Key point: The Securities and Futures Commission's Large Firm AI Readiness Survey, published on 2 November 2026, finds that large licensed groups already use artificial intelligence widely, and that more than half already allow agentic tools to plan and act with limited human direction. The constraint is not whether to adopt these tools, but whether a person can still see, challenge and stop a system once it acts across a workflow. For licensed financial issuers, that test now sits inside the official texts around the survey. For other Hong Kong-listed issuers already using AI, it arises under directors' existing duty of care, skill and diligence. The survey covers 20 large financial groups. The findings should not be interpreted as representative of all SFC-licensed corporations, and must not be read as a picture of all Hong Kong-listed issuers.
On 2 November 2026 the Securities and Futures Commission (SFC) published its Large Firm AI Readiness Survey, based on fieldwork in July and August 2026. The same day, the Commission's chief executive, Ms Julia Leung, discussed the findings at Hong Kong FinTech Week 2026, and the Hong Kong Monetary Authority (HKMA) issued a Discussion Paper on Agentic A.I. Governance in the Banking Sector. They follow the HKMA's Supervisory Guidance for Responsible Adoption of Artificial Intelligence of 15 October 2026, and an address by the SFC's chairman, Dr Kelvin Wong, at the Hong Kong Chartered Governance Institute (HKCGI) Corporate Governance Conference on 18 September 2026.
Agentic AI, as the survey defines it, can autonomously plan and take actions to achieve an objective with limited human direction. Once such a system is connected to internal data, messaging, records or trading systems, a review that only approves the finished output, or that cannot be staffed as volume grows, does not tell a board what the system did along the way. This source set contains no new listing rule from The Stock Exchange of Hong Kong Limited on AI.
A large-firm survey is not a census of Hong Kong issuers
The survey covered 20 large financial groups: 12 large global firms, five large Chinese Mainland firms and three large online retail brokers, together with 78 affiliated licensed corporations. Taken together, they accounted for over 75% of the turnover of securities transactions reported by licensed corporations for the six months ended 30 June 2026. Figure 1 of the report puts the securities-turnover share at 75.3%. Percentages in the report are based, unless otherwise stated, on the 20 consolidated firm responses, with each firm accounting for five percentage points.
The SFC states that the findings should not be interpreted as representative of all SFC-licensed corporations. The figures describe this large-firm sample, not all licensed corporations, and must not be rewritten as a statement about all Hong Kong-listed issuers.
The HKMA guidance and discussion paper, and the Project SAGE announcement of 2 November 2026, apply to authorized institutions. Ms Leung's planned cybersecurity framework is a plan for licensed firms, not requirements already written into rules.
Adoption is already advanced; the friction is in governance
All 20 groups in the sample already use AI in back-office or support functions. Nineteen of the 20, or 95%, expect to increase AI use in the next 12 months: nine anticipate a significant increase and ten a more modest increase; the remaining firm considered it too early to say. Eighteen groups, or 90%, have already connected AI to internal systems; two operate standalone tools. Eighteen groups (90%) use or are evaluating frontier AI for cyber defence.
Eleven groups, or 55%, already allow agentic AI in a pilot or in production: six (30%) in production operations and five (25%) in controlled pilots or tests. The remaining nine are developing or considering such use. Sixteen of the 20, or 80%, expect further agentic AI adoption in the next 12 months.
When firms identified challenges in scaling their AI governance and risk-management frameworks, the most widely reported theme was scaling governance, lifecycle controls and inventories, named by 17 firms (85%). Thirteen firms (65%) cited skills, resources, accountability and organisational readiness. Twelve (60%) cited model validation, monitoring, explainability and human oversight. Eleven (55%) cited regulatory change and cross-jurisdiction alignment, and nine (45%) cited data, privacy, security and third-party or concentration risk.
Those answers say more than the adoption rates. In a sample where every firm already uses AI, and where most have already connected it to internal systems, the difficulty is no longer getting a tool into the firm. It is knowing what is in use, who owns it, and whether anyone can still supervise it as it scales.
