov 2019High-level Principles on Artificial Intelligence issued. Annex A now replaces them

19 Aug 2024Circular on consumer protection in generative AI: a human in the loop for early customer-facing use

15 Oct 2026Circular B1/15C with the Supervisory Guidance, the Sandbox report and the Concept Note on agentic AI. Banks uplift their controls “in a timely manner”; no deadline is given

NextA discussion paper on supervisory options for agentic AI, which the HKMA says it will issue “shortly”. No date given

In brief

• New guidance for every bank, in force now. Annex A replaces the HKMA’s 2019 High-level Principles on AI. Banks apply it in proportion to their AI use and uplift their controls “in a timely manner”. There is no transition date.
• Nine principles under three pillars. Accountability, Resilience and Trust, three principles each (Annex A).
• An owner for every use case, and a list of what is allowed. Each AI use case has a named owner (Principle 2). Banks keep an inventory of approved use cases, restrict anything outside it and control “shadow A.I.” (Principle 3).
• Human oversight can step back. The HKMA now accepts “human-on-the-loop” or “human-in-command” where the risk allows. This relaxes its 2024 expectation of a human in the loop for early customer-facing generative AI (Principle 2, FN3).
• A kill switch for material use cases. More material or higher-risk use cases need a built-in kill switch “or equivalent” (Principle 4).
• Filters are not enough. Banks “should not rely solely on model instructions or filters” for cyber assurance (Principle 5).
• Agents are next. A preliminary Concept Note (Annex C) sets out four ideas for agentic AI, including an industry-level registry of material agents. It is not yet a supervisory requirement; a discussion paper will follow.
• The HKMA uses the term “agent harness”. It appears in Annex C, three times in Annex B and in the HKMA’s speech of 16 October (see section 8).

1. What the HKMA issued, and for whom

On 15 October 2026 the HKMA sent circular B1/15C, “Responsible Adoption of Artificial Intelligence”, to all authorized institutions: the licensed banks, restricted licence banks and deposit-taking companies that it supervises. The circular carries three annexes:

Banks apply the principles “proportionately” to their AI use and can build on their existing governance and risk management (Annex A, Application). The principles are read together with Annex B and with other supervisory and regulatory requirements. Banks are to uplift their policies, procedures and controls “in a timely manner”. The circular says the update draws on the Sandbox and on the Financial Stability Board’s report on sound practices for responsible AI adoption, issued the same day.

There is no light tier for low-impact use. Proportionality does the work: the rigour of review, approval and control follows each use case’s assessed materiality and risk (Principle 4).

2. What “ART” stands for

Annex A defines the three pillars as the defining characteristics of responsible AI adoption:

• Accountability: clear ownership, governance, decision-making authority and assurance throughout the AI life cycle.
• Resilience: secure, well-controlled AI that “operates safely, fails safely and recovers effectively”.
• Trust: fair, transparent, explainable and privacy-conscious AI that responds to customers and other affected parties.

The circular and Annex A both say “Resilience”. The quote from the HKMA’s Deputy Chief Executive in the press release says “Resiliency”. We follow the circular and the annex.

3. Accountability: principles 1–3

Principle 1: the board and senior management. The board approves an AI strategy that sets out the bank’s approach to AI and its risk appetite. A governance framework assigns roles across the three lines of defence, for approval before deployment and for monitoring after it. Senior management reviews the strategy against the risk landscape and adjusts it, with board approval, when needed.

Principle 2: an owner for each use case, and effective human oversight. The owner defines what the system is authorised to do, oversees its controls and monitoring, and makes sure that issues are escalated and fixed. Oversight can be “human-in-the-loop”, “human-on-the-loop” or “human-in-command”, supported by AI where appropriate, with risk-based triggers for human approval or intervention. Reviewers need the competence, information, time and authority to challenge, override or stop the system. The bank tests that the oversight works, and the board and senior management stay accountable for the outputs.

FN3 changes an earlier position. The HKMA’s circular of 19 August 2024 on consumer protection in generative AI asked banks to keep a human in the loop during the early stage of customer-facing deployment. FN3 now recognises that on-the-loop or in-command oversight “could be more appropriate for some use cases”.

