Consumer Protection in respect of Use of Generative Artificial Intelligence

Our Ref: B1/15C B9/67C 19 August 2024 The Chief Executive All Authorized Institutions Dear Sir / Madam, Consumer Protection in respect of Use of Generative Artificial Intelligence I am writing to provide authorized institutions with a set of guiding principles in respect of use of generative artificial intelligence (“GenAI”) in customer-facing applications from consumer protection perspective. In view of the development of big data analytics and artificial intelligence (“BDAI”), the Hong Kong Monetary Authority (“HKMA”) issued a set of guiding principles in the circular “Consumer Protection in respect of Use of Big Data Analytics and Artificial Intelligence by Authorized Institutions” dated 5 November 2019 (“2019 BDAI Guiding Principles”), focusing on four major areas, namely governance and accountability, fairness, transparency and disclosure, and data privacy and protection (see Annex 1 for a handy summary1 ). These guiding principles have demonstrated to be beneficial to banks and customers, and helped promote the healthy development of BDAI in the Hong Kong banking sector, as seen in the proliferation of use cases of BDAI revealed in a recent survey conducted by the HKMA (see Annex 2 for a summary of the survey results). More importantly, the 2019 BDAI Guiding Principles have also helped enhance customer confidence in using banking services adopting BDAI. In recent months, the HKMA notes an increasing interest of the banking sector in adopting GenAI in their operations. GenAI is a form of BDAI that enables generation of new content such as text, image, audio, video, code or other media,

1 For guidance on risk management of authorized institutions in respect of the use of artificial intelligence (including GenAI), please refer to the HKMA circular “High-level Principles on Artificial Intelligence” dated 1 November 2019, which will be updated from time to time in the light of market development and practical experience.

– 2 – based on vast amounts of data. At this moment, adoption of GenAI in the banking sector is still at an early stage, with most of the current applications focusing on improving banks’ operational efficiency, such as internal chatbots and coding. Nonetheless, the ability of GenAI in content-creation means that GenAI could be more extensively adopted by the banking sector in customer￾facing activities. Potential applications include but are not limited to customer chatbots, customised product and service development and delivery, targeted sales and marketing, and robo-advisors in wealth management and insurance. The use of GenAI in customer-facing activities will have consumer protection implications. GenAI, being a subfield of BDAI, basically shares a set of similar risk dimensions. As such, with respect to consumer protection in customer-facing applications, the HKMA expects all authorized institutions to apply and extend the 2019 BDAI Guiding Principles to the use of GenAI and continue to adopt a risk-based approach commensurate with the risks involved. Having said that, since GenAI uses complex models, potential risks such as lack of explainability and hallucination (i.e. generating outputs that seem realistic but are factually incorrect, incomplete, lack important information, or lack relevance to the context) could cause even more significant impact on customers. The HKMA has therefore set out the following additional principles under each of the four major areas aiming to ensure appropriate safeguards for consumer protection are in place when GenAI is adopted for customer-facing applications.

1. Governance and accountability The board and senior management of authorized institutions should remain accountable for all the GenAI-driven decisions and processes, and have thoroughly considered the potential impact of GenAI applications on customers through an appropriate committee under the governance, oversight and accountability framework of authorized institutions. They should ensure, among others: (a) the scope of customer-facing GenAI applications is clearly defined such that GenAI usage would not be used in unintended areas; (b) proper policies and procedures are developed on the responsible use of GenAI in customer-facing applications and related control measures are put in place; and (c) proper validation of the GenAI models are put in place, in particular, during the early stage of deploying customer-facing GenAI applications, authorized institutions should adopt the “human-in-the-loop” approach, i.e. having

– 3 – human to retain control in the decision-making process to ensure the model￾generated outputs are accurate and not misleading. 2. Fairness Authorized institutions should ensure GenAI models produce objective, consistent, ethical and fair outcomes to customers, which include ensuring, among others: (a) the model-generated outputs would not lead to unfair bias or disadvantage against any customers or groups of customers. Authorized institutions should give consideration to different approaches that may be deployed in the GenAI models, such as anonymising certain categories of data, deploying datasets that are comprehensive and fair representation of the population, making adjustments to remove bias during the validation and review process (e.g. by adopting “human-in-the-loop”), etc.; and (b) during the early stage of deploying customer-facing GenAI applications, customers are provided with the option to opt out of using GenAI and request human intervention on GenAI-generated decision at their discretion as far as practicable. Where an “opt-out” option cannot be provided for some reasons, authorized institutions should provide channels for customers to request for review of the GenAI-generated decisions. With the continuous evolution of technology, other measures that can yield the same effect of “opt-out” option will also be acceptable. 3. Transparency and disclosure Authorized institutions should provide an appropriate level of transparency to customers regarding their GenAI applications through proper, accurate and understandable disclosure. Accordingly, they should disclose the use of GenAI to customers, and, among others, communicate with customers on the use and purpose of adoption of the GenAI models as well as the limitations of such models, in order to enhance customers’ understanding of the model-generated outputs. 4. Data privacy and protection Authorized institutions should implement effective protection measures to safeguard customer data. In particular, if personal data are collected and processed by GenAI applications, authorized institutions should comply with the Personal Data (Privacy) Ordinance and pay due regard to relevant recommendations and good practices issued by the Office of the Privacy

– 4 – Commissioner for Personal Data (“PCPD”) related to GenAI, including, among others, the “Guidance on the Ethical Development and Use of Artificial Intelligence” published on 18 August 2021 and the “Artificial Intelligence: Model Personal Data Protection Framework” published on 11 June 2024. Proactive use of BDAI and GenAI in enhancing consumer protection BDAI, in particular GenAI, has the potential for product-feature optimisation and customer segmentation to the individual level, thereby allowing banks to be precise in designing and promoting specific products for specific customers in an efficient and customised manner, posing business potential and opportunities. Along similar logic, authorized institutions are encouraged to explore the use of BDAI, including GenAI, in enhancing consumer protection. Some examples may include identification of customers who are vulnerable and require more protection and education; identification of customers who may need more information or clarifications to better understand product features, risks, and terms and conditions in the disclosure; or issuance of fraud alerts to customers engaging in transactions with potentially higher risks. Should you have any questions regarding this circular, please feel free to contact Ms Cherry Yip on 2597-0495 or Mr Michael Leung on 2878-1186. Yours faithfully, Alan Au Executive Director (Banking Conduct) c.c. The Chairman, The Hong Kong Association of Banks The Chairman, The DTC Association Secretary for Financial Services and the Treasury (Attn: Mr Justin To)