An approval that cannot see the intermediate steps is not oversight
Human oversight, the survey says, also needs to remain meaningful without relying on manual review processes that become impractical as usage expands. An approval step designed for a handful of drafts can look like a control in a policy paper. It will not be one once a system can plan and act across connected internal systems, at a volume no reviewer can actually read.
Ms Leung put the same limit in operational terms. The SFC will provide additional guidance on agentic AI adoption as appropriate, building on the survey and the Sandbox++ trials, and will develop practical, principles-based guidance for applications that involve greater autonomy. Human review of every intermediate step is not realistic; the SFC's focus is preserving human accountability and oversight throughout the workflow. Agentic AI, she said, changes both the nature and the scale of risk: it can compound errors across multiple steps, take unauthorised actions and disrupt other firms in unintended ways. If the board only sees the last output, it does not see the steps in which those errors compounded, or the action that was never authorised. A signature at the end of that chain is not oversight. It is a record that someone was asked to accept responsibility for work they could not inspect.
Greater autonomy may start with low-impact, reversible workflows, for example selected back-office processes and surveillance. Client advice, portfolio decisions and market-facing execution require progressively stronger safeguards, and when a firm acts for clients the degree of autonomy should be commensurate with the risk.
The SFC describes its own stance as safety-first, human-anchored and collaboration-led, meaning, in the official wording, that clear responsibility must be preserved across end-to-end workflows as greater authority is delegated to AI.
On 15 October 2026 the HKMA replaced its 2019 high-level principles with the ART supervisory guidance: the board of an authorized institution should approve an AI strategy and risk appetite, each deployed use case needs an accountable owner, and effective human oversight is required. Institutions should upgrade policies and controls in a timely way; the document does not set a hard compliance deadline. The Financial Stability Board's Sound Practices for the Responsible Adoption of Artificial Intelligence, issued the same day and cited in the HKMA guidance, is international background, not Hong Kong hard law. On 25 August 2026 the Office of the Privacy Commissioner for Personal Data issued guidance on safeguarding personal data privacy in the use of agentic AI, a reminder that the question is broader than financial regulation.
Naming AI in a disclosure is not the same as being able to supervise it
For licensed financial issuers, the survey, Ms Leung's remarks and the HKMA's ART guidance and discussion paper set out what the supervisor is now asking of firms in its perimeter: as use expands, governance has to keep pace with autonomy. The discussion paper does not introduce binding supervisory requirements, is not a consultation on new rules, and creates no new obligations. Comments are invited until 1 February 2027. The same day's Project SAGE announcement is part of that exploratory work, not a new rulebook. Ms Leung's planned cybersecurity framework, with baseline requirements for licensed firms and enhanced requirements for higher-risk profiles, is a plan, not a requirement already in force.
For other issuers already using AI in research, documents, compliance or client communications, there is no new Exchange rule to wait for. The official bridge is Dr Wong's 18 September 2026 address. Citing HKCGI research, he noted that almost nine in 10 issuers reference AI in disclosures, but fewer than 20% report a structured governance framework with clear oversight roles, policies and lifecycle controls. Those figures are HKCGI's, as cited by the SFC chairman. They are not AMMO research, and they are not a finding of the SFC large-firm survey.
The gap is easy to misread as a documentation lag, as if the remainder need only add a policy page. A sentence in an annual report or an ESG report can name AI as a tool, a risk or an opportunity. It does not tell investors, or the board itself, who may approve a use, what the system is allowed to do, or how it will be watched over its life. Naming AI is a disclosure choice. Supervising it is an operating capability. Where the second is absent, the first can get ahead of what the board is actually in a position to stand behind.
Functions may be delegated; responsibility under section 465 cannot
Dr Wong placed the duty where company law already places it. Section 465 of the Companies Ordinance imposes a statutory duty of care, skill and diligence. Functions may be delegated; responsibility cannot. Applied to agentic AI, that distinction is sharp. A board may ask management, a vendor or an internal model to perform a function. It may not treat the delegation as a transfer of legal responsibility for the output, or for an action the system takes with limited human direction. If something goes wrong, the question remains what the directors knew, what they asked, and whether the controls were proportionate to the use they had allowed.
