Cyber Security and Artificial Intelligence Insurance
In one sentence: cyber security and artificial intelligence (AI) risk has evolved from "an IT department problem" into a compliance obligation, operational risk and financial risk for Hong Kong businesses. This section compiles Hong Kong-related news, the coverage structures that actually exist in the market, and explains how they work through a standalone Education Hub.
This section last updated: 1 October 2026 | Data collection date: 1 October 2026
Why This Section Exists
Our Area of Expertise
Among the corporate risk cases handled daily by Henderson Insurance Consultants Limited, enquiries relating to cyber security and artificial intelligence are the fastest-growing category: from notification duties after a data breach, operational disruption caused by ransomware, to "if the company uses AI to generate content and it goes wrong, who is liable".
These questions share a common trait — they straddle the three domains of insurance, legal compliance and information technology. Most market information addresses only one: IT vendors talk about defence, lawyers talk about liability, insurance practitioners talk about policies. Business owners usually receive three disconnected answers.
This section is the public version of that area of expertise: it organises the questions that recur in daily work, the coverage structures that actually exist in the Hong Kong market, and the relevant regulatory requirements into pages that can be consulted and verified.
Where Are the Boundaries
The topic selection and data compilation for this section are provided by Henderson Insurance Consultants Limited (the sponsoring organisation of this site) based on the cyber security and AI risk cases it handles daily; the writing, verification and updating of content remain independent, following this site's established editorial principles. Therefore:
- This section does not sell insurance products, provide quotations, or arrange cover, nor does it recommend any individual insurer or product.
- The coverage items and product structures on the page are a compilation of general market practice, and individual policy wording differences may be substantial.
- Whether an individual business is covered, and how much will be paid, is always determined by the insurer's underwriting and claims decision for that specific case.
For further enquiries about policies, coverage arrangements or incident response, please contact the sponsoring organisation via the WhatsApp number in the footer.
Compliance duty becomes a statutory duty
The Protection of Critical Infrastructures (Computer Systems) Ordinance came into effect on 1 January 2026, imposing three categories of statutory duty — governance structure, prevention and incident notification — on designated critical infrastructure operators, with fines for non-compliance. Cyber security has shifted from "should do" to "must do".
AI exclusion clauses are widening the coverage gap
In recent years several international insurers have applied to regulators to add "artificial intelligence exclusion clauses" to commercial policies, excluding legal liability arising from an enterprise's use or integration of AI. Businesses that assume their existing policy already covers this may in fact face a gap.
The supply chain is the most vulnerable link
Even if a business's own defences are sound, a single partner — cloud service provider, outsourced IT vendor, CRM supplier — can trigger a chain incident and bring the notification duty and claim risk back to the business itself.
Gap between risk awareness and defence capability
Surveys show Hong Kong SMEs lag large enterprises noticeably in adoption of email security, privileged access management and remote security; at the same time, one third of enterprises using AI have fed company data into public AI tools.
Cyber Security and AI Insurance News
Hong Kong regulatory announcements, incident statistics and product developments, organised chronologically, each with announcement date, key points and official source, and an explanation of its practical meaning for businesses.
View news and developments →Products and CoverageCoverage Structure and Market Products
First-party and third-party cyber coverage, common exclusions, the Hong Kong market carrier ecosystem, and the three forms of AI-related policies.
View products and coverage →Insurer ComparisonOverview of Hong Kong Cyber Insurers
Focused on enterprise solutions, comparing Chubb, AIG, Zurich, Beazley, Coalition, OneInfinity and others available to Hong Kong businesses, with their product positioning.
View insurer comparison →Education HubIn-depth Teaching Across Eight Modules
From fundamental concepts, the Hong Kong risk map and regulatory duties, to AI coverage gaps, a corporate self-assessment checklist, claims process and glossary — suitable for readers encountering the topic for the first time.
Go to the Education Hub →Coverage StructureProducts and Coverage Structure
First-party and third-party cyber coverage, sub-limits and common exclusions, to help you identify coverage gaps.
