Hong Kong Boards Face AI and Cybersecurity Skills Gap as Technology Risks Grow

Hong Kong's largest listed companies are facing a significant gap in artificial intelligence and cybersecurity expertise at the board level, even as many companies identify these technologies as major business risks.

A new report from Grant Thornton Hong Kong found that fewer than 1% of directors at the city’s largest listed companies have dedicated expertise in artificial intelligence or cybersecurity. The findings come as businesses increasingly rely on AI systems while facing a growing range of digital security threats.

The firm's 15th annual Corporate Governance Review examined 100 major companies listed on the Hang Seng Composite Index. According to the report, 59% of the companies surveyed identified cybersecurity or AI as principal business risks.

However, only 11% had established specialised board committees responsible for overseeing digital threats and technology integration.

The figures point to a potential gap between recognising technology-related risks and having sufficient technical expertise at the highest level of corporate governance.

AI and cybersecurity becoming board-level risks

AI is increasingly being integrated into business operations, from customer service and software development to data analysis and automated decision-making. At the same time, organisations must manage risks involving sensitive data, access permissions, third-party AI tools and increasingly autonomous AI systems.

Cybersecurity risks are also becoming more closely linked to AI adoption. Companies deploying AI need to consider not only traditional threats such as malware, phishing and data breaches, but also whether AI systems have access to information and corporate systems beyond what is necessary for their tasks.

This makes oversight increasingly important at the board level, where major decisions about technology investments, risk management and corporate governance are made.

Grant Thornton Hong Kong's findings suggest that many companies recognise the importance of these risks but have comparatively limited specialist expertise among directors to oversee them. Barry Tong, head of advisory at Grant Thornton Hong Kong, described the situation as a disconnect between the risks companies acknowledge and the technical expertise available at the top of the organisation.

Governance requirements have also changed

The findings come despite changes to Hong Kong Exchanges and Clearing's corporate governance requirements introduced in 2025.

The updated standards included requirements related to director training and board skills matrices, alongside tighter limits on the number of boards a director can serve on. The changes were intended to strengthen corporate governance and improve transparency around board capabilities.

However, the report indicates that formal governance requirements have not necessarily translated into widespread specialist expertise in AI and cybersecurity at board level.

The security implications of the skills gap

For cybersecurity teams, the issue goes beyond whether directors understand the technical details of a particular AI model or security product.

Board-level understanding can influence how organisations approach security budgets, incident response, data protection, third-party technology risks and AI deployment policies.

As AI becomes capable of taking actions rather than simply generating information, organisations may also need stronger controls around identity, permissions, monitoring and accountability. An AI system with access to internal applications or sensitive information can create a different type of security exposure from a conventional software tool.

This means cybersecurity and AI governance are increasingly interconnected. Organisations may need to establish clear responsibilities over who can approve AI deployments, what data AI systems can access, how their activity is monitored and what happens when an automated system behaves unexpectedly.

A growing challenge for corporate leadership

The Hong Kong findings reflect a broader challenge facing companies as AI moves from an experimental technology into mainstream business operations.

Having AI and cybersecurity expertise at operational levels does not necessarily mean that the same expertise exists among those responsible for corporate oversight. For boards, understanding the technology's risks may become increasingly important alongside traditional financial, legal and operational expertise.

As companies continue adopting AI, the ability to identify and govern technology risks could become an increasingly important part of corporate cybersecurity strategy.

For organisations, the question is no longer simply whether they are using AI, but whether their governance structures are equipped to understand and manage the security risks that come with it.