When AI agents go rogue, who can Hong Kong hold accountable?

When OpenAI's AI agents launched an autonomous attack on Australia's Medicare portal in June, it took the company 84 days to report the incident, revealing gaps in regulatory oversight that Hong Kong experts say the city must address. Following similar breaches involving Google's Gemini AI, authorities worldwide have called for clearer regulation and responsibility frameworks for AI agents.

Singapore released the first official guidelines on AI agents earlier this year, with the UK, mainland China, and the United States quickly following suit. Hong Kong plans to release its own guidelines this week, ahead of a government framework expected in mid-next year. Local experts underscore the need to tackle reporting gaps, human oversight, and legal liability in the city.

Chief Executive John Lee Ka-chiu announced plans for official guidelines in September, with the Innovation, Technology and Industry Bureau aiming to publish them in the middle of next year. The Department of Justice stated that government bureaus and departments had completed a preliminary review of over 600 ordinances, with a further review to examine legal liability for AI-related accidents.

Experts and industry leaders argue that the framework should clearly define accountability and mandate human oversight. Adrian Mak Ho-ting, a lawyer and AI Safety Asia board member, noted Hong Kong's legal framework has clear gaps in reporting requirements, with victims bearing the burden rather than developers or deployers of the agents.

The Protection of Critical Infrastructures (Computer Systems) Ordinance requires operators to report serious security breaches within 12 hours and other incidents within 48 hours, but this duty only falls on the affected operator. A Security Bureau spokesman said they would monitor technological developments and review laws to ensure their relevance.

Unlike generative AI models that respond to human prompts, AI agents can independently plan, make decisions, and take actions to achieve goals set by users. Singapore's AI governance framework warns that malfunctioning agents can cause significant real-world harm, with risks amplified in multi-agent systems due to poor communication or coordinated actions.

Singapore's Infocomm Media Development Authority's framework addresses accountability but leaves legal liability undefined. Many AI-related risks are already covered by existing Singaporean legislation, the framework suggests technology-specific guidance while allowing flexibility for rapid developments. Mainland China's AI Safety Governance Framework was updated in September to include a chapter on agentic AI risk management, adding a Hong Kong-specific focus on risks in financial regulatory sandboxes and AI-equipped driverless buses.