Education Hub: Cyber Security and Artificial Intelligence Insurance

In a sentence: this page is neither news nor a product introduction. It is a beginner-to-advanced teaching resource that explains cyber security and artificial intelligence (AI) insurance across eight modules — from fundamental concepts and Hong Kong's risk data, to legal liability, AI coverage gaps, the enterprise self-assessment checklist and the claims process.

Last updated on this page: 1 October 2026 | Data collected on: 1 October 2026

This page is a beginner-to-advanced teaching resource that explains the topic across eight modules.

How to Read This Page

If you are	Suggested reading order
New to this topic	Module 1 → Module 2 → Module 5 → Appendix A Glossary
Business owner or management	Module 2 → Module 3 → Module 6 → Module 7 (Self-Assessment Checklist)
Colleague in charge of IT or compliance	Module 4 → Module 7 → Module 8
Already hold a policy and preparing to renew	Module 1 → Module 5 → Module 7 → and cross-reference the 'Exclusions' and 'Sub-limits' sections of Products and Coverage Structure
Just want a quick overview of Hong Kong	Module 2 → News and Developments

---

Module 1: What Is Cyber Insurance

1.1 A Fundamental Distinction

The way traditional insurance is classified has always been by where the loss occurs — mostly dealing with losses to physical premises or tangible assets.

Cyber insurance is classified differently: the losses it handles all occur in networks and data.

	Traditional Property and Liability Insurance	Cyber Insurance
Loss carrier	Physical property, person	Data, systems, fund flows
Form of loss	Damage, injury, financial liability	Leakage, interruption, fraud, lockout
Trigger	Incident or claim	Cyber incident (no need to wait for a claim)
Ancillary services	Survey, assessment	Digital forensics, legal and PR response

Therefore, cyber insurance cannot be replaced by 'adding an endorsement'. It requires a separate set of underwriting questions, separate exclusions, and a response team that knows how to handle digital incidents.

1.2 Why 'Cyber' and 'AI' Are Now Often Discussed Together

There are three reasons:

1. AI is changing the way attacks are carried out. Generative AI makes phishing messages harder to identify and easier to mass-produce; deepfake voice is used in financial fraud; AI is also used to automate ransomware operations.
2. AI is creating new types of liability. When a business uses AI to generate content, reply to customers or make decisions, the attribution of liability when something goes wrong — the business, the AI vendor, or no one — is still taking shape.
3. AI is creating divergence in coverage. Some insurers add AI exclusion clauses to policies; others include AI-related risk within coverage. Businesses are unclear which type their own policy falls into.

1.3 Three Obligations That Apply Simultaneously

The reason cyber and AI risk is hard to manage is that a single incident can trigger three different lines of obligation at the same time:

A single data breach
├── Legal liability: the data protection principles and notification requirements under the Personal Data (Privacy) Ordinance (PDPO)
├── Regulatory liability: varies by industry — for example, financial institutions are bound by the cyber security requirements of the HKMA, the IA or the SFC
└── Contractual liability: security and indemnity clauses in customer contracts, outsourcing contracts and procurement contracts

Insurance only addresses the financial consequences after the third line. It can pay you, but it cannot notify on your behalf, accept an investigation on your behalf, or comply with regulations on your behalf. This must be made clear upfront, otherwise the misconception 'buying insurance means being compliant' easily arises.

---

Module 2: Hong Kong's Risk Map

To judge whether you need coverage and how much, the first step is to see the actual risk data clearly. The following two sets of figures are the two most worthwhile public statistics to reference in Hong Kong.

2.1 HKCERT: The Shape of Attacks

The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) announced in Hong Kong Cyber Security Outlook 2026:

• In 2025, Hong Kong recorded 15,877 cyber security incidents, up 27% year-on-year, a record high.
• Phishing accounted for 57% of all incidents, the predominant threat source; attack vectors have extended from traditional email to social media and instant messaging platforms (34%) and cryptocurrency platforms (18%).
• Vulnerable-system cases numbered 2,328 (15%), up more than 3.5 times year-on-year.
• Nearly 30% of businesses have no dedicated person for cyber security; only 26% of SMEs have a full-time cyber security staff member (59% for large enterprises).
• 35% of businesses using AI have entered company data into public AI tools.
• The main risks for 2026 are categorised into two types: AI application risk and supply chain risk.

