AI in Hong Kong Schools: What IT Teams Need to Get Right

AI is arriving in Hong Kong classrooms faster than most school IT setups are ready for it — and whether it works depends far less on the AI than on the unglamorous layers underneath: devices, identity, data protection and governance. The vendor press releases skip that part. This is a practical guide to it, written for the people who actually have to make AI work in a school: IT coordinators, operations managers and school leadership.

The push into classrooms is real

This isn’t a hypothetical trend. Microsoft Hong Kong has been working with the Education Bureau for years through its Partners in Learning programme to build AI and STEAM capability in K-12 schools, alongside initiatives with local education bodies — AI pilot schools with teacher training and certification, student AI-application programmes, and hands-on labs built around Azure OpenAI. At one Microsoft Showcase School, the Education University of Hong Kong Jockey Club Primary School, over 220 students have used Azure OpenAI tools such as chatbots and text-to-image generation in science classes.

So the question facing a Hong Kong school in 2026 is no longer whether AI reaches the classroom. It’s whether it arrives on governed school systems — or through whatever app a teacher or student happens to have on their phone.

Readiness starts with devices and identity, not the AI

Every useful AI deployment in a school sits on two foundations, and most problems trace back to one of them.

Devices. Shared classroom devices, student laptops and tablets, and staff machines all need to be properly managed — imaging, software distribution, patching, and sensible policies about what can be installed. A fleet that isn’t centrally managed can’t have AI tools deployed to it deliberately, or kept off it deliberately. Either capability matters.

Identity. AI tools inherit their data protections from the account that signs in (more on that below), which makes account hygiene the real control surface. Schools have a uniquely demanding identity lifecycle — hundreds of accounts provisioned at the start of each academic year, transitions between year groups and roles, leavers every summer — across Microsoft 365, Google Workspace, or both. If provisioning and deprovisioning are messy, your AI access control is messy too.

This is exactly the day-to-day work of education-sector IT support — and it’s worth fixing before any AI rollout, not after.

The licensing reality

What’s actually deployable in a Hong Kong school is narrower than the AI headlines suggest:

• ChatGPT is still not directly available in Hong Kong — OpenAI geoblocks HK as a commercial decision, so a school can’t simply standardise on it. The same GPT models are, however, available compliantly through Microsoft Copilot. Our guide to which AI tools work in Hong Kong has the full picture.
• Microsoft Copilot is fully available in Hong Kong and runs inside Microsoft 365 — which most schools already operate for staff.
• Google Gemini has been officially available in Hong Kong since March 2026, relevant for Google Workspace schools.

The detail that matters most for a school: the data protection attaches to the work sign-in, not to the product name. Signed in with a school (work) account, Copilot Chat carries Microsoft’s enterprise data protection at no extra cost — prompts and responses are not used to train the underlying models, and standard Microsoft 365 admin tooling (DLP, sensitivity labels, retention) applies to its output. The full Microsoft 365 Copilot — the version embedded in Word, Excel and the rest — is a paid per-user add-on at a meaningfully higher cost than a personal chatbot subscription, so budget for it deliberately rather than assuming it comes with the licence. Education entitlements for staff and student accounts differ and change frequently; confirm the current terms with your Microsoft education reseller before you build a budget around them. For a wider comparison of what each tool does with your data, see AI tools compared for Hong Kong and China.

And treat any rollout as a change programme — training, policy and support — not a licence switch you flip.

Student data and the PDPO

Schools hold some of the most sensitive personal data of any organisation: children’s records, health and welfare information, family details, assessment histories. That makes the data question — not the capability question — the one to answer first.

