This page lists the main points that companies and institutions using an AI system in their business should consider under Regulation (EU) 2024/1689 (the EU AI Act) and the Turkish Law No. 6698 on the Protection of Personal Data. It is based on the publications of Prof. Dr. Murat Volkan Dülger listed at the end. The legislation cited was checked against official sources on 1 November 2026. The scope of the AI Act and its relationship with data protection law are covered on a separate page linked at the end.

1. Identify your role

Obligations under the AI Act depend on the role. A natural or legal person, public authority, agency or other body using an AI system under its authority is a deployer (Art. 3(4)). A company using an off-the-shelf system in its business is, as a rule, a deployer. Natural persons using AI in the course of a purely personal, non-professional activity are not subject to deployer obligations (Art. 2(10)).

In certain cases a deployer is treated as a provider and takes on the provider's obligations (Art. 25(1)): where it puts its name or trademark on a high-risk system already placed on the market, makes a substantial modification to such a system, or modifies the intended purpose of a system that is not high-risk, including a general-purpose system, so that it becomes high-risk. Starting to use a general-purpose language model to screen job applicants is an example of the last case.

2. Classify the use

Four questions should be asked for each use. Is it prohibited (Art. 5)? Does it fall within one of the high-risk areas listed in Annex III? Does it trigger transparency obligations (Art. 50)? If none of these applies, the AI literacy obligation remains under the AI Act (Art. 4). Data protection law applies separately in every case. Recruitment and decisions about employees, creditworthiness, pricing of life and health insurance, admission and assessment in education, and remote biometric identification are examples of uses classified as high-risk.

3. Avoid prohibited practices

The prohibitions have applied since 2 February 2025 and bind deployers too. For companies, the most relevant are emotion recognition in the workplace and in education institutions (except for medical or safety reasons), biometric categorisation inferring race, political opinions, trade union membership, religious beliefs or sexual orientation, and untargeted scraping of facial images from the internet or CCTV footage. Software that measures employees' emotional state from camera images or voice analysis may therefore not be used. The prohibitions added by the Digital Omnibus on generating realistic intimate images without consent and on child sexual abuse material apply from 2 December 2026.

4. If you use a high-risk system

Following the Digital Omnibus, the obligations for Annex III systems apply from 2 December 2027. From that date the deployer must use the system in accordance with the provider's instructions for use, assign human oversight to persons with the necessary competence, training and authority, ensure that input data under its control are relevant and sufficiently representative, monitor the operation of the system, suspend use and inform the provider and the market surveillance authority where it identifies a risk, and keep the logs automatically generated by the system for at least six months (Art. 26).

A deployer who is an employer must inform workers' representatives and the affected workers before putting a high-risk system into use at the workplace (Art. 26(7)). Where a system makes or assists in making decisions about natural persons, those persons must be informed that the system is used (Art. 26(11)); they may ask for an explanation of the system's role in the decision (Art. 86). Bodies governed by public law, private entities providing public services, and deployers of systems used for creditworthiness and for life and health insurance must carry out a fundamental rights impact assessment before use (Art. 27). Where personal data are processed, the information supplied by the provider is used for the data protection impact assessment under Article 35 of Regulation (EU) 2016/679 (GDPR) (Art. 26(9)).

5. Transparency obligations

The transparency obligations have applied since 2 August 2026 (Art. 50). Deployers of emotion recognition or biometric categorisation systems must inform the persons exposed to them. Deployers of systems that generate or manipulate image, audio or video content constituting a deep fake must disclose that the content has been artificially generated or manipulated; for evidently artistic, creative or satirical works the obligation is limited. The same disclosure applies to AI-generated text published to inform the public on matters of public interest, unless the text has undergone human review or editorial control and a person holds editorial responsibility for the publication.

Designing systems that interact directly with people, such as customer service chatbots, so that people are told they are interacting with AI is an obligation of the provider. A company using an off-the-shelf chatbot should check that this notice also works in its own deployment. Machine-readable marking of synthetic content is likewise a provider obligation; for systems placed on the market before 2 August 2026 the deadline is 2 December 2026.

6. AI literacy

Providers and deployers must take measures to support the development of AI literacy among their staff and other persons operating and using AI systems on their behalf (Art. 4). As amended by the Digital Omnibus, the provision does not require them to guarantee any specific level of AI literacy of any individual. The measures take account of the persons' technical knowledge, experience and training and of the context in which the systems are used.

