What Hong Kong’s Agentic AI Guidance Means for Brands

Marketing teams in Hong Kong have quietly crossed a line in the past year. The tools sitting in their stack no longer just draft copy and wait for approval. They research prospects, send follow-ups, update records, and decide what to do next, often without anyone signing off on each step. Hong Kong’s privacy regulator has now written the rules for exactly that situation.

On 25 August 2026 the Office of the Privacy Commissioner for Personal Data published Protecting Personal Data Privacy in the Use of Agentic AI, a set of practical recommendations for organisations deploying autonomous AI agents. It supplements the office’s 2024 Model Personal Data Protection Framework instead of replacing it, and it arrives at the point where agents have moved from demonstration to everyday use.

The Four Things the Guidance Asks For

The document is short and unusually direct for a regulatory publication. First, accountability does not thin out as autonomy increases. An organisation that hands an agent a loose instruction remains the data user under the Personal Data (Privacy) Ordinance, and reduced human involvement changes nothing about that position.

Second, data flows have to be understood properly. An agent that reaches across a customer database, a third-party plugin, and an external tool creates a path for personal data that nobody drew on purpose, and the guidance expects organisations to map it before deployment.

Third, risk assessment becomes continuous. Rather than a single sign-off before launch, the office asks for evaluation at each processing stage, together with a contingency plan for the moment human oversight fails. Fourth, transparency has to be specific: privacy policies and Personal Information Collection Statements should explain the actual agentic use case, not carry a generic line about using AI. Law firm Conventus Law described the publication as completing a jigsaw the regulator has been assembling since 2021.

Why a Marketing Team Should Read It

Compliance documents tend to reach the legal team and stop there, which is a mistake in this case. The agents most likely to touch personal data in a Hong Kong business are marketing agents, and the list below covers where the exposure usually sits:

• Outreach agents that enrich a contact record from external sources before sending anything
• Chat agents on a website that collect enquiry details and pass them into a CRM automatically
• Research agents that scrape competitor and customer information into a shared workspace
• Reporting agents with standing access to analytics, CRM, and advertising accounts at once
• Content agents that pull real customer examples into draft material without a review step

The Adoption Gap Behind the Guidance

Agentic tools are still early in Hong Kong, which makes this a good moment for the guidance to arrive. HKT’s Hong Kong Business AI Adoption Survey, published on 21 July 2026, found that only 14 per cent of businesses already using AI had adopted an agentic solution.

The intention gap is wider. Among large enterprises, 40 per cent said they planned to adopt agentic AI, against 19 per cent of small and medium enterprises. Most of the deployments the guidance describes have therefore not happened yet, which is a rare position for a regulator to be writing from.

Two Regimes, One Corridor

Businesses running across the Singapore-Hong Kong corridor now hold two agentic AI rulebooks, and they are built differently. Singapore’s Infocomm Media Development Authority launched its Model AI Governance Framework for Agentic AI on 22 January 2026 at the World Economic Forum in Davos, framed around use-case risk, human checkpoints, technical controls, and end-user education.

The Hong Kong guidance takes a narrower and firmer line, because it sits underneath an existing statutory obligation. Singapore’s framework is advisory and organisation-wide; Hong Kong’s recommendations attach to duties a data user already carries by law. A team that treats the Singapore framework as sufficient preparation for Hong Kong has misread the relationship between the two.

The mainland adds a third layer for anyone operating that far north, with its own generative AI rules administered separately again, so a corridor business is reading three regimes and not two. Describing them as interchangeable is the error that creates work later.

For a marketing operation the practical answer is one workflow built to the stricter standard, documented once, and applied in both markets. That is cheaper than maintaining two, and it holds up better when a client in either city asks how their customer data is handled. Anyone who followed the argument in Hong Kong’s Data Privacy Academy will recognise the pattern, since the regulator has been signalling this direction for some time.

A Short Task for This Week

Open your marketing stack and write down every tool with standing access to customer data and permission to act without approval. Most teams find the list longer than expected. That list is the beginning of the data-flow map the guidance asks for, and it usually surfaces one or two integrations nobody remembers switching on, which is exactly the kind of quiet path the regulator has in mind.

If you would like help reviewing how your content and campaign workflows handle customer information, or building search visibility work that stays on the right side of both rulebooks, our team is based in Singapore and spends its days bridging these markets. Get in touch and we can walk through it with you.