Source: Esenyel Partners

Turkey is moving from a “wait and see” approach to an “active compliance” stance on AI, favoring a hybrid legislative model that updates existing laws rather than creating a single umbrella statute. Drafts before the Turkish Grand National Assembly (TBMM) would classify AI systems by risk and subject algorithms used in defined high-risk domains — including health, security, recruitment, and financial scoring — to strict inspection mechanisms; administrative fines for violations are mentioned as potentially reaching up to 7% of annual turnover. The Turkish approach described prefers adding AI-specific clauses to existing texts such as the Turkish Penal Code (TCK), the Personal Data Protection Law (KVKK), and the Law on Intellectual and Artistic Works.

Companies are advised to identify all AI tools in use (chatbots, productivity software, data-analysis tools), determine which qualify as “high-risk,” and document decision-making processes. Data-privacy measures recommended include regular audits, dataset anonymization, and updating explicit consent texts to meet KVKK-related concerns; the legal entity using or developing AI can be held directly liable for AI-generated data breaches. Generative-AI outputs (texts, audio, images) should be labeled “synthetic,” with watermarks or disclaimers to counter deepfake risks. The principle of human-centricity requires justifiable AI decisions and human-oversight mechanisms where a human gives final approval on critical outcomes. The guide frames compliance as both penalty avoidance and reputation protection and invites companies to contact Esenyel & Partners for risk analyses, alignment with drafts, and legal support.