Financial institutions have been deploying AI for years with tools like credit scoring models, fraud detection algorithms, and chatbots. The Hong Kong Monetary Authority's introduction of the Accountability, Resilience, and Trust (ART) framework signals a shift. Regulators are no longer passive; they're setting expectations for how you govern, test, and explain these systems.
The myths around AI governance persist because they're rooted in outdated assumptions: that AI is just another IT project, that compliance can wait until the technology matures, and that existing risk frameworks automatically cover algorithmic decision-making. They don't. Here's what you need to know.
Myth 1: Your existing IT governance covers AI systems
Reality: AI introduces risks that traditional IT governance doesn't address.
Your change management process might track software deployments, but does it evaluate whether a model's training data reflects protected characteristics? Does your vendor risk assessment ask how a third-party algorithm makes decisions, or just whether the API meets uptime SLAs?
The HKMA's framework calls for governance structures with clear ownership and decision-making authority over AI adoption. Someone needs to answer when a loan denial algorithm starts rejecting applicants at different rates across demographic groups. Your IT steering committee probably isn't equipped to evaluate that question.
You need governance that covers model development lifecycles, data lineage, algorithmic bias testing, and explainability requirements. ISO/IEC 42001, the AI management system standard, provides a starting framework. But you'll need to map it to your existing controls, not assume your ISO 27001 certification automatically extends to AI.
Myth 2: Compliance can wait until regulations are finalized
Reality: The regulatory window is already closing, and waiting puts you behind.
By the time a framework like ART becomes mandatory, you're already late. Building effective AI governance takes months: defining roles, establishing testing protocols, creating model inventories, and training staff on bias detection. If you start when the regulation drops, you're implementing under deadline pressure with no room for iteration.
The HKMA issued updated Supervisory Guidance for Responsible Adoption of Artificial Intelligence alongside the ART framework. That guidance focuses on three pillars: effective governance and accountability, proportionate risk management, and trust and transparency. These aren't suggestions for future consideration. They're current supervisory expectations.
Early adopters gain something more valuable than compliance: they learn what actually works. You discover that your data scientists can't explain model decisions in plain language. You find gaps in your vendor contracts around algorithmic accountability. You realize your incident response plan doesn't cover model drift. Fixing these issues before an exam is cheaper than explaining them during one.
Myth 3: AI risk management is a technical problem
Reality: The hardest AI risks are governance and accountability gaps, not technical failures.
Your data science team can probably build a robust model. They understand overfitting, validation techniques, and performance metrics. What they likely can't do is explain to your board why the model denied a commercial loan, document the fairness testing protocol in language an examiner understands, or define the threshold at which model performance degradation triggers human review.
The ART framework's emphasis on resilience isn't just about system uptime. It's about operating safely, failing safely, and recovering effectively. That requires cross-functional coordination: legal teams defining acceptable use cases, compliance officers mapping algorithmic decisions to regulatory obligations, and risk managers setting impact tolerances for model errors.
Consider a fraud detection model. The technical risk is a false negative that lets fraud through. The governance risk is deploying a model that flags legitimate transactions from specific merchant categories at higher rates, creating fair lending exposure you don't discover until a regulatory exam. The second risk doesn't show up in your model performance metrics.
Myth 4: Transparency means publishing your algorithms
Reality: Transparency is about explainability at the decision level, not code disclosure.
When regulators talk about transparency in AI, they don't want your source code. They want to know: Why did this specific decision happen? What factors drove it? Can you explain it to the affected customer? Can you recreate the logic during an examination?
The ART framework prioritizes fairness, transparency, explainability, and privacy. That means you need documentation showing how a model reaches decisions, not just that it performs within acceptable error rates. If your credit model uses 200 variables, can you identify which five drove a specific denial? If not, you have a transparency problem.
This is where many institutions discover their vendors can't help them. The contract says the model meets fair lending requirements, but the vendor won't provide decision-level explanations. You're accountable for decisions you can't explain. That's not a technical gap, it's a vendor management failure.
Myth 5: One-time validation is sufficient for AI systems
Reality: AI models require ongoing monitoring because they degrade over time.
You wouldn't validate a control once and never test it again. AI systems need the same continuous assurance approach, but most institutions treat model validation as a deployment checkpoint rather than an ongoing control.
Models drift. Training data becomes stale. Real-world conditions change. A fraud model trained on pre-pandemic transaction patterns might perform poorly on current behavior. A credit model built when interest rates were near zero needs recalibration. If you're not monitoring for these shifts, you're operating with controls that have failed without triggering any alert.
The HKMA's focus on proportionate management of unique AI risks means your monitoring intensity should match the model's impact. A chatbot that answers balance inquiries needs different oversight than an underwriting algorithm making million-dollar credit decisions. But both need ongoing validation, the scope and frequency differ, not the requirement.
What to do instead
Start with an inventory. You can't govern what you don't know exists. Document every AI system in production, in development, and under vendor management. For each one, identify the business owner, the risk owner, and the technical owner. If those are all the same person, you have an accountability gap.
Map your existing risk framework to AI-specific risks. Where does your third-party risk assessment address algorithmic accountability? How does your change management process evaluate model updates? Which committee approves new AI use cases? If the answers are "nowhere," "it doesn't," and "unclear," you're building governance from scratch.
Establish testing protocols before you need them. Define what constitutes acceptable bias in model outputs. Set performance thresholds that trigger human review. Create incident response procedures for model failures. These decisions are easier to make in a conference room than during a regulatory examination.
The ART framework isn't unique to Hong Kong. It reflects a global regulatory trend toward explicit AI governance expectations. Whether you're subject to HKMA supervision or not, the principles apply: clear accountability, resilient operations, and transparent decision-making. The institutions that treat these as optional will spend the next few years playing catch-up.
