Live from 1 January 2026
Hong Kong's Critical Infrastructure Ordinance reaches maritime
Hong Kong's Protection of Critical Infrastructures (Computer Systems) Ordinance commenced on 1 January 2026 and names maritime transport services among the essential service sectors in scope. For a designated operator this is a statutory regime with audits, drills and incident clocks — a different animal from the ISM-based cyber obligation most managers already carry.
Designation is done by the Commissioner rather than by self-declaration, so the first practical step for a manager with Hong Kong exposure is to establish, in writing, whether any of its computer systems support an essential service delivered in Hong Kong.
The four families of obligation
Organisational
A local point of accountability and a computer-system security management unit with named responsibility — not a shared inbox.
Preventive
A maintained security management plan, periodic risk assessment and independent audit of the critical computer systems on a set cycle.
Notification
Material changes to the critical computer systems reported to the Commissioner within the statutory period.
Incident
An emergency response plan, participation in drills, and notification of security incidents to short statutory deadlines, with serious incidents on the tighter clock.
Why the incident clock is really a records problem
Meeting an hours-long notification deadline is not a matter of writing faster. It depends on already knowing which systems are critical, who owns them, what changed last, and what the ship reported — before the incident. Full Ahead Maritime keeps that register continuously as part of normal operations, in an append-only record, so the notification is an export rather than an investigation.
Common questions
When does the Ordinance take effect?
The Protection of Critical Infrastructures (Computer Systems) Ordinance was passed by the Legislative Council in March 2025 and commences on 1 January 2026, with the Commissioner's office standing up to designate operators and issue codes of practice. Obligations bite on organisations once they are designated, not on the whole industry at once.
Does it apply to shipping companies?
Maritime transport services are among the essential service sectors the Ordinance covers, alongside energy, telecommunications, banking, air transport, land transport and healthcare. Whether a specific company is caught depends on designation by the Commissioner — the test is the importance of the infrastructure to the continuous delivery of the essential service in Hong Kong, not the company's size or flag.
What are the main obligations on a designated operator?
In broad terms: maintain a presence and a point of accountability in Hong Kong, notify material changes to the critical computer systems, establish a computer-system security management unit, run periodic risk assessments and independent security audits, take part in drills, and maintain and follow an emergency response plan.
How fast must incidents be reported?
The Ordinance sets short statutory clocks for notifying computer-system security incidents to the Commissioner, with a tighter deadline for serious incidents than for other incidents. Treat the practical requirement as: detect, classify and notify within hours — which is only achievable if the operating record is already in one place.
We are not a Hong Kong company. Why does this matter?
Because designation follows the infrastructure, not the incorporation. Managers with Hong Kong-linked operations, terminals, or systems supporting maritime services delivered in Hong Kong should establish early whether they are in scope, and should not assume an existing IMO/ISM cyber posture satisfies a statutory critical-infrastructure regime.
Summary for operational planning only, not legal advice on Hong Kong law. Confirm scope, deadlines and codes of practice with the Ordinance text and your legal advisers before relying on any timeline here.
Track the cyber deadlines that reach shipping
IMO, IACS and national critical-infrastructure regimes, dated and summarised.