Hong Kong Cyber Security and Artificial Intelligence Insurance: News and Developments
In a sentence: this page chronologically compiles Hong Kong's regulatory announcements, incident statistics and product developments in cyber security and artificial intelligence (AI) insurance. Each item includes a publication date, key points, source and practical implications for businesses, so you can verify the original rather than reading only an abstract.
Last updated on this page: 1 October 2026 | Data collected on: 1 October 2026
How This Page Works
| This page will | This page will not |
|---|---|
| Record regulatory, statistical and product news with clear publication dates and sources | Publish rumours or unverified 'reportedly' news without source or date |
| Explain the practical implications of each item for enterprise risk and coverage | Recommend any insurer, product or solution |
| Mark data as official original, institution publication or media report | Provide premium quotes, discounts or sales promotion information |
| Retain old records and flag them when the official updates | Delete or rewrite already-published old news |
1. Regulation and Legislation
1 January 2026 | Protection of Critical Infrastructures (Computer Systems) Ordinance Comes into Effect
The Hong Kong SAR Government gazetted a commencement date announcement on 27 June 2025, designating 1 January 2026 as the commencement date of the Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653).
Key Points
- The Ordinance was gazetted on 28 March 2025, with the purpose of imposing statutory duties on designated critical infrastructure operators to ensure they take appropriate measures to protect computer systems and reduce the likelihood that essential services are disrupted or destroyed by cyber attacks.
- The Ordinance imposes three categories of statutory duty: structural (maintaining a continuous office in Hong Kong, establishing a computer system security management unit), preventive (submitting and implementing a security management plan, conducting risk assessments, arranging security audits), and incident notification and response (participating in exercises, submitting emergency plans, notifying the Commissioner of security incidents within specified time limits).
- Covered sectors include energy, information technology, banking and financial services, land, air and sea transport, healthcare, and communications and broadcasting; it also covers infrastructure sustaining important social and economic activities, such as large sports and performance venues and R&D parks.
- According to public information at the legislative stage, fines for violations range from HK$500,000 to HK$5,000,000, with additional daily fines for continued violations; the notification time limit for serious incidents is two hours.
- The government has stated that the regulated operators are mainly large institutions, and SMEs and the general public will not be affected.
Implications for Businesses
The Ordinance directly binds only designated operators, but its impact cascades downward: to meet statutory requirements, designated operators must write security requirements into procurement contracts, outsourcing contracts and service level agreements, and require suppliers to provide proof of security capability, even requiring suppliers to take out cyber insurance themselves. If you are a supplier to these operators, the Ordinance's requirements will eventually appear before you in the form of contract terms.
5 March 2026 | Launch of the Generative AI Sandbox++ (GenA.I. Sandbox++)
The HKMA, the SFC, the IA and the MPFA — four financial regulators — together with the Hong Kong Cyberport Management Company Limited, announced the launch of GenA.I. Sandbox++. The programme expands the GenA.I. Sandbox launched in 2024, covering banking, securities and capital markets, asset and wealth management, insurance, MPF and stored value payment instruments.
Key Points
- The programme focuses on three areas: risk management, anti-fraud, and customer experience, and continues to advance the 'A.I. vs A.I.' strategy — using artificial intelligence to manage the risks brought by AI applications.
- Participating institutions receive targeted regulatory guidance, technical support, and free use of the GPU computing resources of Cyberport's AI Supercomputing Centre.
- Application scenarios listed in the programme include using AI for insurance underwriting and claims processes, as well as cross-sector smart customer chatbots and fraud detection systems.
- The application period runs until 30 June 2026.
Implications for Businesses
The IA's Executive Director stated in the announcement that the programme's thinking is consistent with the IA's 'AI Facilitation Plan'. This means the insurance industry's AI applications are moving from 'individual institutions testing on their own' to 'controlled testing with regulator participation'. The scope and conclusions of the tests will later become a reference benchmark for the industry's compliance expectations.
3 February 2026 | Privacy Commissioner's Office Publishes 2025 Work Report
The Privacy Commissioner's Office published its 2025 work report and simultaneously announced its intervention in three incidents involving personal data security.
Key Points
| Item | 2025 | 2024 | Change |
|---|---|---|---|
| Complaint cases | 4,228 | 3,431 | +23% |
| Data breach notifications | 246 | 203 | +21% |
| — involving hacking intrusion | 81 | 61 | +33% |
| — from public bodies | 79 | — | — |
| — from private organisations | 167 | — | — |
| Number of compliance checks | 435 | 400 | +9% |
- Among the 246 notifications, 92 came from schools and non-profit organisations, accounting for 37% of all incidents.
