Regulatory tracker
Every instrument that applies to Hong Kong and Macau organisations, with its issuing body, date and status. Reviewed monthly.
| Instrument | Body | Date | Status |
|---|---|---|---|
| Model Personal Data Protection Framework | PCPD | 2024-06-11 | Voluntary guidance |
| Checklist on Generative AI by Employees | PCPD | 2025-03-31 | Voluntary guidance |
| Circular on GenAI in customer-facing applications | HKMA | 2024-08-19 | Supervisory expectation |
| Circular on generative AI language models | SFC | 2024-11-12 | Supervisory expectation |
| Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) | HKSAR | 2026-01-01 | Mandatory |
| ISO/IEC 42001:2023 | ISO/IEC | 2023-12-18 | Voluntary, certifiable |
| ISO/IEC 27701:2025 | ISO/IEC | 2025-10-14 | Transition to 31 Oct 2028 |
| Lei n.º 8/2005 (Macau) | Macau PDPB | 2005-08-22 | Mandatory |
| EU AI Act | European Union | 2024-08-01 | Phased 2026–2027 |
Macau has no separate AI-specific regime; the PDPB publishes AI and privacy material expressly marked non-binding. Verify instruments before citing them.
Want this mapped to your organisation?
We produce a scoped applicability note for your sector and your systems.