The Privacy Commissioner's latest compliance checks found that 95% of surveyed organisations now use AI in their day-to-day operations, while a separate survey by the Hong Kong Internet Registration Corporation found that 63% of surveyed organisations using AI had no AI usage policy and 68% had provided no AI training.
For Hong Kong employers, the central issue is therefore not simply whether AI may be used, but who remains accountable when it informs an employment decision. The answer is the employer. AI may assist, recommend or rank, but it cannot assume legal responsibility. Employers must be able to show that consequential decisions were based on lawful criteria, tested against the relevant facts, subject to meaningful human review and supported by an adequate record. This article sets out how employers can build that accountability into their decision-making.
Start with the decisions, not the technology
The level of governance should follow the consequence of the decision. Lower risk uses, such as producing a first draft of routine internal material, will not require the same controls as tools that are used to screen CVs, rank candidates, measure productivity, analyse workplace communications, support investigations or score employees in a redundancy exercise. Recruitment, performance management, disciplinary action and termination should be treated as high-risk because errors can affect an individual's livelihood and expose the employer to legal challenge.
Before approving an AI use case, employers should ask what decision the tool will influence, whose interests may be affected, what information the tool is unaware of and whether a manager could explain and justify the outcome without relying on the tool's authority. If the answer to the last question is no, the process is not ready for use.
Accountability under Hong Kong's existing legal and regulatory framework
Hong Kong currently has no AI-specific employment legislation, but that does not create an accountability gap in the law. Existing obligations continue to apply, including under the anti-discrimination ordinances, the Employment Ordinance, the Personal Data (Privacy) Ordinance (“PDPO”) and intellectual property legislation, including the Copyright Ordinance. Sector-specific guidance and circulars may also be relevant. The Privacy Commissioner has adopted a risk-management approach and issued guidance that consistently emphasises governance, meaningful human oversight, transparency and security controls:
- the Guidance on the Ethical Development and Use of Artificial Intelligence;
- the Artificial Intelligence: Model Personal Data Protection Framework;
- the Checklist on Guidelines for the Use of Generative AI by Employees; and
- more recently, the guidance notes on Protecting Personal Data Privacy in the Use of Agentic AI.
The practical result is that an employer cannot defend a flawed decision merely by saying that a system produced the recommendation. It must be able to identify the lawful basis for processing personal data, explain the criteria that mattered, show how discrimination and other legal risks were considered, and evidence the human judgment applied before action was taken.
Where accountability can fail
- Bias and discrimination: AI trained on historical data may reproduce existing biases relating to protected characteristics such as sex, marital status, pregnancy, breastfeeding, disability, family status and race. No AI-related employment claim has yet been litigated in Hong Kong, but experience from other jurisdictions is instructive. In the US, for example, an HR platform provider faces a lawsuit in California alleging that its recruitment tool filtered out applicants on the basis of age, disability and race. The provider denies the claims and says that its users retain human oversight. The case illustrates the risk for employers: if they rely on a biased tool without adequate human oversight, they may face discrimination claims, and they cannot shift responsibility for the outcome to the technology.
- Lack of context: an AI tool may not have the context needed to reach the right decision. For example, it may label an employee a "low performer" without recognising that the figures reflect disability adjustments or medical appointments. In a redundancy exercise, it may recommend dismissing an employee without knowing that the employee is pregnant or has a disability. An employer that relies on that recommendation may be liable for unlawful dismissal and will find the claim hard to defend if it cannot show that the employee was selected for reasons unrelated to their pregnancy or illness.
- Breach of confidentiality: a study by the Hong Kong Computer Emergency Response Team Coordination Centre earlier this year found that around 35% of businesses using AI would enter corporate data into AI tools. Many employees do not regard an AI tool as a "third party" and may input the company's confidential information, such as pricing strategies, financial projections or colleagues' personal data. The risk is greatest with open-source and public AI tools. Where the information is legally privileged, such as legal advice obtained on the termination of an employee, pasting it into a public AI tool (for example, to have it summarised) may give rise to an argument that confidentiality has been lost and privilege waived.
- Infringement risks: when employees use AI to produce documents such as marketing materials, employers need to know who owns the output and whether it infringes the intellectual property rights of third parties. Although there have been no litigated cases in Hong Kong, examples from other jurisdictions show a risk that both the material used to train AI tools and the output they generate may infringe third parties' intellectual property rights.
These risks have a common feature: they arise when an employer treats an AI output as a decision rather than as information to be tested. A defensible process requires HR to interrogate the output against the facts, the law and common sense, and to record why the final decision remains appropriate.