Hong Kong has no AI-specific law; the Personal Data (Privacy) Ordinance (PDPO) governs what may be put into AI tools, and its core principles map directly onto classroom AI use: data collected for a purpose may only be used consistently with it, must be kept secure, and mustn’t be retained longer than necessary. The practical floor for any school:

• No student personal data into consumer AI tools. Free and consumer tiers — Western and Chinese alike — generally use what’s typed into them to train their models. A teacher pasting a class list, IEP notes or report comments into a free chatbot is a data breach in the making.
• Use governed tiers for real work. Enterprise routes signed in with school accounts carry contractual no-training commitments; consumer sign-ins don’t.
• Anonymise before input. The Privacy Commissioner’s guidance — the Model Personal Data Protection Framework for AI (2024) and the 2025 checklist on staff use of generative AI — tells organisations to give staff clear instructions on what may and may not be entered into AI tools, and to anonymise or cleanse personal data before input. That guidance applies to schools as much as to businesses.

Our PDPO guide covers the ordinance’s principles in more depth.

Governance before tools

The pattern we see in Hong Kong workplaces — staff quietly using their own AI tools outside any policy — has an obvious school-sector parallel, except the stakes include children’s data and assessment integrity. The fix is the same:

1. Write an AI acceptable-use policy before the rollout, covering staff use (what data may be entered, which tools are sanctioned) and the school’s position on student use — including how AI interacts with homework and assessment.
2. Provide a sanctioned route. Staff use AI because it saves them time; a banned-but-available tool loses to a sanctioned, governed one. Give teachers a school-account tool that’s actually good.
3. Back the policy with technical controls — DLP, sensitivity labels and retention policies on the school tenant, and device management that keeps unsanctioned apps off shared classroom devices.
4. Train the staffroom. Teachers need to know what the policy allows, why the consumer-app shortcut is dangerous, and how to use the sanctioned tools well. A policy nobody has read governs nothing.

A sensible rollout order

For most schools the sequencing matters more than the tool choice:

1. Fix devices and identity first — managed fleet, clean provisioning, MFA on staff and admin accounts.
2. Start with staff-facing use cases — lesson-material drafting, summarising documents, translation across English, Cantonese and Mandarin communications, administrative writing. High value, low risk, easy to govern.
3. Pilot with guardrails — a small group, a written policy, the right account types — and check what’s working before going wider.
4. Sequence student-facing AI last. It raises questions staff-facing use doesn’t — age-appropriateness, consent and parental communication, assessment integrity — and it deserves its own decision rather than arriving as a side effect.

AI in Hong Kong schools FAQ

Can Hong Kong schools use ChatGPT?

Not directly — OpenAI geoblocks Hong Kong, so ChatGPT isn’t available first-party. The same GPT models are available compliantly through Microsoft Copilot inside Microsoft 365, and Google Gemini has been officially available in Hong Kong since March 2026. For a school, the governed route through an institutional account is the right answer anyway — see which AI tools work in Hong Kong.

Does Microsoft Copilot train on school data?

No — when users sign in with a school (work) account, Copilot carries Microsoft’s enterprise data protection: prompts, responses and the data they reach are not used to train the underlying models, and Microsoft acts as data processor under contract. The crucial caveat is that this protection attaches to the work sign-in, not to personal Microsoft accounts — which is why account hygiene matters as much as tool choice.

What does the PDPO mean for AI in the classroom?

Personal data entered into an AI tool is governed by the PDPO like any other processing — purpose limitation, security and retention obligations all apply, and schools hold particularly sensitive data about children. The Privacy Commissioner’s AI framework and staff-use checklist expect organisations to tell staff clearly what may and may not be entered into AI tools and to anonymise personal data before input. The practical floor: no student personal data in consumer chatbots, governed school-account tools for real work.

Where PTS fits

PTS supports international schools and education providers across Hong Kong and APAC — device fleets, identity, Microsoft 365 and Google Workspace, networks and security — which is precisely the foundation AI adoption stands on. If your school is working out how to adopt AI without creating a data problem, our education sector IT services and practical AI advisory are built for exactly this. Talk to PTS and we’ll come back with a plan that fits your school, your platforms and the academic calendar.

Related reading: AI tools compared — what works in Hong Kong & China · Can you use ChatGPT in Hong Kong? · Hong Kong privacy law (PDPO) explained · The state of AI in Hong Kong business 2026