Hong Kong boards face AI and cybersecurity skills gap as 59% of firms flag major risks

Fewer than 1% of directors at Hong Kong's largest listed companies have dedicated AI or cybersecurity expertise, a Grant Thornton Hong Kong review found. The report says boards recognise technology as a major business risk but have made limited changes to strengthen oversight, while upcoming director turnover could create an opportunity to add digital specialists.

Editor: AI News 24x7 Published: 30 Sep 2026, 09:07 AM Updated: 30 Sep 2026, 09:07 AM

Hong Kong boards face AI and cybersecurity skills gap as 59% of firms flag major risks.

Hong Kong's largest listed companies are recognising artificial intelligence and cybersecurity as major business risks, but their boards have little specialist knowledge to oversee those challenges, a Grant Thornton Hong Kong review found.

The firm's 15th annual Corporate Governance Review examined 100 companies on Hong Kong's Hang Seng Composite Index. It found that fewer than 1% of directors have dedicated expertise in either AI or cybersecurity, highlighting a gap between the risks companies identify and the skills available at board level.

Risk recognition has outpaced board expertise

Cybersecurity or AI is viewed as a principal business risk by 59% of the companies surveyed. However, only 11% have created specialised board committees to supervise digital threats and technology integration.

The report puts the skills gap in more precise terms: 0.56% of directors have cybersecurity expertise, while 0.26% have specialist AI skills. Nearly 2-thirds of large-cap companies have no director with technical information technology or cyber expertise.

Barry Tong, head of advisory at Grant Thornton Hong Kong, said disclosure quality on Hong Kong Exchanges and Clearing (HKEX) had improved overall. He also pointed to a continuing disconnect between the risks companies acknowledge and the technical capability of their boards.

Ivan So, an advisory director at the firm, said many boards were still structured around capital allocation and traditional risk management. That model had supported stability, he said, but was not well suited to autonomous AI systems and increasingly sophisticated cyber threats.

Governance changes put pressure on boards

The shortcomings have continued despite updated HKEX Corporate Governance Code standards introduced last year. Those rules brought in mandatory director training, board skills matrices and tighter limits on the number of boards directors can serve on.

Board composition is nevertheless changing more quickly as companies prepare for HKEX's hard 9-year limit on independent non-executive director, or INED, tenures. Average INED tenure fell from 6.8 years in 2025 to 5.8 years in 2026.

Traditional professional backgrounds remain prominent. Executives with experience in finance, accounting, business and economics occupy 37% of board seats, according to the review. The findings suggest that board renewal has not yet translated into broad representation of digital and cyber expertise.

Female representation among directors increased slightly to 22%. That remains below European benchmarks of 34% to 40%, the report said, indicating that progress on board diversity has been gradual.

Turnover could create an opening for digital talent

Tong urged companies to use forthcoming director turnover to recruit people with stronger digital capabilities. He warned that weak expertise in emerging risk areas could expose companies to operational disruptions and investor scrutiny.

The review therefore presents board renewal as a practical opportunity for listed companies. As INED tenures change under the new limit, firms will have to decide whether replacement appointments continue to emphasise traditional experience or add expertise in AI, cybersecurity and information technology.

Conclusion

Grant Thornton's review identifies a clear mismatch in Hong Kong's listed-company boards: technology risks are widely recognised, but specialist AI and cybersecurity skills remain rare. Upcoming changes in INED tenure could give companies an opportunity to strengthen digital oversight.