Introduction

Artificial intelligence (“AI”), including generative AI (“Gen AI”) tools such as ChatGPT, Copilot and DeepSeek, have become fixtures in modern Hong Kong workplace, used by employees across sectors to draft correspondence, summarise documents, analyse data, generate marketing content and more. A compliance review by the Office of the Privacy Commissioner for Personal Data (“PCPD”) published in May 2026 found that 95% of the 60 organizations surveyed used AI in day-to-day operations, up 15 percentage points from 2025, and that AI use is becoming an entrenched part of business operations rather than an experimental add-on.

While Gen AI may offer genuine productivity gains, its casual or unsupervised use in the workplace can carry legal risks for employers and employees alike, some of which are not immediately obvious at the point of use. This article explores three main areas of particular concern under Hong Kong law: (1) breach of confidentiality and data privacy obligations, (2) legal liability arising from inaccurate AI output, and (3) disciplinary risk and the proper scope of employer monitoring of AI use at work. Both employers and employees should understand these risks as AI adoption accelerates across Hong Kong workplaces.

1.    Confidentiality and data privacy risks

Employees may owe contractual and common law duties of confidentiality to their employers. Where an employee inputs confidential business information, client data or trade secrets into a public Gen AI chatbot, this may constitute an unauthorised disclosure, since a significant number of Gen AI platforms retain user prompts and uploaded files to further train their underlying models. The well-publicised 2023 incident in which employees at Samsung Electronics shared proprietary and sensitive internal source code and confidential meeting transcripts to ChatGPT, resulting in leakage of that code, illustrates how quickly such disclosures can escalate into a data breach.

Equally, employer companies may owe contractual and common law duties of confidentiality to their clients. Breaches by employees that cause their employers to breach such duties owed to their clients may result in claims by those clients.

Where personal data is involved, the Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”) is engaged. The PDPO is technology-neutral and principle-based, where its six Data Protection Principles apply equally to data inputted into AI tools as to any other form of processing. Critically for employers, section 65(1) provides that any act done by an employee in the course of his employment is treated as having been done by the employer as well, whether or not the employer had knowledge of or approved the act. This means that an employer, as the “data user”, can be held liable for an employee’s unauthorised input of client or personal data into a Gen AI tool even where the employer never sanctioned or knew of that specific use.

Employers do have a statutory defence under section 65(3) if they can show they took such steps as were “reasonably practicable” to prevent the employee from committing the contravention, but this places a proactive and ongoing burden on employers to implement, communicate and enforce a clear AI usage policy, rather than simply prohibiting misuse on paper. Employers should also note that section 65 does not extend to criminal proceedings, so a director or senior officer who consents to or connives in a contravention involving AI may face criminal liability.

In March 2025, the PCPD published the “Checklist on Guidelines for the Use of Generative AI by Employees” (“PCPD Checklist”), which recommends that employers set out clear rules on the scope of permissible Gen AI use, what data may be inputted, permissible storage and retention of AI outputs, and incident reporting obligations. The PCPD’s 2024 “Artificial Intelligence: Model Personal Data Protection Framework” goes further, recommending that employers establish a dedicated AI governance structure, conduct privacy impact assessments before deploying AI tools, and maintain an AI Incident Response Plan to detect and remediate any misuse. Employers who fail to adopt such measures risk not only regulatory scrutiny but also exposure to the statutory liability described above, while employees, for their part, should not treat the absence of a formal policy as tacit permission to input sensitive information into public AI tools, since the underlying common law and contractual duties of confidentiality continue to apply regardless. Pending the introduction of clear internal rules, employees should seek guidance from management before inputting any client, personal or proprietary information into a Gen AI tool.

