Abstract: For AI to support personalised learning effectively, Hong Kong needs to translate the principles of learning data portability, interoperability and ownership into practical governance arrangements. This article proposes three levels of action: a shared checklist to help schools assess suppliers; standard contracts developed by school sponsoring bodies to reduce duplicated work; and voluntary certification established by the education sector and professional bodies to support product evaluation. While preserving school autonomy and market choice, Hong Kong can begin building common rules through guidance, contracts and pilot schemes, supported by an education data dictionary and staff training in data literacy. Progress need not wait for dedicated legislation.
In our previous article, published in Ming Pao on 27 August 2026, we noted that artificial intelligence (AI) is gradually entering Hong Kong’s classrooms. Yet delivering personalised learning at scale requires more than adopting increasingly sophisticated tools: it depends on whether learning data can be retained, integrated and used over time. Schools and AI platforms currently use their own data formats and standards. When students change schools, move to the next stage of education or switch platforms, the learning records they have accumulated often cannot follow them, creating “data silos”. Hong Kong should therefore progressively establish three principles—data portability, interoperability and data ownership—to enable AI to help teachers understand students’ learning needs over time and bring personalised learning into the classroom. The principles are easy enough to understand. The real difficulty is how to put them into practice within Hong Kong’s existing institutional framework.
Imagine a school that has just received a HK$500,000 grant and is preparing to purchase an AI learning platform. The supplier demonstrates automated marking, personalised exercises and learning analytics. Naturally, the school asks about price, accuracy and ease of use for teachers. But when the discussion turns to data governance, the answers often become vague: “We collect only the data we need” or “We follow industry security standards.” These assurances sound reasonable, but they leave the most important questions unanswered.
Exactly what data does the platform collect? If a student changes schools, or the school switches platforms, can existing records be exported in a commonly used format? May the supplier use students’ work to train AI models? Can subcontractors access the data? When the contract ends, will the data be returned or deleted?
Governing AI learning data requires expertise in education, law, information technology, information security and data management. Expecting every school to research contractual terms, vet suppliers and assess technical standards effectively means asking each school to establish its own specialist team.
Hong Kong has government, aided, Direct Subsidy Scheme and private schools. Most public sector schools are operated by school sponsoring bodies, within a system that values school-based management and autonomy. Schools choose products according to their teaching needs. This differs from Singapore’s approach, where the government has established a unified national platform supported by centralised procurement and approval.
Diversity of choice is one of Hong Kong’s strengths. Without common rules, however, more choice can mean greater fragmentation of data. The solution should neither add another layer of central approval above schools nor leave every school to shoulder the entire responsibility. Instead, Hong Kong should build shared governance capacity at three levels, drawing on its existing institutions.
Step One: Help Schools Ask the Right Questions
The first level begins with procurement. The Hong Kong Future Economy Institute’s report, AI Applications and Data Governance in Hong Kong Primary and Secondary Schools, sets out ten frequently asked questions on school data governance. These cover the purposes of data collection, storage and security, restrictions on use, data ownership, export and deletion, transparency, interoperability and effectiveness, with accompanying points to consider. The aim is not to turn principals into privacy lawyers or data engineers, but to give schools a common language when they sit down with suppliers. If a supplier says it collects “only necessary data”, the school can ask for an itemised list of data fields and their educational purposes. If the supplier says data can be exported, the next questions should be whether the format is commonly used and whether another platform can read it.
As more schools make the same demands, the market will change too. Support for data export, restrictions on secondary use and clear arrangements for the end of a contract can gradually become basic requirements for suppliers to compete, rather than additional requests from individual schools. Procurement is more than buying a tool; it can also be the first step towards establishing market rules.
Step Two: Ensure That Schools Do Not Have to Start from Scratch
A checklist can help schools ask the right questions, but it may not be enough to enable every school to negotiate a sound contract on its own. Many governance costs are fixed: whether a school has 500 students or 1,000, it still needs to vet suppliers, review contractual terms and establish data management procedures. Repeating this work in every school wastes resources and risks producing incompatible standards.
Hong Kong’s existing system of school sponsoring bodies offers a solution at the intermediate level. Around one-fifth of sponsoring bodies—the larger organisations—currently manage roughly two-thirds of primary and secondary schools. They already provide administrative and professional support to their schools, acting as an intermediary between the government and individual schools. They could go further by developing standard contracts for AI platforms, with common provisions on data ownership, export formats, restrictions on suppliers’ use of data, minimum security requirements and the return of data when contracts end.
In the United States, for example, A4L’s Student Data Privacy Consortium has introduced a national standard contract. Once a supplier signs it, other school districts can use the same agreement. The initiative has facilitated more than 220,000 agreements to date. Hong Kong’s larger school sponsoring bodies could similarly launch pilot schemes, so that their schools do not have to begin with a blank page every time.
Step Three: Build Trust Through Certification
Even with a shared set of questions and standard contracts, schools still need to choose among many products. At the third level, school sponsoring bodies, the education sector, universities and professional bodies could jointly establish an independent, non-profit organisation to provide voluntary certification for education technology products. Drawing on Australia’s Safer Technologies 4 Schools initiative, it could assess products against criteria covering privacy, security and responsible AI.
Certification is fundamentally different from a government whitelist. A whitelist determines what schools are allowed to use; voluntary certification provides a trusted quality mark that helps schools judge whether a product meets basic requirements, while leaving the final choice to schools according to their teaching needs. This can reduce the cost of individual assessments while preserving competition and room for school-based innovation.
Begin with Administrative Measures
Some may ask whether legislation should come first, given the importance of student data. Our research indicates that Hong Kong need not wait for dedicated legislation at this stage, nor does it necessarily need a central platform or approval system. The existing Personal Data (Privacy) Ordinance already provides a basic legal framework for data collection, use and security. The most urgent task is to translate principles such as portability, interoperability and control over data into common rules for education data governance.
International experience also shows that administrative measures are often the starting point. In a comparison of 29 education systems, the Organisation for Economic Co-operation and Development (OECD) found that only around one-third required digital education platforms to adopt specified technical standards through regulation; just seven prescribed standards for data portability. The UK’s approach is more suited to Hong Kong’s circumstances. Rather than selecting products for schools, the government uses guidance on education technology procurement and generative AI to require suppliers to explain their data collection practices, privacy protections and security measures, helping schools understand data flows and risks.
Starting with administrative measures does not mean rejecting legislation. AI technologies and products are still changing rapidly. Guidance, standard contracts and pilot schemes can be updated more promptly, while allowing the education sector to gain practical experience. Once common standards and market practices have matured, the government can determine which core requirements should be enshrined in law, giving the regulatory framework a firm foundation in practice.
Hong Kong’s Education Bureau can also put two foundations in place in parallel: a territory-wide education data dictionary that standardises the definitions, formats and codes of key data, and data literacy training under the Blueprint for Digital Education in Primary and Secondary Schools, so that every school has at least one designated staff member to coordinate governance. Neither measure needs to wait for new legislation, and both can immediately reduce the cost of schools having to find their own way.
The next time a school sits down with a supplier, its questions should go beyond which AI model is smarter or which features are more attractive. It should ask whether students’ data can be taken with them, whether different platforms can exchange and use that data, and whether the school can decide how it is used. When schools know what to ask, sponsoring bodies have the capacity to negotiate, and the education sector has a mechanism for evaluating products, Hong Kong can gradually establish common rules while preserving autonomy and innovation. Governance of AI learning data does not have to begin with a new law. It can begin with a checklist, a standard contract and a trusted certification mark.