7. Personal data

Entering personal data into an AI system is processing within the meaning of Law No. 6698 (KVKK). Each processing activity must rest on one of the conditions in Article 5, or in Article 6 for special categories of data; the persons concerned must be informed (Art. 10) and the necessary technical and organisational measures must be taken (Art. 12). Where the provider is established abroad and data go to servers outside Türkiye, the transfer must comply with Article 9 and the Regulation on the Procedures and Principles for Transferring Personal Data Abroad. The Turkish Personal Data Protection Authority's guide recommends avoiding entering identifying data such as names, addresses, telephone numbers and identity details into these systems (Guide, p. 57).

Proportionality is particularly important for applications that monitor or assess employees. Prof. Dr. Murat Volkan Dülger's paper on employer monitoring of employees' communications discusses the limits of such monitoring in the light of the right to the protection of personal data.

8. Secrets and confidential information

Before client information, trade secrets or information covered by professional secrecy is entered into a publicly available AI tool, the provider's contract and terms of use should be reviewed: Are inputs used to train the model? How long are they stored? In which country are they processed, and who can access them? For lawyers, the duty of confidentiality (Art. 36 of the Turkish Attorneys' Act No. 1136) is at the centre of this assessment. A written internal policy stating which tools may be used, with which data and by whom, keeps this check consistent over time.

9. Check the output

Texts and suggestions produced by AI systems may be wrong; generative models may cite sources and decisions that do not exist. Responsibility for a decision based on the output lies with the person and the institution using the system. As Prof. Dr. Murat Volkan Dülger noted in his paper on AI in the judiciary, the discretion that plays an important role in law cannot be handed over to these systems; they should be used to support human decisions.

10. Fines

Breaches of the prohibitions carry administrative fines of up to EUR 35 million or 7% of total worldwide annual turnover; breaches of deployer obligations (Art. 26) and transparency obligations (Art. 50) up to EUR 15 million or 3%; and supplying incorrect, incomplete or misleading information to authorities up to EUR 7.5 million or 1% (Art. 99). For undertakings the higher of the two amounts applies; for SMEs the lower.

Assessment

In Prof. Dr. Murat Volkan Dülger's view, the risks of AI technologies should not be a reason to halt development; risks should be identified in advance and progress made with the necessary safeguards in place. The same approach applies at the stage of use: an institution should know which system it uses for which purpose, which data the system processes and who reviews the output. As stressed in a joint opinion co-authored by Dülger in 2020, a structure ensuring accountability should be set up at every stage at which AI processes data, and responsibility should be allocated from the outset.

This is how Dülger's general approach to AI law applies within an institution: rather than banning AI, using it in a controlled way that is open to oversight. Within an institution, the approach can be implemented through a list of approved tools and uses, records of use, a way to challenge the output, and regular internal review.

The legislation and sources cited and their status for Türkiye

The legislation and sources cited on this page are listed below with their full titles and their legal status for Türkiye. For texts not in force in Türkiye, the list states why they are cited and in which cases they may nevertheless bind persons in Türkiye.

  • Turkish legislation: Law No. 6698 on the Protection of Personal Data (KVKK; Official Gazette 7.4.2016, No. 29677) and the Regulation on the Procedures and Principles for Transferring Personal Data Abroad (Official Gazette 10.7.2024, No. 32598). In force and binding in Türkiye.
  • Attorneys' Act, Law No. 1136 (Official Gazette 7.4.1969, No. 13168): in force and binding in Türkiye.
  • EU AI Act: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024. In force in the EU since 1 August 2024. Since Türkiye is not an EU member, it is not in force in Türkiye and does not bind Turkish authorities or courts. It does, however, bind providers and deployers in Türkiye that place systems on the market or put them into service in the EU, or whose systems' output is used in the EU (Art. 2(1)(a) and (c)). Because Türkiye is an EU candidate country and is required, within the Customs Union, to align its technical legislation on products, the Act is also cited as a model for Turkish legislation.
  • Digital Omnibus: Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026, amending the AI Act; in force in the EU since 27 July 2026. Its status for Türkiye is the same as that of the AI Act.
  • General Data Protection Regulation (GDPR): Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. Applies in the EU since 25 May 2018; not in force in Türkiye. It binds companies in Türkiye that offer goods or services to persons in the EU or monitor their behaviour in the EU (Art. 3(2)). Since the KVKK was modelled on EU data protection law, the GDPR and EU case law are cited for comparison.
  • Turkish Personal Data Protection Authority, Guide on Generative AI and the Protection of Personal Data (in 15 Questions), Publication No. 113, November 2025; Recommendations on the Protection of Personal Data in the Field of Artificial Intelligence, 2021: they reflect the interpretation of the Turkish data protection authority. Not being a law or regulation, they are not binding, but they show how the Law is interpreted in the Board's practice.

Related publications and pages

Status of the law: 1 November 2026. This page provides general information and does not replace legal advice on a specific case.