How to read these figures

Data	What it really says
Phishing at 57%	The biggest risk is 'people', not 'machines'. The return on investment in staff training and process design does not fall as technology advances
Vulnerable systems up 3.5x	This is a matter of basic configuration and patch management. Such issues have low technical barriers and low cost, yet are most often overlooked
Only 26% of SMEs have full-time staff	SMEs cannot make up for it with headcount; they must rely on a combination of process, outsourcing and insurance
35% entered company data into public AI	AI governance is a new security gap, and it is an irreversible leak — once sent to a third-party system, it cannot be recovered

2.2 Privacy Commissioner's Office: The Shape of Incidents

The Privacy Commissioner's Office announced in its 2025 work report:

• In 2025, a total of 246 data breach notifications were received, up 21% year-on-year; of these, 79 came from public bodies and 167 from private organisations.
• Among them, 81 involved hacking intrusion (33%), up 33% year-on-year.
• Notifications from schools and non-profit organisations accounted for 92 cases, i.e. 37% of all incidents.
• Over the same period, 435 compliance checks were conducted, up 9% year-on-year.

How to read these figures

• Among the causes of incidents, besides hacking intrusion, there are also lost documents or portable devices, accidental disclosure via email or post, employee violations, and system misconfiguration — in other words, a considerable proportion of incidents have nothing to do with technology, but are process problems.
• The three cases cited by the Office in the same announcement were all cases of human negligence involving employment data. Their common thread is: no system, no supervision, no training.
• Schools and non-profit organisations account for over one-third of notifications, reflecting that institutions with limited resources but holding large amounts of personal data are among the highest-risk groups.

2.3 Reading the Two Sets of Figures Together

Observation	Implications for businesses
Attack patterns concentrate on phishing and basic configuration vulnerabilities	Basic measures have the highest return on investment: multi-factor authentication, email security, patch management, backups
A considerable proportion of incidents are human negligence	Policy, process and training are not 'extra work' but the primary line of defence
Resource gaps among SMEs are evident	A 'outsourcing + insurance + process' combination is more practical than trying to build an in-house team
AI is both an attack tool and a risk source	AI governance needs to be planned together with information security, not handled separately

---

Module 3: Hong Kong's Legal and Regulatory Liabilities

Hong Kong currently has no dedicated artificial intelligence law, but businesses still bear substantial liability in cyber and AI matters. These liabilities come from three levels.

3.1 First Level: Statutory Liability

Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653)

• Gazetted on 28 March 2025, in force from 1 January 2026.
• The targets are designated critical infrastructure operators, covering sectors such as energy, information technology, banking and financial services, transport, healthcare, and communications and broadcasting, as well as infrastructure that sustains important social and economic activities.
• It imposes three categories of statutory duty:

Category	Content
Category 1: Structure	Maintain a continuous office in Hong Kong; notify changes of operator; establish and continuously maintain a computer system security management unit supervised by employees appointed by the operator
Category 2: Prevention	Notify material changes; submit and implement a computer system security management plan; conduct security risk assessments; arrange security audits
Category 3: Incident Notification and Response	Participate in security exercises; submit and implement emergency plans; notify the Commissioner of security incidents within specified time limits

• The government has stated that the regulated operators are mainly large institutions, and SMEs and the general public will not be affected.

Personal Data (Privacy) Ordinance (Cap. 486, PDPO)

• Applies to any institution holding personal data, not limited to large enterprises or regulated industries.
• Its core is six data protection principles, of which the two most directly relevant to cyber risk are:
  • Data Protection Principle 3: Personal data shall not be used for a new purpose without the prescribed consent of the data subject — this includes improper disclosure.
  • Data Protection Principle 4: Data users must take all practicable steps to ensure data is protected against unauthorised or accidental access, processing, deletion, loss or use.
• When a data breach occurs, notify in accordance with the requirements of the Privacy Commissioner's Office, which may trigger an investigation, an enforcement notice or a warning letter.

