CI Operators’ Statutory Obligations

With Hong Kong’s monumental cybersecurity law – the Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap.653) (the “Ordinance”) and the Code of Practice (“CoP”) coming into force on 1 January 2026, operators of critical infrastructures (“CI Operators”) have been imposed with three categories of statutory obligations. The “infographic” attached provides a pictorial representation of the three categories of statutory obligations.

The “making-off” of the Infographic

This infographic is generated with the new function of a powerful AI tool – NotebookLM of Google. Pro-tip: don’t just feed everything into the notebook. Instead, try the following:

1. Be selective – it is important to find a focus. I extracted only the pages covering the three categories in the CoP as a separate PDF first instead of feeding the entire CoP.
2. Ask AI to prompt itself – even the extracted pages (20+) of the CoP may contain too much information for generating a meaningful infographic. Instead, I asked AI to summarise the extracted pages as a prompt for NotebookLM’s infographic generation. And guess which AI I used? Gemini 3 Pro, as it is a Google product too.
3. Keep the notebook simple – with only two sources – i.e., the extracted CoP and the Gemini-generated prompt only – I used NotebookLM to generate the final

This 3-step workflow shows that to generate the desired outputs by AI, some thoughtful planning is required especially when dealing with complex materials. Good news is: some planning steps – even prompt writing – can be assisted by AI.

Final remarks

The infographic here is not perfect, hopefully, it will still help you remember the three categories of CI Operators’ obligations under the Ordinance and the CoP (feel free to save or download).  With the assistance of AI tools, lawyers are empowered to focus more on strategic thinking and client engagement, ultimately enhancing the quality of legal services.