Artificial Intelligence and Turkish Law: Regulatory Framework

While AI technologies rapidly transform health, education, finance, law, and retail sectors, legal systems also take steps to catch up with this new technology. In the shadow of comprehensive regulations like the EU AI Act, Turkey shapes its own regulatory framework. For businesses, AI integration carries legal risk as much as opportunity. As a law firm advising tech-focused companies in Antalya, in this guide we cover implications of AI applications under Turkish legal framework.

Current State of AI Regulation in Turkey

Specific law for AI in Turkey has not yet entered into force as of writing this text; however:

• State conducts planning under National AI Strategy,
• Preparatory work continues for Turkey's reflection of EU AI Act,
• Sector-specific regulations (health, finance, automotive) indirectly affect AI application use.

For businesses in this period:

• KVKK rules,
• Consumer law,
• Intellectual property law,
• Contract law and tort law

set the framework for AI applications in a mixed manner.

AI and KVKK: Limits of Data Processing

Training AI models requires large amounts of personal data. Under KVKK, this data processing:

• Must rely on legal basis (explicit consent, contract formation, legitimate interest, etc.),
• Disclosure obligation must be met,
• Special objection right must be granted to data subject for automated decision-making mechanisms,
• Cross-border data transfer regulations must be followed.

Automated Decision-Making

If a fully automated system makes decision adverse to data subject (e.g., loan application rejection, job application pre-screening), KVKK grants data subject right to object to this decision and demand human intervention. Businesses using AI must establish this mechanism.

Copyright in AI Outputs

Who can claim ownership of text, image, audio, or code produced by an AI? Under Turkish law:

• Authorship belongs as a rule to natural persons,
• AI itself cannot be author,
• For works produced through collaboration with AI, human's creative contribution is determinative.

Therefore:

• Copyright protection of fully automated content produced with ChatGPT or similar tools is weak,
• "Prompt" text given to AI is not sufficient to qualify the output as human work,
• Commercial use of code, image, or text produced with AI raises copyright risks.

When using AI for content production, businesses should ensure output is humanly edited and original contribution element is provided.

Training Data and Copyright Infringement

AI models use existing texts, images, sounds for training. Whether this use:

• Complies with copyright,
• Protects rights of works' owners

is still debated worldwide. For companies developing AI models locally in Turkey:

• Documentation of training data source,
• Preference for licensed datasets,
• Prioritisation of open source and public domain data use

is recommended.

Liability for Damage from AI

If an AI system makes decision and that decision causes damage, who is liable? Under Turkish law, expectation is evaluation under tort liability; however, in concrete cases:

• Software developer,
• Model trainer,
• System deployer,
• System user

— who is liable is debated. Contractual arrangements fill this gap:

• Vendor places liability limitation in contract,
• Customer can take insurance against damage from system use,
• Additional obligations for high-risk use areas similar to EU AI Act.

High-Risk AI Use

Use areas considered "high-risk" under EU AI Act:

• Health diagnosis and treatment,
• Education and exam scoring,
• Recruitment and performance evaluation,
• Credit scoring,
• Judicial and criminal applications,
• Biometric identification.

Use of AI in these areas by Turkish businesses requires additional preparation in terms of compliance with regulations to be adopted in future. Conducting risk assessment now reduces compliance cost later.

AI in Chatbot and Customer Service

Use of AI chatbots for customer communication has spread. Legally:

• Customer has right to know they are speaking with a bot,
• Business is liable for accuracy of bot's responses,
• Misleading information's damage to customer creates compensation obligation,
• Bot's data processing activity is subject to KVKK rules.

Tourism and retail businesses in Antalya must consider these points in chatbot applications.

Contract Provisions Related to AI

The following provisions in supplier contracts containing AI components require attention:

• Data use permissions — it must be guaranteed that customer data will not be used for AI training,
• Output ownership — by whom can model outputs be used,
• Misleading output (hallucination) liability,
• Bias audit — particularly in systems affecting human decisions,
• Explainability — mechanisms explaining AI decisions.

AI Ethics and Internal Company Policies

Determining business AI use policy is important for both legal risk and reputation. In this policy:

• Which systems can be used,
• Customer data sharing limits,
• Human oversight in content production,
• Data breach response procedure

are clearly determined. Employee training supports this policy.

Future Preparation: Regulatory Process

More comprehensive regulation regarding AI is expected in Turkey in coming period. Forward approach for businesses:

1. Compliance with EU AI Act's basic obligations,
2. Update KVKK compliance for AI use,
3. Conduct risk assessment,
4. Revise contracts according to AI contractual risks,
5. Prepare internal training and ethics rules.

Legal Support

For companies benefiting from AI technologies in Antalya, MONA HUKUK provides data protection compliance, contract negotiation, copyright analysis, and risk assessment service. Whether you're developer or user of AI, in dynamic transformation of legal framework we predictably guide you.

Contact us at contact@monahukuk.com or call +90 (242) 606 14 32 to schedule a consultation in Antalya.