3.2 Second Level: Regulatory Guidance (by industry)

Taking the insurance industry as an example, the Insurance Authority's requirements include:

Guidance	Content
Cyber Security Guideline (GL20)	The revised version took effect from 1 January 2025, introducing the Cyber Resilience Assessment Framework (CRAF), including inherent risk assessment, maturity assessment, and threat-intelligence-led attack simulation (required for those with medium or high inherent risk, simulating at least three end-to-end attack scenarios)
Enterprise Risk Management Guideline (GL21)	Requires insurers to identify, assess and manage risks arising from technology applications (including AI and machine learning models)
GL8 Guideline revision	Consultation launched in Q4 2025, planned for completion in 2026; according to the IA's public explanation, the revision will add requirements for board and management accountability, 'human-in-the-loop' mechanisms, operational resilience and AI decision disclosure

Implications for non-financial institutions: Even if you are not directly bound by these guidelines, your clients may be. When banks or insurers must meet CRAF requirements, your security capability becomes a prerequisite for their procurement and outsourcing.

3.3 Third Level: Contractual Liability

This is the most easily overlooked layer, yet actually the first to be triggered. Common contractual clauses for businesses include:

• Customer contracts: data security and confidentiality obligations, incident notification time limits, caps on indemnity liability.
• Outsourcing and procurement contracts: require suppliers to provide security attestations, accept audits, and comply with specified standards.
• Leases, engineering contracts, exhibition contracts: require provision of insurance proof, and some contracts are beginning to include 'cyber insurance' as a requirement.

3.4 Comparison of the Three Levels of Liability

Level	Who is bound	Consequences of breach	Can insurance address it
Statutory liability	Designated critical infrastructure operators; all institutions holding personal data	Fines, enforcement notices, investigation	The fine portion is very rarely covered; defence costs may be covered
Regulatory guidance	Regulated industries (banking, insurance, securities, etc.)	Regulatory action, licence conditions, public criticism	Defence costs may be covered
Contractual liability	Any business that signed the relevant contract	Breach damages, contract termination, recovery	Depends on the terms, usually within third-party liability coverage

In a sentence: insurance handles the 'financial consequences'; the legal liability itself, regulatory compliance itself, and customer trust itself all have to be borne by the business itself.

---

Module 4: Handling Process for Data Breach Incidents

Data breaches are the most common type of incident in Hong Kong, and also the easiest to handle incorrectly. The following process starts from 'after the incident is discovered'.

Step 1: Confirm and Contain (First Few Hours)

• Confirm whether the incident is real: a system error, an internal mis-send, or an external intrusion.
• Contain immediately: cut network connections to affected systems, disable the account involved, and rotate credentials.
• Do not immediately reinstall or wipe the system — this destroys the evidence needed for digital forensics.
• If cyber insurance has been purchased, notify the insurer immediately as required by the policy to activate response services and the hotline.

Step 2: Assess Scope and Preserve Evidence

• Determine which types of personal data are involved, how many people are affected, and whether the data is identifiable to individuals.
• Have qualified forensic personnel conduct the investigation and fully record the timeline.
• Retain logs, images and communications records; build an incident file.

Step 3: Determine Notification Obligations

• Whether notification to the Privacy Commissioner's Office is required.
• Whether affected individuals need to be notified.
• If in a regulated industry (e.g. insurance, banking), whether notification to the industry regulator is required.
• If a designated critical infrastructure operator, whether notification to the Commissioner is required within specified time limits.
• If a customer contract is involved, whether the customer needs to be notified per the contract terms.

Step 4: Notification and Communication

• The notification should include: what happened, what data is involved, what measures have been taken, and what affected individuals should do.
• Use a designated spokesperson for unified external communication to avoid internal information chaos.
• Prepare a response plan for reputational risk.

Step 5: Recovery and Post-Incident Review

• Restore systems and data once safety is confirmed.
• Review systemic gaps, implement corrective measures, and retain records.
• If a regulator later conducts an investigation, 'whether there was remediation afterwards and whether it was recorded' is often as important as the incident itself.