A five-question accountability test for employers
Before AI is used in a material employment process, employers should be able to answer five questions. First, is personal, confidential or privileged information being entered into or generated by the tool? Second, could the criteria or output disadvantage a protected group? Third, what relevant employment context is unavailable to the system? Fourth, who will independently review the output and has authority to depart from it? Fifth, can the employer retain a clear record of the inputs, output, review and reasons for the final decision? Recruitment, performance evaluation, disciplinary action and termination require particularly rigorous answers.
- Assign ownership and decision rights. Appoint a senior individual or committee to oversee AI, whether within data governance, risk or a standalone group. For each high-risk HR use case, identify the human decision-maker, the circumstances requiring escalation and who may override an AI recommendation. Training should help employees understand approved tools, responsible use and the consequences of misuse. Where AI processes employee data, employers should also update personal information collection statements and privacy notices and, where appropriate, obtain consent.
- Set clear rules for acceptable use. Existing discrimination, confidentiality and misconduct policies were not drafted with AI in mind and are unlikely to be sufficient on their own. A workplace AI policy should cover business use on any device and in any location. It should limit use to approved applications, define who may use AI and for what purpose, require critical review of outputs and permission before external use, address intellectual property ownership, prohibit business-sensitive data from being entered into public tools and reserve the employer's right to monitor AI use.
The policy should also set out the consequences of a breach. It should identify the types of misuse it covers, such as entering confidential data into unauthorised tools, relying solely on AI for employment decisions, publishing unreviewed AI content and using unapproved tools. For example, a deliberate or reckless misuse of AI that results in the disclosure of confidential information may amount to gross misconduct justifying summary dismissal.
- Plan for AI-related breaches. Although the PDPO does not currently impose mandatory data breach notification, employers should maintain a response plan covering compromise of an AI system and leakage of confidential or personal data through a tool. The plan should allocate responsibility for containment, legal assessment, notification where appropriate and preservation of relevant prompts, outputs and logs. It should also explain when an AI-assisted HR process must be paused pending investigation.
- Carry out due diligence on vendors and put sufficient contractual protections in place. Before approving an AI tool, employers should establish how it was designed and tested, what data it uses, how the vendor stores data, who can access it, what security certifications apply and how long prompts and outputs are retained. Contracts should impose appropriate data protection, confidentiality and security obligations, allocate responsibility for incidents and include suitable audit, assistance and indemnity provisions where appropriate.
- Develop a data playbook. A data playbook should map the types of data the organisation holds, where it is stored, and the applicable retention periods. This makes it easier for employers to respond to data access requests and to decide the scope of the response.
The objective is not to discourage useful technology. It is to give HR and managers clear boundaries within which they can use AI confidently while preserving the quality, fairness and defensibility of employment decisions.
Prepare for scrutiny and challenge
Two developments make decision records increasingly important. AI adoption is likely to accelerate with the Hong Kong Government's support, while employees are also using AI to formulate challenges, draft correspondence and pursue claims. An employer should assume that an AI-assisted decision may later need to be explained to the employee, a regulator, a tribunal or a court.
The Hong Kong Government has made AI research and development a policy priority, including in its 2026 Policy Address. It has set aside HK$1 billion to establish the Hong Kong Artificial Intelligence Research and Development Institute, which is due to begin operating later this year and will lead and support Hong Kong's AI research and development and its industrial application. Alongside this, the Secretary for Justice earlier this year convened a Steering Committee meeting on the establishment of the "Inter-Departmental Working Group to Review Legislation to Support Wider Application of AI". The working group will carry out a comprehensive review of existing laws to identify any gaps and will then consider whether AI-specific legislation or administrative measures are needed. We therefore expect AI adoption to accelerate, making good governance even more necessary.
Employers are not the only ones using AI. Employees increasingly using it to help them bring and pursue claims, including to draft letters of demand, court documents and data access requests. Former employees often use data access requests after contentious dismissals as a way of obtaining pre-action discovery, and these may extend to AI prompts and AI-generated analysis. Employers should start with the PDPO definition of personal data: information relating to a living individual, from which that individual can be directly or indirectly identified, held in a form in which access or processing is practicable. Removing an employee's name does not necessarily take information outside that definition if the individual remains identifiable, whereas information that can no longer be located or retrieved from an AI system may fall outside the request. To respond properly, an employer needs to know what information is being put into AI tools, what those tools produce and how long the data is kept. This again shows why governance matters.
Hong Kong may introduce AI-specific legislation in time. Until then, employers must continue to navigate AI issues within the existing legal framework and close the gap between adoption and governance. Whatever technology is used, employers remain accountable for the decisions made. HR teams have a central role in ensuring that AI is used safely and lawfully, and that employees understand the consequences of misuse. The practical test is simple: if HR cannot explain the decision without blaming the algorithm, the process needs more work.
