Hong Kong's SFC chairman puts AI-assisted decisions under Section 465 director duties

Almost nine in ten of the more than 2,500 Hong Kong-listed issuers in the Hong Kong Chartered Governance Institute and Wizpresso sample referenced AI in their annual or ESG reports, and fewer than 20% disclosed a structured governance framework covering oversight roles, policies and lifecycle controls ^[5][6]. On a base of 2,500, that is about 2,250 issuers telling investors AI is in the business and fewer than 500 telling them who inside the company owns it, a gap of roughly 1,750 companies ^[1][2][3]. The study named its weakest disclosure areas as risk, compliance and incident management, AI governance and responsible use, executive ownership, and AI-related ESG issues ^[7].

Wong asked boards to understand the AI use cases inside their companies, assign named owners, and make controls match the statements made to investors ^[9]. The third item is the one an outsider can check. "Functions may be delegated; responsibility cannot," Wong said, referring to directors' duties under Section 465 of Hong Kong's Companies Ordinance ^[10]. He said all directors should have basic AI literacy, and that directors with technology, data, cybersecurity or AI responsibilities would face higher expectations based on their relevant expertise ^[11].

What the SFC has put in writing to firms this year is narrower in scope. In June it told licensed corporations, licensed virtual asset service providers and associated entities to strengthen defenses against AI-enabled cyberattacks, through updated technology inventories, vulnerability management, access controls, third-party risk management and incident response ^[12]. The regulator said frontier AI models could reduce the expertise, cost and time required to identify and exploit software vulnerabilities ^[13]. Those instructions bind licensees, while the speech addresses the boards of roughly 2,700 issuers ^[6].

Hong Kong has about 2,700 listed companies, and roughly 9% of them account for more than 90% of average daily turnover, according to figures cited in the speech ^[14]. That works out at about 243 companies carrying the turnover, with about 2,457 sharing what is left ^[4][5]. Among issuers with market capitalizations below HK$4 billion, about 40% have a shareholder controlling more than half the shares ^[15]. Wong said such conditions can increase the importance of independent information and oversight, and that AI could help investors identify anomalies in corporate disclosures while also amplifying selective narratives, misinformation and herd behavior in less liquid parts of the market ^[16].

On spending, Wong asked boards to assess what business problem an investment addresses, the expected returns and risks, and the conditions that would prompt the company to expand, change or terminate it ^[17]. "Activity is not achievement. Expenditure is not value creation. And adoption is not transformation," Wong said ^[18]. The termination condition is the demanding item, because a board that writes one down has to come back to the spend on a date.

In my view the first response will be disclosure language, because another paragraph in an annual report costs less than a named owner with a budget, and the study shows which option most issuers have taken so far ^[6]. The counter-case is that Section 465 attaches to individuals, and Wong said directors holding the technology, data or cybersecurity brief will be judged against that expertise rather than the board average ^[11]. That puts a person in front of a bad AI-assisted disclosure, not a committee. If the share of issuers disclosing a structured framework moves well clear of 20% in the next reporting cycle, the speech was enough on its own; if it sits at the same level, the next step falls to a rule ^[6].