Hong Kong organisations need two layers of training before an agent acts: literacy for everyone who works beside agents, and certified competence for the people who approve what agents do. The deciding factor is authority. Anyone who can release a held payment, change a customer record or answer a complaint on an agent's draft must be trained and evidenced first.
What should Hong Kong staff learn before an agent acts?
Training should follow the work the agent will actually do, not a generic course on how models work. Five things matter most:
- Depth. An agent is certified to one depth, and each action needs its own: 1 read, 2 draft, 3 execute routine work within bounds, 4 move money or take hard-to-undo actions, 5 coordinate other agents. Staff must know which depth an agent holds and what the task in front of them needs.
- The verdict. Every action ends allowed, held, refused or withheld, and the verdict names the bound that decided. A reviewer who cannot read that line cannot judge the draft.
- Held actions. A held action waits for a named person. That person needs to know what to check before releasing it, and that releasing it makes the decision theirs.
- Where facts came from. A sealed fact from the system of record outranks a forwarded email. An external claim cannot authorise a payment, however urgent it looks.
- Both working languages. Many Hong Kong teams serve customers in Chinese and English. A reviewer must check the draft in the language the customer used, not only a translation of it.
Which Hong Kong rules shape the training?
Hong Kong has no single statute for AI agents. Oversight comes through the existing regulators: the HKMA for banking, the SFC for securities and futures firms, and the PCPD for personal data. The Personal Data (Privacy) Ordinance sets principles on collecting, using, keeping accurate, retaining and securing personal data, and those principles apply when an agent reads or drafts with customer records.
In practice this means the people overseeing agents must understand what personal data an agent touches and why. If you also serve customers in the EU, GDPR and the EU AI Act can reach you. The PDPO guide for staff who use AI agents covers the data side in more depth.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What may the agent do, and what stays with a person?
| Work | The agent may | Stays with a person |
|---|---|---|
| Customer onboarding | Read files and draft a summary (depth 2) | Accepting or declining the customer |
| Routine updates | Change an address within the customer's limits (depth 3) | Anything outside those limits |
| Payments | Prepare and hold a payment (depth 4 only if certified) | Releasing a held payment |
| Complaints | Draft a reply | Sending it and owning the outcome |
The table only works if the person in the right-hand column is trained. A held action approved by someone who does not understand depth is a rubber stamp.
What does this look like in a Hong Kong payments team?
Take a payments firm that uses an agent for KYC reviews. The agent reads identity documents and drafts a risk summary at depth 2. An analyst approves or rejects each file. Ninety days after its last certification run, the agent's certificate lapses unless it passes again. If a run clears no depth, the agent drops to depth 1 the same day.
An analyst who knows this reads the change in the workspace and adjusts the queue. One who does not keeps approving drafts that no longer arrive. The KYC analyst brief for payments in Hong Kong walks through that role in detail.
How do you evidence the training?
A supervisor or auditor will ask one question in many forms: was the person who approved this action competent to do so at the time? Answer it with a record that joins three things. The verdict and the approver come from the append-only record of agent decisions. The approver's credential, its number and its expiry come from a certificate anyone can check at source. Your policy states which credential each approval right requires.
Keep the record per person, per capability. A team lead in insurance operations, covered in the operations manager brief for Hong Kong insurers, needs different evidence from a claims reviewer. Compare how the same approach plays out in Singapore. The wider approach is set out in AI literacy and certification for people who work with agents.
Where the Academy fits
Pryme Intelligence Academy runs Foundations for everyone and the Operator track for people who review agent decisions. Operator ends in a written exam and a two-week practicum of real review decisions, signed off by a Pryme assessor. Certificates are issued through VerifyDoc.ai, so a supervisor can check any approver's credential and expiry by number or QR code.
Questions people ask
Do Hong Kong regulators require a specific AI qualification?
None of the regulators named here sets a specific AI credential. They expect firms to show that people with authority are competent, and a certificate tied to approval rights is a clear way to show it.
Should frontline staff get the same training as approvers?
No. Everyone near an agent needs literacy: depth, verdicts and where facts come from. People who release held actions need certified competence, tested on real decisions in their own work.
How often should training be refreshed?
Refresh whenever the agent's depth or bounds change, and at least when a person's certificate comes up for renewal. Agents re-certify every 90 days, so approvers should expect the workspace to change between their own renewals.