- Causes of incidents include hacking intrusion, lost documents or portable devices, accidental disclosure via email, post or fax, employee violations, and system misconfiguration.
- The three intervened cases were all instances of human negligence in handling employment data: sending a termination-of-employment notice containing identity card numbers to an instant messaging group; a department head failing to lock the drawer storing staff appraisal forms; an administrative officer mistakenly saving a scanned copy of dismissal documents to a department shared folder. The Office issued enforcement notices or warning letters respectively.
Implications for Businesses
None of the three cases involved a 'high-tech hacker'. They were all everyday processes and human negligence — exactly the most common risk source for SMEs, and the part most easily solved through process and training. At the same time, note: the growth rate of data breach notifications (+21%) reflects that regulation is proactively intervening rather than merely passively receiving complaints — outpacing the overall trend except for the growth in complaints (+23%) over the same period.
May 2026 | Privacy Commissioner's Office Publishes AI Compliance Check Results for 60 Organisations
The Office launched an AI compliance check on 60 organisations in January 2026 and published the results in May. According to public reports, among the organisations checked, 95% use AI in daily operations, and over half run three or more AI systems simultaneously; the check found no violations of the Privacy Ordinance, but the Office recommended that organisations establish a governance framework, conduct privacy impact assessments and AI audits, and put control measures in place for agentic AI.
Over the same period, the Office issued a standalone alert in March 2026 on agentic artificial intelligence (AI systems that can execute tasks on their own) and subsequently published the practical guideline Agentic Artificial Intelligence: Protecting Personal Data Privacy.
Implications for Businesses
The regulatory focus has shifted from 'whether AI is used' to 'how AI is governed'. For businesses, this means they need to start having three types of documentation: an AI usage policy, privacy impact assessment records, and AI system behaviour records.
Late May 2026 | HKMA and SFC Issue Circular on AI-Driven Cyber Attacks
According to public information, the HKMA and the SFC issued a circular in late May 2026 on AI-driven cyber attacks to regulated institutions, continuing the HKMA's earlier circular requirements on AI cyber security.
Implications for Businesses
Regulators have explicitly listed AI as an attack vector (not merely an application tool). IT suppliers, outsourcing service providers and cloud service providers of financial institutions can expect to successively receive customer enquiries and requirements regarding AI-related risk controls.
From November 2025 | IA GL8 Guideline Revision Consultation
The IA's Chief Executive said during Hong Kong FinTech Week 2025 that the IA would launch a GL8 guideline revision consultation, planned for completion in 2026, with the revision adding requirements for board and management accountability, 'human-in-the-loop' mechanisms, operational resilience, and AI decision disclosure.
Other measures announced over the same period include: implementation of the Cyber Resilience Assessment Framework in January 2025, launch of an AI-related industry programme in August 2025, and publication of a federated learning white paper in November 2025.
Implications for Businesses
The two items 'human-in-the-loop' and 'AI decision disclosure' will directly affect how insurers use AI for underwriting and claims. For business customers, this means an automated underwriting or automated claims result you receive may later need to be accompanied by an explanation and a human review mechanism.
To Be Published | IA Updates AI Guidance
The IA stated in August 2025 that it would issue updated AI guidance in 2026 to provide regulatory clarity and promote responsible adoption. As of this page's last update, the guidance has not yet been published.
Implications for Businesses
This is a compliance scope still in flux. In this situation, the practical approach is: do not wait for the final guidance; first build demonstrable governance evidence based on the existing Cyber Security Guideline (GL20) and the Privacy Commissioner's Model Framework.
2. Incidents and Statistics
28 January 2026 | HKCERT Publishes Hong Kong Cyber Security Outlook 2026
The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT), under the Hong Kong Productivity Council, published its annual report Hong Kong Cyber Security Outlook 2026, and simultaneously released the findings of the Hong Kong Enterprise Cyber Security Status study.
Key Points
| Item | Figure |
|---|---|
| Hong Kong cyber security incidents in 2025 | 15,877 (up +27% year-on-year, a record high) |
| Share of phishing among all incidents | 57% |
| — via social media or instant messaging platforms (e.g. WhatsApp) | 34% |
| — via cryptocurrency platforms | 18% |
| Vulnerable-system cases | 2,328 (15%, up over 3.5x year-on-year) |
| Botnet-related incidents | 18% |
- The study covers 622 enterprises (544 SMEs, 78 large enterprises), plus interviews with 50 cyber security service providers.
- Nearly 30% of enterprises have no dedicated person for cyber security; only 26% of SMEs have a full-time cyber security staff member (59% for large enterprises).