Advisor's Note

Within this process, the step most prone to error is not the technical steps, but Step 1's 'notify the insurer immediately'. Many businesses rush to fix things themselves after an incident and only remember the policy days later, missing the notification time limit stipulated in the policy, or destroying the evidence needed for forensics, affecting the claim payout. The notification time limit stated in the policy wording is worth printing out in advance and sticking on the first page of the response plan.

---

Module 5: AI Risk and Coverage Gaps

5.1 Six Ways AI Causes Loss

Type	Example	Main impact
AI hallucination	AI-generated legal references, financial figures or medical information are wrong, and customers act on them and suffer loss	Third-party liability, professional liability
Algorithmic bias	Automated screening, scoring or pricing produces unfair outcomes for specific groups	Regulatory investigation, class actions, reputation
AI used as an attack vector	Deepfake voice fraud for fund transfers, AI-enhanced phishing causing credential leakage, AI-automated ransomware	First-party loss, third-party liability
Autonomous behaviour of AI agents	AI agents execute wrong transactions, wrong pricing or wrong filings under authorised credentials	Pure financial loss — the hardest type to handle
Data entered into public AI tools	Employees paste customer data into public AI services	Data leakage, cross-border transfer, notification liability
Infringement by AI-generated content	Unauthorised use of copyright-protected material to generate marketing content	Intellectual property claims, advertising torts

5.2 Why These Risks Fall Into Coverage Gaps

The reason is that the design starting point of existing policies does not match the actual shape of AI incidents:

Policy type	Why it may not cover AI incidents
General liability insurance	Traditionally centred on bodily injury and property damage; the pure financial loss caused by AI is usually outside its scope
Professional liability insurance	Deals with the negligence of human professionals; when a decision is made by an automated system, attribution of liability is disputed
Cyber insurance	Originally designed to handle data breaches, ransomware and network interruption. Harmful acts by AI agents under authorised credentials are not an 'intrusion'
Management liability insurance	If AI governance failures lead to shareholder or regulatory action, the risk may extend to the director level

On top of that, some insurers have added AI exclusion clauses to commercial policies, removing liability arising from 'actual or alleged use of AI', further widening the gap.

5.3 Three Responses Currently in the Market

Approach	Content	Advantage	Limitation
Add an AI endorsement to existing policies	Attach AI-related coverage to professional liability or cyber insurance	Lower cost, faster underwriting	Narrower scope, may separately exclude 'autonomous decision-making'
Include AI risk within cyber insurance	Include coverage starting from 'AI used as an attack vector'	Aligns with existing cyber insurance processes	Mainly handles AI-induced cyber losses, not comprehensive AI liability
Standalone AI liability insurance	Designed specifically for AI incidents, covering hallucination, model degradation, bias, etc.	Broadest scope, definitions closest to actual risk	Early market, limited capacity; not yet a ready-made product purchasable in Hong Kong

5.4 Where Hong Kong Businesses Actually Stand at This Stage

In Hong Kong, standalone AI liability insurance is not a ready-made standard product you can buy. Therefore, the practical strategy at this stage is not to rush to find an 'AI policy', but to first reduce the gaps, then improve insurability:

1. Read existing policies carefully. Review general liability, professional liability, cyber insurance and management liability policies one by one, confirming whether there is an AI exclusion clause and how far it reaches.
2. Improve insurability through governance. When underwriting AI risk, insurers care most about whether the business can demonstrate governance. Documented governance directly affects insurability and premium levels.
3. Address the most certain parts first. Network losses caused by AI being used as an attack vector are currently the clearest segment for which coverage can be obtained in the market.