View coverage structure →How does cyber insurance differ from general insurance?
Property and liability insurance is written for the "physical world" — inventory, premises, bodily injury. Cyber insurance deals with losses that occur entirely in networks and data: data breaches, system outages, payment fraud. The two do not replace each other.
First-party and third-party coverage
First-party covers the business's own losses (response costs, business interruption, data restoration); third-party covers the business's liability to others (client claims, regulatory investigation, legal defence). Both must be examined together; buying only half is a common gap.
The trigger is the "incident", not the "claim"
Most cyber policies are triggered by a "cyber incident"; once confirmed, response services (forensics, legal, PR) are activated without waiting for a third-party claim. This is the biggest operational difference from traditional liability insurance.
AI-related losses currently have three treatments
One: excluded by an exclusion clause. Two: AI-induced cyber risk included within the cyber policy. Three: a separate standalone AI liability insurance or embedded micro-insurance. Three policies for one enterprise can take three different stances on AI.
Exclusions deserve more reading than coverage items
War and state action, circumstances known before cover, failure to maintain the security level required by the policy, and sub-limits for business email compromise — these clauses determine whether the policy actually pays when an incident occurs.
The sum insured is not the actual compensation cap
Cyber policies widely use sub-limits and layered structures: under the same overall limit, ransomware, business interruption and regulatory fines each have independent caps. When comparing policies, look at sub-limits, not just the total.
| Regulation / Guideline | Status | Meaning for businesses |
|---|---|---|
| Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) | Gazetted on 28 March 2025, in effect from 1 January 2026 | Imposes three categories of statutory duty — governance structure, prevention, and incident notification and response — on designated critical infrastructure operators. Covers sectors such as energy, information technology, banking and financial services, transport, healthcare, and communications and broadcasting. |
| Personal Data (Privacy) Ordinance (Cap. 486) | Current | Data users must take practicable steps to safeguard personal data; upon a data breach, notify in accordance with the requirements of the Office of the Privacy Commissioner, which may trigger investigation and an enforcement notice. |
| Office of the Privacy Commissioner "Artificial Intelligence (AI): A Model Framework for Personal Data Protection" | Published June 2024 (non-binding) | Provides governance recommendations on procuring, implementing and using AI, covering four directions: establishing an AI strategy and governance, risk assessment and human oversight, continuous management of AI systems, and communication with stakeholders. |
| Office of the Privacy Commissioner "Agentic AI: Safeguarding Personal Data Privacy" | Published 2026 | Provides practical recommendations on agentic AI (AI systems that can execute tasks autonomously), covering access control, human intervention and audit trails. |
| Insurance Authority "Cyber Security Guideline" (GL20) | Revised version in effect from 1 January 2025 | Introduces the Cyber Resilience Assessment Framework (CRAF), comprising inherent risk assessment, maturity assessment and threat-intelligence-based attack simulation. Applies to authorised insurers and also indirectly affects their IT supply chain and intermediaries' operational requirements. |
| Insurance Authority GL8 Guideline revision | Consultation launched in Q4 2025, planned for completion in 2026 | Per the Insurance Authority's public explanation, the revision will add director and management accountability, a "human-in-the-loop" mechanism, operational resilience, and AI decision disclosure requirements. |
| Generative AI Sandbox++ (GenA.I. Sandbox++) | Launched March 2026, first cohort of use cases announced in August | Launched by the HKMA, SFC, Insurance Authority and MPFA together with Cyberport, covering the insurance sector. Its testing scope and conclusions will become a reference for future industry compliance expectations. |
The table lists only the items most directly relevant to Hong Kong businesses. The full requirements, scope of effect and latest revisions of each regulation are always governed by their official original text.
Purpose of this section: If you are encountering this topic for the first time, we recommend reading the Education Hub first, starting from "What is cyber insurance"; if you already hold a policy, go directly to the "Common Exclusions" and "Sub-limits" sections of Products and Coverage, and give the self-assessment checklist to the colleague responsible for IT or compliance.