2.    Legal liability for inaccurate AI output

Employees who blindly trust and use text or data from Gen AI without checking can cause legal trouble or financial damage for themselves as well as their employers if the information is wrong or unfair. The PCPD Checklist emphasise that employees using Gen AI bear responsibility for verifying the accuracy of AI-generated outputs through proofreading and fact-checking, and for identifying and correcting biased or discriminatory content before it is used or published. This obligation is of particular importance because Gen AI tools are known to “hallucinate”, producing plausible-sounding but factually incorrect information, case citations or figures

Where AI-generated content influences business decisions, disclosures or filings, the consequences may extend well beyond reputational harm for the employer, potentially exposing the company to contractual, regulatory or other legal liability if flawed AI output is relied upon in client-facing work, financial disclosures or public statements. At the employee level, failure to comply with an employer’s internal AI-use policy, including requirements to verify outputs, redact confidential information, or label AI-generated content, may give rise to disciplinary action. In serious cases, such non-compliance may also amount to a breach of the employee’s implied duties, such as the duties of fidelity and good faith, and the duty to exercise reasonable skill and competence. In exceptional circumstances, particularly where the employee occupies a senior role or a position of trust and confidence, misuse of AI that causes material harm to the company may also give rise to a breach of fiduciary duty.

3.    Disciplinary risk and monitoring of AI use at work

Section 9 of the Employment Ordinance (Cap. 57) (“EO”) permits an employer to summarily dismiss an employee, without notice or payment in lieu, where the employee wilfully disobeys a lawful and reasonable order, misconducts himself in a manner inconsistent with the due and faithful discharge of his duties, is guilty of fraud or dishonesty, or is habitually neglectful in his duties. Breaching a clear, lawful internal AI usage policy, for example by inputting client data into an unauthorised Gen AI tool despite an express prohibition, could constitute wilful disobedience of a lawful and reasonable order, or misconduct inconsistent with the faithful discharge of duties, particularly where it results in a breach of confidence. Moreover, conduct need not be dishonest to justify summary dismissal; it is sufficient if it is conduct of such a grave and weighty character as to amount to a breach of the confidential relationship between employer and employee, and breach of confidence in disclosing trade or other secrets has historically justified summary dismissal.

For employers, however, the ability to detect and act on such misconduct largely depends on lawful monitoring of AI use in the workplace. Employers may, for instance, log prompts, uploads and other inputs made through workplace AI accounts to identify unauthorised disclosure of confidential or personal data. Such monitoring must nevertheless comply with the PDPO and the PCPD’s guidance on employee monitoring. In particular, it should serve a clear and previously notified business purpose, be proportionate to that purpose, and avoid unnecessary intrusion into employees’ private affairs or matters unrelated to work.

In Chan Long Ning Christine v Dragon Guard Security Ltd HKDC 449, the Court confirmed that workplace surveillance is lawful where it is fair and proportionate, and that there is no overarching cause of action for “invasion of privacy” in Hong Kong outside the framework of the PDPO. The decision should not, however, be regarded as permitting indiscriminate monitoring of employees. An employer that monitors AI usage without adequate notice, or collects information beyond what is reasonably necessary to achieve a legitimate business purpose, may itself risk contravening the PDPO. Employers should therefore ensure that any AI monitoring framework is clearly documented, proportionate and properly communicated to staff in advance, so that misuse can be legitimately identified and acted upon, without the employer's own monitoring practices becoming a separate source of liability.

Takeaways

AI is here to stay and has become part of Hong Kong workplace. On 21 August 2026, our Partner Mr Michael Szeto jointed RTHK Radio 1’s programme “Free as the Wind” (《講東講西》) for a discussion with Mr Joshua Chu, lawyer, lecturer & co-chair of Hong Kong Web3 Association, on legal issues surrounding robot companions including various legal issues of use of AI at workplace. For the programme, please click here.

Employers should not assume that issuing a brief AI policy discharges their obligations; the PDPO’s statutory liability regime and the PCPD’s Model Framework place an ongoing burden on employers to actively govern and monitor AI use, with a documented, reasonably practicable compliance system offering the best protection against vicarious liability.

Employees, in turn, should treat Gen AI tools as assistants rather than infallible sources, and strictly follow any internal AI usage policy issued by their employers. Where no such policy exists, a cautious approach on both sides, such as avoiding the input of confidential, personal or proprietary information, verifying all outputs before relying on them, and maintaining proportionate, transparent monitoring, remains the safest course pending further legislative and regulatory developments in this fast-moving area of Hong Kong law.

Navigating the vast and intricate web of employment laws and compliance risks tied to workplace AI can present a significant challenge for modern employers. As always, if in doubt, it is advisable to seek legal advice.