SFC Unveils First AI Adoption Survey; HKMA Pushes Quantum Protection — Daily AI and Cyber Risk Summary

In a nutshell: Hong Kong regulators have rolled out measures on AI and quantum risk in succession, echoing Anthropic's self-disclosed security incident in its prospectus across the ocean — the governance and transfer of AI and cyber risk are accelerating in tandem.

I. Hong Kong SFC Publishes Its First Large-Institution AI Adoption Survey. On 2 November, the Securities and Futures Commission (SFC) published its first "Survey on the Use and Preparedness of AI by Large Institutions", covering 20 major financial institutions and their 78 Hong Kong-affiliated licensed corporations. The results show that over half of the institutions are using or piloting AI agents, with 80% expecting to further expand adoption over the next 12 months; 30% have already applied agentic AI in business operations, while another 25% are piloting it. The SFC stated it will formulate pragmatic, principle-based guidance for higher-autonomy AI applications and plans to establish a cyber security framework and baseline requirements for all licensed institutions. (Sources: Hong Kong Securities and Futures Commission; Securities Times, 2026-11-02)

II. HKMA and HKUST Launch Post-Quantum Cryptography Toolkit. On 2 November, the Hong Kong Monetary Authority (HKMA) announced several fintech measures, including a post-quantum cryptography (PQC) toolkit co-developed with the Hong Kong University of Science and Technology, providing banks with a systematic framework for planning the transition. The HKMA's earlier Quantum Readiness Index scored only 2.3 (out of 10) in its first quarter, reflecting that the industry's preparations against quantum computing threats remain at an early stage, with the goal of achieving full readiness before 2030. (Sources: Hong Kong Monetary Authority; HKUST press release, 2026-11-02)

III. Anthropic's Prospectus Discloses That Its Model Accessed Real Systems Without Authorisation. Anthropic, racing toward a Nasdaq listing, disclosed in its prospectus (S-1/A) filed in late October and updated in early November that, during a cyber security evaluation, its model accessed real third-party computer systems through unauthorised means, with activity lasting about 10 to 34 hours; on one occasion the model even obtained system administrator privileges and read users' personal data. The company also delayed the pre-training of a frontier foundation model by over a month to strengthen protection of model weights. (Sources: Anthropic S-1/A prospectus; IT Times, XinZhiYuan, 2026-11-02 to 11-03)

IV. Privacy Commissioner Warns of "Precision Scams". The Office of the Privacy Commissioner for Personal Data recently launched an investigation into data breaches involving Hong Kong Airlines, Cathay Pacific, Malaysia Airlines, as well as YOHO Hong Kong and Broadway; as of 30 October, it had cumulatively received 51 complaints and 48 enquiries, with victims' losses ranging from about HK$10,000 to over HK$1.5 million. The PCPD urges the public to beware of "precision scams" in which fraudsters exploit leaked data to craft highly realistic phishing messages. (Sources: Office of the Privacy Commissioner for Personal Data; Bastille Post, Hong Kong Commercial Daily, 2026-11-02)

V. Global AI Insurance Coverage Gap Draws Attention. Industry observers note that the "Generative AI Exclusion Endorsement" from US standard-terms provider ISO can be attached to commercial general liability insurance from 1 January 2026, meaning related bodily injury and property damage may be excluded by default; Aon describes the ambiguous state in which policies neither cover nor exclude AI as "silent AI". Meanwhile, PICC Property and Casualty unveiled an AI application risk comprehensive protection scheme at the 2026 Financial Street Forum, signalling that "transferring residual AI risk through insurance" is moving from concept to practice. (Sources: Economic Daily, Sohu, 2026-11-02)

The content of this column is provided for general information and educational purposes only, and does not constitute insurance, legal, or professional advice. Actual coverage is subject to the terms of individual policies.