Principle 3: the inventory, and shadow AI. Banks keep an up-to-date inventory of AI use cases approved for deployment and restrict the use of solutions that are not in it. The inventory gives “full visibility” of AI that is built in-house, bought from third parties or embedded in other products. Banks define what counts as “A.I. use”, standardise the attributes and assign who keeps the records current. The inventory generally covers purpose, owner, provider and model, risk classification, life cycle and approval status, dependencies, and key controls on risk, access and monitoring. Staff are told the rules, for example no unapproved tools and no approved tools used for unapproved purposes, and banks put controls on “shadow A.I.”. For third-party tools, FN4 adds compliance with contract and licence terms and controls against circumvention.

4. Resilience: principles 4–6

Principle 4: manage each use case in line with its materiality and risk. A board-approved framework assesses each proposed use case. The assessment sets how much review and approval it needs before deployment; material or higher-risk use cases get stricter treatment, including senior management sign-off, and control and audit functions show effective challenge. FN5 lists what the assessment weighs: the purpose (data used, outcomes or actions produced), the impact of failure (harm to customers, consequences of heavy reliance) and the maturity of the use case (technical complexity, track record of the models, how new it is to the bank). The approach then runs through the whole life cycle:

Assessments are revisited as the risk landscape changes.

Principle 5: risk management that caters for AI. Three areas get particular attention:

• Data governance. A framework that sets which data may be used, for what purpose and with which controls. Full compliance with the Personal Data (Privacy) Ordinance. Contract terms that stop AI providers re-using customer personal data or other confidential information for model training or improvement unless the bank authorises it. Masking or pseudonymous identifiers where possible.
• Third-party risk. The bank stays responsible for all AI-generated outcomes. Due diligence before selection, formal contract safeguards (FN8: audit rights, data protection, notice of material changes and incidents, response and recovery), monitoring and performance reviews. Concentration, continuity, substitutability and exit risks, especially where material use cases “depend on a small group of dominant players”.
• Cyber risk. Layered security and access controls against data poisoning, prompt injection and safeguard bypass, kept current with new tactics and with frontier AI. Banks “should not rely solely on model instructions or filters”.

Principle 6: resources and expertise. Senior management commits enough resources to deliver the AI strategy and plans capacity ahead. Communication and exposure to AI across the bank grow with its use of AI, and specialist skills are kept current through role-specific training.

5. Trust: principles 7–9

Principle 7: accountability for outputs, including actions. Safeguards fitted to how outputs will be used. Vigilance against inaccurate or fabricated outputs (“hallucinations”). Where an output can have material impact, for example on a customer, stronger review and controls, such as anchoring it in reliable reference sources, or human validation, or both. Each bank defines when an output must be withheld, sent for review or stopped from triggering an action.

Principle 8: explainability and transparency. Banks understand and document how far each use case can be explained, and its limits, in proportion to its materiality and risk. They give internal and external stakeholders information that fits their needs: purpose, functions, limitations and the basis for material outcomes. Where a use case’s objectives can still be met, banks should prefer the more explainable arrangement.

Principle 9: ethics and fair treatment of customers. No discrimination or unintended bias against any group of consumers. Where outputs have real consequences for customers, regular monitoring and benchmarking, for example by sample review. Affected parties can ask for clarification, review or re-assessment, and human reviewers are empowered to correct outcomes. Banks tell consumers that a service uses AI, and its relevant risks, before they provide it. Existing consumer protection expectations, including disclosure and opt-out where applicable, still apply.

6. What the Sandbox report shows

The second cohort of the GenA.I. Sandbox ran 27 use cases with 20 banks and 14 technology partners (Annex B, s 1). Each practice in the report is tagged to the ART pillar or pillars it shows. Sections 2 and 3 cover data preparation, model selection, prompting, retrieval and validation. For a risk reader, the parts below matter most.