---

Module 6: What AI Governance Should Prepare

The Privacy Commissioner's Office's Artificial Intelligence (AI): Model Framework for Personal Data Protection (released June 2024) recommends that organisations build AI governance from four directions. Corresponding to practical documents, businesses need to prepare the following four types:

Document	Content	Why needed
AI usage policy	Which AI tools are allowed, for what purposes, what data must never be entered, who is authorised to approve new tools	This is the most basic one. Hong Kong surveys show one-third of businesses using AI have entered company data into public AI tools; the reason is usually not rule-breaking but the absence of clear rules
AI system inventory	Which AI systems the organisation currently uses, for what purpose, what types of data they process, and who is responsible	Without an inventory, you cannot answer underwriting questions or regulatory enquiries
Privacy impact assessment records	Before introducing an AI system, assess its impact on personal data privacy and the mitigation measures	The Model Framework explicitly recommends this at the procurement and implementation stages; it is also a focus of compliance checks
Human supervision and audit records	Which decisions require human review, who is responsible for review, and how system behaviour logs are retained	The IA's GL8 revision direction already includes 'human-in-the-loop' and AI decision disclosure

On 'Human-in-the-Loop'

The Model Framework divides human supervision into three modes, and organisations should choose according to the level of risk:

Mode	Applicable situation
Human-in-the-loop	High-risk systems, where a human retains the decision-making authority
Human-on-the-loop	Risk cannot be ignored but full human intervention is too costly; a human uses the system output and supervises operations, intervening when necessary
Human-out-of-the-loop	Low-risk systems, where AI can directly adopt its output

A practical test: If the AI's output affects a customer's money, rights or legal status, 'human-out-of-the-loop' should not be adopted.

---

Module 7: Enterprise Self-Assessment Checklist

The following checklist is grouped by area. It is recommended that colleagues responsible for IT or compliance answer each item, and list the 'No' items as to-dos.

A. Basic Controls

#	Check item	What to do if answered 'No'
1	Multi-factor authentication is enabled on all email and critical system accounts	This is the lowest-cost, highest-return item and should be prioritised
2	There is a process for patching system vulnerabilities regularly, with records	Set a patch deadline schedule and record the completion of each patch
3	Backups exist and are offline or immutable	If backups are on the same network as production systems, ransomware can encrypt them too
4	Data recovery has been tested and you know how long it actually takes	Conduct regular drills and record the recovery time objective and actual results
5	Privileged accounts (admin rights) have separate management and monitoring	Review who holds privileges and reduce unnecessary admin accounts

B. People and Process

#	Check item	What to do if answered 'No'
6	There is a dedicated or clearly designated person responsible for cyber security	SMEs may outsource, but there must be a clear internal owner
7	Staff receive regular phishing and security training	Recommend once per quarter, and test effectiveness with simulated phishing
8	There is a written incident response plan	The first page of the plan should include the policy notification time limit and the insurer's hotline
9	Accounts and access rights of departing employees are revoked immediately	Establish an offboarding checklist and retain execution records
10	There is a clear data classification policy (which data can go where)	At least distinguish three levels: 'public', 'internal', 'confidential / personal data'

C. AI-Specific

#	Check item	What to do if answered 'No'
11	There is a written AI usage policy, communicated to staff	Establish a minimum viable version: list of permitted tools, categories of data forbidden to enter
12	The organisation's AI systems and their uses have been inventoried	Build an inventory, including tools subscribed by departments without going through IT
13	It is explicitly forbidden to enter customer personal data or confidential data into public AI tools	Back the policy with technical measures (blocking), not just self-discipline
14	AI decisions affecting customer rights have a human review mechanism	Define which decisions are high-risk and designate a reviewer
15	AI systems' inputs and outputs are logged	Preserve evidence for future regulatory enquiries and underwriting

D. Legal and Contractual

#	Check item	What to do if answered 'No'
16	Existing policies have been reviewed for AI exclusion clauses	Review general liability, professional liability, cyber insurance and management liability policies one by one
17	The security and incident notification clauses of key customer contracts have been reviewed	Especially the notification time limits and caps on indemnity liability
18	Key supplier contracts have been reviewed for security and notification clauses	Liability for supply-chain incidents needs to be written into contracts in advance
19	You know which institutions to notify in the event of an incident, and the time limits	Compile into a one-page list in advance
20	Whether the organisation's cyber insurance covers losses caused by third-party suppliers	This is an incident type that has actually occurred in recent years and must be confirmed policy by policy