- 67% of SMEs have an employee responsible for cyber security (95% for large enterprises).
- SME adoption of email security solutions is 48% (79% for large enterprises); privileged access management 29% (60% for large enterprises); advanced remote security 31% (67% for large enterprises).
- 35% of enterprises using AI admit to having entered company data into public AI tools.
- The report predicts that the main risks for 2026 fall into two categories: AI application risk and supply chain risk, and notes that threats from cloud single points of failure and networked AI devices are rising.
Implications for Businesses
Three points are worth noting. First, phishing attacks account for nearly 60%, and generative AI makes phishing messages harder to identify — this means the value of staff training does not decline as technology investment increases. Second, vulnerable-system cases up over 3.5x are a matter of basic configuration and patch management, low cost but most often overlooked. Third, the supply chain has been explicitly named as 'the most vulnerable link'; even if an enterprise's own defences are solid, a single partner's vulnerability is enough to trigger a chain incident.
April 2026 | SoFi Securities (Hong Kong) Data Breach Incident
According to public information, SoFi Securities (Hong Kong) Limited suffered a data breach in April 2026; the source of the incident was not the company's own systems, but an attacker unauthorisedly intruding into a customer database managed by one of its third-party suppliers.
Implications for Businesses
This case concretises an often-overlooked blind spot: your data may not be in your hands. Cloud systems, accounting outsourcing, IT service providers, payment platforms, CRM system suppliers — all may hold your customers' personal data. When a supplier has an incident, the notification obligation and customer claim liability can fall back on you at any time. This is also why, in cyber insurance, whether 'losses caused by third-party suppliers' are covered needs to be confirmed clause by clause.
3. Product and Market Developments
12 January 2026 | OneInfinity Includes AI-Related Risk in Cyber Insurance
OneInfinity, under digital insurer OneDegree, announced an upgrade to its cyber insurance product, including AI-related risks intersecting with cyber security, data protection and network intrusion within coverage, with a limit selectable up to US$2 million.
Key Points
- The company noted that in recent years several international insurers have applied to regulators to add AI exclusion clauses to commercial policies, removing liability arising from a business's deployment, use or integration of AI technology; some clauses even cover 'actual or alleged use of AI'.
- The upgraded policy takes 'AI used as an attack vector' as its entry point, covering cyber losses and third-party liability caused by the exploitation of AI technology, including costs such as incident response, business interruption, data recovery, and cyber security and privacy liability.
- The product adopts risk layering and sub-limit management, and states it has secured reinsurance capacity support with an A-grade rating.
- The company also noted that the new Ordinance coming into effect is expected to drive local market demand for cyber security coverage.
Implications for Businesses
This is a clear watershed in the Hong Kong market: at the same time, some insurers add exclusions on AI risk while others include it within coverage. When renewing, businesses cannot assume 'the market treats it uniformly' and must review the clauses policy by policy.
15 June 2026 | Zurich Insurance (Hong Kong) and YAS Launch Robot Embedded Insurance
Zurich Insurance (Hong Kong) and YAS Insurance announced a partnership to promote the application of artificial intelligence and robotics technology in Hong Kong through an 'embedded insurance' solution: Zurich custom-built microinsurance for YAS's robot sales and service solution, directly embedded within its service.
Key Points
- Main coverage includes robot repair costs caused by insured incidents, and compensation for customer deductibles under other related policies.
- Use scenarios cover manufacturing and logistics, malls and commercial buildings, construction sites, restaurants and clubs.
- The series belongs to Zurich's 'Insight Series' microinsurance, designed for different innovative technology application scenarios.
- YAS Digital Limited is an IA-licensed insurance agent (licence number FA2648) distributing this robot insurance product.
Implications for Businesses
This is a concrete example of 'AI and robot risk embedded into the procurement process as microinsurance': when a business purchases a robot service, the coverage is in place at the same time, without separate arrangement. This model is especially meaningful for SMEs, because traditional enterprise insurance's application and underwriting processes often have no ready-made classification for 'new technology equipment'.
2026 | Developments in the Insurance Industry's Internal Use of AI
Beyond insurance products themselves, insurers are also applying AI to operational processes. According to industry reports, in the first half of 2026 a Hong Kong insurer partnered with an insurtech to launch an AI agent platform for automated medical claims processing, capable of handling unstructured documents such as claim forms, medical reports, invoices and receipts, and identifying disease classifications and benefit codes.
Implications for Businesses
Two things must be kept distinct: 'the insurer uses AI to process your claim' and 'the insurer underwrites your AI risk' are two completely different subjects. The former concerns your experience and rights as a claimant (e.g. whether AI decisions need disclosure, whether there is human review); the latter concerns your coverage as a business. Both are affected by the IA's AI guidance.