• Agents and intent (s 3.4). The report compares single-agent and multi-agent designs. Multi-agent designs gain modularity, control and traceability, and pay for it in coordination effort, delay between agents and the risk that agents hold different views of the state. An orchestrator agent routes each request by its intent: simple enquiries take a short path, compliance-sensitive ones get more validation. A case study compares a strict, rule-based design (“strong control”) with a flexible, guardrail-based one (“light constraint”). The strict design is the stable baseline for critical transactions; the flexible one serves conversation better but costs more to diagnose and maintain.
• Governance of agents (s 3.4.4). Agents act in a decision-support role, with mandatory human review before anything is finalised. System prompts set abstention conditions: when a request is ambiguous, out of scope or unsupported by the sources, the agent asks, gives a controlled response or escalates. The three lines of defence each have a part in setting agent boundaries. A checker agent from a different model family caught mismatches that a same-family checker missed; in one bank, an external guardrail layer raised misinformation detection in red-team exercises from 81.6% to 92.1%. To stop reviewers approving without reading, the report recommends evidence-based review: the reviewer sees the evidence behind each step.
• More AI checkers are not always safer (s 4.3). One bank tested review pipelines with two to six AI “judge” models in sequence. More than two did not consistently improve results, because similar models share blind spots. Two independent review chains did help: if each wrongly approves 10% of bad cases, and their errors are independent, about 1% of bad cases pass both. The report adds that independence must be tested, not assumed.
• Adaptive guardrails (s 4.4). Controls step up with risk: standard guardrails for routine queries, pre-approved content only for higher-risk ones, and escalation to a human with automatic protective action, such as freezing an account, for critical cases.
• Deepfakes (s 4.5). Layered defences: liveness detection, document and selfie cross-checks, server-side validation (client-side checks can be bypassed on a compromised device) and image clustering to find fraud patterns.

The report also states results from the trials (s 5). These are the HKMA’s and the participating banks’ figures, not ours. They include a fall in the false acceptance rate in fraud testing from 10% to below 1% over more than 10,000 attack samples; about 60% less manual risk-review work; AML risk review time down 66%, from about 60 to 20 minutes per case; and over 99% factual accuracy, relevance and completeness for a wealth-management chatbot.

7. AI agents: the Concept Note

Annex C describes agentic AI as systems that plan and carry out multi-step tasks with some autonomy, use tools and data, and can work as several connected agents. It sets out four “key governance concepts”, as preliminary considerations for industry discussion:

1. Intent-anchored accountability. An agent’s actions come from how it interprets an instruction or business objective. The business intent defines the agent’s authorised scope of autonomy and who is accountable for it. The business function that owns the intent would generally be accountable for the agent’s outcomes; the technology function supports, but may not be the owner.
2. Visibility over material AI agents. An inventory of material agents (those with material business functions, high autonomy, or access to sensitive data and important systems) as a basis for continuous monitoring, with clear lineage of the models, data, tools, infrastructure and third parties they depend on. The HKMA is also exploring an industry-level registry of material agents deployed by banks, to clarify accountability, show common dependencies and support intelligence sharing.
3. Human oversight and intervention. The approach “is moving from ‘human in the loop’ to ‘human on the loop’”. Banks actively monitor what agents do, decide when human approval is needed, and can respond fast when an agent departs from its intent: suspend its access to tools or systems, or use an emergency stop. Intervention points may need to sit before actions with material customer implications.
4. Operating boundaries and safeguards. Agents work within defined boundaries: the tools, systems and data they may access or invoke. These boundaries “may be supported by ‘risk-integrated agent harness’”, which turns business intent, risk appetite and internal controls into operating constraints. Safeguards stop agents from accessing, sending or misusing customer and bank data without authorisation.

The HKMA will watch agentic AI through the GenA.I. Sandbox++, whose first cohort it announced on 27 August 2026, and will “soon” issue a discussion paper with options for possible supervisory requirements. Its press release names three topics for that paper: intent-anchored accountability, a registry of material agents, and effective intervention mechanisms. The HKMA’s Executive Director (Banking Supervision) said on 16 October that more than 60% of second-cohort use cases involved AI agents, and half of those were multi-agent.

8. The “agent harness”

None of the four documents defines the term, but the HKMA uses it in five places across its 15 and 16 October material:

• Annex C, concept (d): boundaries that “may be supported by ‘risk-integrated agent harness’”.
• Annex B, s 4.3: when banks develop “more comprehensive agent harness”, their own risk policies and procedures can be built in to make guardrails more dynamic.
• Annex B, s 4.4: adaptive guardrails “implemented in the more advanced form of agent harness”.
• Annex B, s 6: the GenA.I. Sandbox++ “will also further explore agent harnesses and related orchestration arrangements”.
• The Executive Director’s speech of 16 October: trust starts with “securing the boundaries around an agent – often referred to as the agent harness”, which in financial services should put the bank’s wider risk management framework into practice.

