Unlike the PCPD's AI guidance, this one is law. If you are designated, the obligations are mandatory and the penalties are real.
Who it covers
Designated operators in critical infrastructure sectors — energy, transport, communications, banking, healthcare and others — together with their suppliers where the supply relationship creates system access.
What this means for you
If you supply a designated operator, expect your security and incident posture to become a contractual requirement. If you are designated, you need a documented security management plan, incident reporting capability, and evidence of both.
The penalty exposure
Up to HK$5,000,000 for specified operator offences, with up to HK$100,000 per continuing day for certain offences.
Designation does not arrive on a fixed calendar — the Commissioner may designate an operator at any time. If you are in a listed sector, or you supply one, treat the obligation as effective now and record your position before the question is asked.