2026 | Standalone AI Liability Insurance Products in Overseas Markets
Outside Hong Kong, standalone AI liability insurance has emerged since 2025, mainly targeting institutions that 'use AI' rather than 'develop AI':
| Product / Underwriter | Time | Features (summary) |
|---|---|---|
| HSB (under Munich Re) AI liability insurance | Announced March 2026 | Targets SMEs, covering third-party bodily injury, property damage, and personal and advertising injury caused by using AI; not sold directly, attached to partner insurers' commercial policies |
| Armilla (Lloyd's authorised coverholder) | From April 2025 | Covers AI hallucination, model performance degradation and failure, including legal costs and third-party liability |
| Testudo (Lloyd's) | From January 2026 | Explicitly targets enterprises integrating supplier generative AI, not AI developers |
| Munich Re aiSure | — | Insurance targeting the AI model's performance itself, triggered by model performance failure rather than third-party claims |
Implications for Businesses
These products currently have limited underwriting capacity and mostly use the US and Lloyd's markets as their main distribution channels, not ready-made products that can be bought directly in Hong Kong at present. Their significance lies in pointing a direction: AI risk is moving from 'uninsured' to 'insurable'. The practical implication for Hong Kong businesses is three steps — first honestly read the AI exclusion clauses of existing policies; then assess the coverage available; finally improve insurability with governance documents (AI policy, test records, supervision mechanisms).
Market Observation: SME Risk Exposure and Coverage Gap
- According to QBE's 2025 survey data (cited in industry analysis), the cyber incident rate among Hong Kong SMEs reached 30% between 2024 and 2025, higher than 24% in 2023, making it the second most common risk for SMEs; yet the corresponding cyber insurance take-up rate is below 20%.
- The same analysis cites a forecast that Hong Kong's cyber insurance market will maintain about 7.2% annual growth between 2025 and 2029, among the fastest-growing insurance segments.
Implications for Businesses
'Rising incident rates, low take-up' means this is a scope where risk has already materialised but coverage has not caught up. This both explains why insurers have been willing to invest resources in developing SME cyber insurance products in recent years, and why clause differences are so pronounced — the market is still taking shape.
Master Source Table
| Item | Source | Nature | Publication date | Collection date |
|---|---|---|---|---|
| Protection of Critical Infrastructures (Computer Systems) Ordinance commencement date | Hong Kong SAR Government press release | Official original | 2025-06-27 | 2026-10-01 |
| Ordinance's three categories of statutory duty and covered sectors | Office of the Communications Authority | Official original | Current | 2026-10-01 |
| Ordinance penalties and notification time limits | Public reports at legislative stage | Media report | 2024-03 | 2026-10-01 |
| GenA.I. Sandbox++ launch | Hong Kong Monetary Authority press release | Official original | 2026-03-05 | 2026-10-01 |
| GenA.I. Sandbox++ first cohort of selected use cases | Industry media report | Media report | 2026-08-27 | 2026-10-01 |
| Privacy Commissioner's Office 2025 work report | Office of the Privacy Commissioner for Personal Data | Official original | 2026-02-03 | 2026-10-01 |
| AI compliance check results for 60 organisations | Industry analysis citing Office publication | Secondary compilation | 2026-05 | 2026-10-01 |
| HKMA and SFC AI cyber attack circular | Industry analysis citation | Secondary compilation | 2026-05 | 2026-10-01 |
| GL8 guideline revision consultation | IA Chief Executive public remarks (via media) | Media report | 2025-11 | 2026-10-01 |
| HKCERT Hong Kong Cyber Security Outlook 2026 | Hong Kong Computer Emergency Response Team Coordination Centre | Institution publication | 2026-01-28 | 2026-10-01 |
| SoFi Securities data breach incident | Industry compilation report | Media report | 2026-04 | 2026-10-01 |
| OneInfinity cyber insurance upgrade | OneInfinity / AIFT official press release | Institution publication | 2026-01-12 | 2026-10-01 |
| Zurich × YAS robot embedded insurance | Zurich Insurance (Hong Kong) press release | Institution publication | 2026-06-15 | 2026-10-01 |
| Insurer AI claims processing application | Industry compilation report | Media report | 2026 | 2026-10-01 |
| Overseas AI liability insurance products | Composite of multiple industry sources | Secondary compilation | 2025–2026 | 2026-10-01 |
| SME cyber incident rate and take-up rate | QBE survey data (cited in industry analysis) | Institutional survey (secondary citation) | 2025 | 2026-10-01 |