HKMA Advances SAGE Governance; Privacy Commissioner Sets Out Six Requirements for Third-Party Vendors — Daily AI and Cyber Risk Summary

In a nutshell: During Hong Kong FinTech Week, regulators rolled out measures on AI governance and third-party vendor risk in succession; meanwhile, HKCERT has upgraded a WordPress vulnerability to "high risk", and Apple has also flagged AI agent loss-of-control risk in its annual report for the first time.

Hong Kong FinTech Week Focuses on AI Governance and Cyber Resilience. At the Hong Kong FinTech Week x StartmeupHK 2026 main forum held on 4 November, HKMA Chief Executive Eddie Yue said the Authority would continue to promote responsible innovation and enhance cyber defence capabilities; the HKMA has launched the SAGE project (Securing Agentic Finance with Governance and Enablement) and, together with the Hong Kong University of Science and Technology, released a post-quantum cryptography (PQC) toolkit. SFC Chief Executive Julia Leung noted that, faced with intensifying AI-related threats, the industry must enhance cyber resilience. HKIA Executive Director Eric Kwong also outlined his "AI Facilitation Initiative", encouraging insurers to establish AI centres of excellence in Hong Kong. (Sources: Tencent News, Sina Finance, China News Service, 2026-11-04)

Privacy Commissioner Warns of "Precision Scams" and Sets Out Six Requirements for Third-Party Vendors. In a statement on 2 November, the Office of the Privacy Commissioner for Personal Data said that, as of 30 October, it had received 51 complaints and 48 enquiries over a string of institutional breaches, with individual losses of about HK$10,000 to over HK$1.5 million, involving Hong Kong Airlines, Cathay Pacific, Malaysia Airlines, YOHO, Broadway, and others; the PCPD also set out six requirements for institutions managing third-party service providers, including prudent vendor selection, data minimisation, contractual security obligations, least-privilege access, an immediate notification mechanism, and ongoing monitoring and assessment. (Sources: Office of the Privacy Commissioner for Personal Data, 2026-11-02; Hong Kong & Macau Daily, 2026-11-04)

HKCERT Raises WordPress Vulnerability to "High Risk". In an updated advisory on 4 November, HKCERT upgraded CVE-2026-119977 (an unauthenticated remote code execution in the WordPress core update window, already exploited in the wild) to "high risk"; affected versions span the 4.7 to 7.1 branches, with 7.1.4 as the fixed release, and HKCERT urges organisations to check staging directories after upgrading. (Source: HKCERT, 2026-11-04)

Apple's Annual Report Flags AI Agent Risk for the First Time. In its fiscal 2026 10-K annual report filed with the US SEC on 3 November, Apple warned that AI agents may operate in "unexpected or unpredictable ways", including acting beyond authorised scope, circumventing safety measures, executing or modifying code, sending messages, and completing transactions — some consequences (such as data deletion) being difficult or even impossible to reverse. (Sources: China Daily Online, 2026-11-03; NetEase, 2026-11-05)

Mainland China's AI Liability Insurance Accelerates Its Rollout. According to Sina Finance, PICC Property and Casualty launched the nation's first "comprehensive AI application risk protection scheme", comprising external "AI service liability insurance" and internal "AI application expense-loss insurance", assessed under an underwriting framework built on the three elements of "scenario, content, and data"; first policies have been written in Tianjin, Shenzhen, Hainan, and Beijing. (Source: Sina Finance, 2026-11-04) This development echoes Hong Kong enterprises' need to assess AI risk-transfer options.

The content of this column is provided for general information and educational purposes only, and does not constitute insurance, legal, or professional advice. Actual coverage is subject to the terms of individual policies.