Every director, in his words, needs baseline AI literacy: not coding skills, but the ability to ask probing questions, identify material risks and test whether controls are proportionate. That is not a request that directors become engineers. It is the capacity to test whether oversight still means something: whether a person with enough information, time and authority can challenge, override or stop the system, and whether that arrangement will still function when the workflow scales. A manual review queue the organisation cannot staff is a process description, not a discharge of the duty.
For listed issuers more broadly, he pointed to HKCGI's five priorities: visibility of use, senior ownership, integration into enterprise risk management, human accountability and transparent reporting. A board can test those points now by asking which internal systems the tools can reach, who is accountable for the outputs and for any action the tools may take, and whether a person can still intervene once use scales. In the SFC sample, connections already include email or enterprise messaging and document or knowledge repositories, and in some cases customer data, compliance monitoring, or trading, order or portfolio systems. If the answers cannot be produced in one place, the board is being asked to supervise a capability it cannot see.
Key dates
25 August 2026: The Privacy Commissioner issued guidance on safeguarding personal data privacy in the use of agentic AI. 18 September 2026: Dr Kelvin Wong addressed the HKCGI Corporate Governance Conference. 15 October 2026: The HKMA issued its ART supervisory guidance, replacing the 2019 high-level principles; the Financial Stability Board published its sound practices the same day. July and August 2026: Fieldwork for the SFC survey. 2 November 2026: The SFC published the survey; Ms Julia Leung discussed the findings at Hong Kong FinTech Week 2026; the HKMA issued its discussion paper, with comments invited until 1 February 2027, and announced Project SAGE.
FAQs
1. Does the SFC survey describe all Hong Kong-listed issuers? No. It covers 20 large financial groups and 78 affiliated licensed corporations, which together accounted for 75.3% of securities turnover reported by licensed corporations for the six months ended 30 June 2026. The SFC states that the findings should not be interpreted as representative of all SFC-licensed corporations. They should not be rewritten as a statement about all Hong Kong-listed issuers.
2. Has the Exchange introduced a listing rule on AI? Not on the official sources used for this article. This set of texts does not impose a new listing obligation that boards must adopt a specified AI framework. For issuers that are not licensed financial institutions, the official bridge is directors' existing duty under section 465 of the Companies Ordinance, as discussed by Dr Wong, together with the governance priorities he attributed to HKCGI research.
3. What does the SFC mean by agentic AI? Note 1 of the survey defines agentic AI as AI that can autonomously plan and take actions to achieve an objective with limited human direction. In the sample, 11 of the 20 groups already allow such use in a pilot or in production, of which six have put it into production operations.
4. Is the HKMA discussion paper a new rule for banks, or for listed issuers generally? Neither. The paper applies to the banking sector and, by its own wording, does not introduce binding supervisory requirements, is not a consultation on new rules, and creates no new obligations. Comments are invited until 1 February 2027. The ART guidance of 15 October 2026 sets expectations for authorized institutions. It is not a listing rule for issuers outside that perimeter.
5. If a listed company already uses AI for research, documents, compliance or client communications, where should the board begin? With whether it can still supervise the uses it has already allowed: which internal systems the tools can reach, who is accountable for the outputs and for any permitted actions, and whether a person can still intervene as use scales. If those answers are not available in one place, the board is being asked to oversee a capability it cannot see.
Conclusion
Large licensed groups in the SFC sample are already using AI, already connecting it to internal systems, and in many cases already allowing agentic tools to plan and act. The figures describe that sample only. What travels beyond it is a narrower test: whether the board can still see the uses it has allowed, name the person responsible, and intervene before a system that can plan and act has moved beyond anyone's view. Directors do not need a new listing rule before they can apply that test. Company law already requires them to.
Edited / written by: Amanda Cheung, Founder, AMMO Group