E. Organisational Resilience

#	Check item	What to do if answered 'No'
21	Critical systems are listed and single points of failure are flagged	First handle systems that 'bring the whole company to a halt once they fail'
22	There is a designated incident spokesperson and external communication plan	External messages during an incident need to be unified, otherwise reputational loss is amplified
23	Management receives regular cyber risk reports	Cyber risk is an enterprise risk and needs scrutiny at the management level
24	Incidents and near-misses over the past three years are recorded	These records are important underwriting material and also prevent repeated mistakes

How to use this checklist

You do not need to complete all items at once. The practical priority order is: Items 1, 3, 6, 11, 13 (high return, low cost) → Items 8, 16, 20 (directly related to insurance) → the rest sorted by risk.

---

Module 8: Claims and Incident Response Process

The biggest difference between cyber insurance claims and ordinary insurance is: it often begins before the incident happens.

Incident occurs
│
├─ Step 1 | Notify the insurer immediately (usually within 24–72 hours; check the policy wording)
│        └─ Activate response services: forensics, legal, PR
│
├─ Step 2 | Contain and preserve evidence (do not wipe the system)
│
├─ Step 3 | Submit a preliminary incident report
│        └─ Contents: time of occurrence, how discovered, scope involved, preliminary impact
│
├─ Step 4 | Cooperate with the insurer's forensics and loss assessment
│        └─ Retain all expense receipts (response, legal, PR, recovery)
│
├─ Step 5 | Submit claim documents
│        └─ The insurer verifies coverage, sub-limits and exclusions
│
└─ Step 6 | Payout and closure
         └─ Retain complete incident records for future renewals

Four Most Common Problems When Claiming

Problem	Cause	How to avoid in advance
Claim denied for late notification	The notification time limit in the policy is short, and the business forgets while busy firefighting	Put the time limit and hotline number on the first page of the response plan
Claim denied for 'known circumstances'	The incident had already begun before the policy started, just undiscovered	Disclose honestly when taking out cover; if in doubt, conduct a security assessment first
Claim denied for failing security standards	At application the business declared a control was implemented, but it was not	Verify the actual control status before applying, and avoid over-declaring
Payout far below expectations	Sub-limits and layered structure mean the total limit is not the usable amount	Check sub-limits item by item when applying, rather than looking only at the total limit

---

Appendix A: Glossary

Term	Explanation
Cyber insurance	Insurance covering a business's own losses from a cyber incident (first-party) and its liability to third parties (third-party)
First-party coverage	Covers the insured business's own losses, such as response costs, business interruption, and data recovery
Third-party liability	Covers the insured business's liability to others (customers, partners, regulators)
Incident response	A series of actions after an incident — forensics, legal, PR and crisis management
Sub-limit	A separate compensation cap set under the overall limit for a specific coverage item, usually non-fungible
Deductible / Excess	The amount the policyholder bears for each claim; confirm whether it is calculated 'per incident' or 'per policy year'
Claims-made policy	A policy designed so that the time the claim is made (rather than when the incident occurs) is the basis of coverage
Known circumstances	A situation that had occurred or should have been known before the policy took effect, generally not covered
War exclusion	Excludes losses caused by attacks launched by war or state-level actors; the most commercially impactful exclusion in cyber policies
Business email compromise	An attacker impersonates or intrudes into an email account to induce a business to transfer funds to its account; many policies set a separate sub-limit
Ransomware	Malware that encrypts a business's files and demands payment for the decryption key; recently it also exfiltrates data to threaten public disclosure
Digital forensics	The professional work of collecting and analysing digital evidence after an incident, to determine cause, scope and impact
Data breach notification	The action of notifying affected individuals and regulators of a data breach incident
Designated operator	A critical infrastructure operator designated under the Protection of Critical Infrastructures (Computer Systems) Ordinance, required to perform statutory duties
Critical computer system	A computer system directly related to the operation of critical infrastructure under the Ordinance
Cyber Resilience Assessment Framework (CRAF)	An assessment framework under the IA's Cyber Security Guideline, including inherent risk assessment, maturity assessment and threat-intelligence-led attack simulation
AI hallucination	Content generated by an AI model that appears plausible but is actually wrong
Agentic AI	An AI system that can plan and execute tasks on its own (e.g. calling tools and making decisions by itself)
Human-in-the-loop	An AI supervision mode where a human retains the decision-making authority
AI exclusion clause	A clause in a policy that removes 'liability arising from the use or deployment of AI'
Embedded insurance	An arrangement that embeds insurance directly into the product or service sales process, e.g. obtaining coverage when purchasing a robot service
Microinsurance	A small insurance product designed for a single risk or scenario, with lower limits and premiums

