The Office of the Privacy Commissioner for Personal Data (PCPD) on Monday issued a checklist to guide organisations in regulating their employees’ use of generative artificial intelligence.

Privacy Commissioner Ada Chung said the checklist is important as the secure use of AI is an essential part of national security.

“In the areas of technological development and industrial innovation, the country has all along stressed the equal importance of development and safety,” she said.

“In order to implement the spirit of the Two Sessions… and in order to facilitate the safe and healthy development and use of AI in Hong Kong, my office published the checklist on guidelines for the use of generative AI by employees today.”

Organisations must specify tasks in which employees are allowed to use AI, with examples including drafting documents, summarising information and creating video and audio content.

They should also clearly define which AI tools employees can use, which may include publicly-available or internally developed systems.

The devices that can access the AI tools should also be regulated, the PCPD noted, as organisations are advised to establish clear distinctions between work devices and personal devices.

Organisations should also spell out the penalties or review mechanisms for employees who don’t adhere to the guidelines.

Chung said organisations need to be particularly careful if they want to train their AI models with data from clients.

“For example, when you first collect the data, you did not tell them that it would be used for training AI but subsequently you want to [do so],” she said.

“And you will need to obtain the customer's expressed and voluntary consent to do that under the Privacy Ordinance.”

The full checklist of the newly released guidelines is available for download on the PCPD’s website.

The office said a hotline has been set up for organisations to make enquiries about how to use AI safely and properly.

Chung also pointed out that the privacy watchdog has initiated compliance checks on 60 private-sector organisations and government departments to assess how responsibly they are using AI.

The results will be finalised by summer.