In our view this is the most useful idea in the package for a bank that is starting with agents. An agent is a model plus its harness: the software that gives the model tools, runs its actions, keeps the record of what it did and decides when it stops. The same model can behave very differently in two harnesses, so the harness is where the HKMA’s boundaries, intervention points and auditable records actually live. Annex B’s case study of a strict and a flexible design is a comparison of two harnesses.

A bank can test whether its harness carries its risk framework with six questions. Can it list every agent and the components each depends on? Are the tools and add-ons the agent can call approved and fixed by version? Does the agent run in a contained environment with limits on where it can send data? Does each agent have its own identity and short-lived credentials? Are its actions logged where the agent cannot change the log? Can it be stopped at once, with its access revoked? For a harness the bank runs itself, the bank produces this evidence. For an agent inside a vendor’s product, the bank has to get it from the vendor, which Principle 5 already expects through contract terms and audit rights.

9. Where the text is open to more than one reading

None of these changes what a bank should do in principle. Each is a place where a bank should write down its own reading, so that its staff, its auditors and its supervisor work from the same one.

1. No deadline. Annex A asks banks to uplift their controls “in a timely manner” and gives no date. A bank should set its own plan and be ready to explain it.
2. “Material” and “higher-risk” are not defined. Independent validation, senior management sign-off, the kill switch and outcome-tracing records all switch on at “material and/or of higher risk” or similar wording. Each bank defines its own tiers and maps these phrases to them.
3. “This circular” in FN3. FN3 quotes the 2024 circular, then says banks “may follow the guidance set out in this circular” when choosing oversight for customer-facing AI. Read with Principle 2, it most likely means the new guidance, but the footnote sits in an annex, not a circular.
4. Approved versus all. Principle 3 asks for an inventory of use cases “approved for deployment” but also “full visibility” of all AI use, embedded AI included. In our view the inventory should record AI in use that is still waiting for approval, or the bank cannot show that it restricts it.
5. “Kill switch or equivalent”. “Equivalent” is not described. In our view any equivalent should meet the three results that Principle 4 names: prompt suspension, access revocation and prevention of further actions.
6. The examples are not requirements, but they are read with them. Annex B is “non-exhaustive” and banks are encouraged to consider it, yet Annex A says the principles are read together with it. Expect supervisors to ask why a bank chose not to use a practice in Annex B for a similar use case.
7. The registry. Annex C says the HKMA is exploring an industry-level registry; the speech calls it a centralised supervisory registry. Whether registration would be compulsory, and what it would record, waits for the discussion paper.
8. “Agent harness” has no definition (section 8). A bank that uses the term in its own policies should define it.
9. A probable typo. Principle 5 on third-party risk says the bank stays responsible for “the overview robustness of the arrangement”. “Overall robustness” is the likely meaning.
10. “Resilience” or “Resiliency”. The press release quote uses “Resiliency”; the circular and Annex A say “Resilience”. Nothing turns on it, but use the annex’s word in policies.

10. What to do first

Sources

All accessed 21 October 2026. The circular and annexes are on the HKMA’s Banking Regulatory Document Repository.

• Hong Kong Monetary Authority, circular B1/15C, Responsible Adoption of Artificial Intelligence, 15 October 2026.
• Hong Kong Monetary Authority, Annex A, Supervisory Guidance for Responsible Adoption of Artificial Intelligence, 15 October 2026.
• Hong Kong Monetary Authority, Annex B, Practical Insights from the Second Cohort of the GenA.I. Sandbox, 15 October 2026.
• Hong Kong Monetary Authority, Annex C, Concept Note on Governance of Agentic Artificial Intelligence, 15 October 2026.
• Hong Kong Monetary Authority, press release, “HKMA announces ‘ART’ Framework to promote responsible A.I. adoption”, 15 October 2026.
• Carmen Chu, Executive Director (Banking Supervision), HKMA, opening remarks at the Finance + A.I. Forum, 16 October 2026.