Appendix B: Six Common Misconceptions

Misconception 1

"Cyber security is the IT department's job." Hong Kong's surveys show the largest attack pattern is phishing (57%), and a considerable proportion of data breach incidents are human negligence. The defence against these two types of risk lies in process design and staff training, not the firewall. Cyber security is a matter for management and the personnel system.

Misconception 2

"We have no customer data, so we don't need to worry." Besides customer data, you also need to consider employee data, supplier data, trade secrets, financial and payment data, and intellectual property. Among Hong Kong's 2025 notifications, a portion were precisely caused by errors in handling employment data.

Misconception 3

"Buying insurance means being compliant." Insurance and compliance are two different things. Insurance pays money; compliance is the business's own responsibility. When under regulatory investigation, the policy can pay defence costs, but it cannot submit plans, conduct audits or fix systems on your behalf.

Misconception 4

"AI risk is too new; insurers definitely won't cover it." The market has already diverged: some insurers add AI exclusion clauses to policies, while others include AI-induced cyber risk within coverage. The direction is not uniform, so you must read your own policy clause by clause, rather than relying on general statements.

Misconception 5

"If we use an AI vendor, the liability is the vendor's." Vendor contracts usually set liability caps and may not cover your own losses. When the AI's output affects your customers, the party they pursue is usually you — because you are the one who signed the contract with them.

Misconception 6

"Buying the highest limit is safest." Sub-limits and layered structure determine the actual amount usable. A policy with a high overall limit but scattered and low sub-limits may, in a single type of incident, have less actual coverage capability than a policy with a lower overall limit but a better-matched structure.

Appendix C: Further Reading and Sources

Official Sources

• Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) — Hong Kong SAR Government press releases, Office of the Communications Authority
• Personal Data (Privacy) Ordinance (Cap. 486) and various guidelines — Office of the Privacy Commissioner for Personal Data
• Artificial Intelligence (AI): Model Framework for Personal Data Protection (June 2024) — Guidance Checklist for Employees Using Generative AI (2025) — Agentic Artificial Intelligence: Protecting Personal Data Privacy (2026) — Office of the Privacy Commissioner for Personal Data
• Hong Kong Cyber Security Outlook 2026 — Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT)
• IA Cyber Security Guideline (GL20), Enterprise Risk Management Guideline (GL21) and guideline revision announcements — Insurance Authority
• Generative AI Sandbox++ announcements — Hong Kong Monetary Authority, Securities and Futures Commission, Insurance Authority, Mandatory Provident Fund Schemes Authority, Hong Kong Cyberport Management Company Limited

Related Pages on This Site

• Cyber Security and Artificial Intelligence Insurance (Section Home)
• Hong Kong News and Developments
• Products and Coverage Structure
• Global Market Overview
• AI Risk and Insurance
• Insurance Glossary

i

Educational Use Statement

This page is educational content on general insurance, risk management and compliance information, and does not constitute the sale, offer or solicitation of any insurance product, nor does it constitute legal, compliance or insurance advice. The regulatory summaries herein are general illustrations that change with legislative amendments; everything is subject to the official original text and the latest amendments. The incident response process and self-assessment checklist are generic reference frameworks; organisations should adapt them to their own industry, size and applicable regulations, and consult legal and insurance professionals when needed.

Related Content

• Cyber Security and Artificial Intelligence Insurance (Section Home)
• Hong Kong News and Developments
• Products and Coverage Structure
• Sources and Disclaimer