Artificial Intelligence Law in Türkiye

Alongside these sit the Turkish Code of Obligations (No. 6098) for contract and tort and, for any business whose systems or outputs reach the European Union, the EU AI Act, a second and directly binding layer whose timetable was amended in July 2026.

That is the whole of the position, and it is worth stating plainly, because much of what circulates online as “Türkiye’s AI law” describes proposals that were never enacted. The absence of a single AI statute does not mean the absence of AI regulation. It means several regimes apply at once, and the burden of joining them up falls on your business.

Türkiye’s AI policy instrument is administrative rather than legislative. The National Artificial Intelligence Strategy (2021-2025) was promulgated by Presidential Circular No. 2021/18, published in the Official Gazette of 20 August 2021, No. 31574. Its successor, the Türkiye Artificial Intelligence Action Plan (2026-2030), was announced by Presidential Circular No. 2026/9 of 17 August 2026, published in the Official Gazette of 18 August 2026, No. 33344; like the Strategy, it sets policy and creates no obligations for private businesses. In Parliament, work is at the research stage rather than the enactment stage: the Grand National Assembly’s AI research commission, chaired by the Eskişehir deputy Fatih Dönmez, presented its report to the Speaker in early 2026. Several private members’ bills on AI have been tabled. A bill is a proposal, not law, and none has been enacted.

What this means for you: you cannot point to one checklist and declare yourself compliant, and you should not build a compliance programme around a bill that has not passed. A single AI deployment can simultaneously raise a data question, an IP question and a liability question, and each must be answered under its own body of law.

Its reach is wider than it first appears. A lender scoring loan applicants, a retailer profiling customers, an insurer pricing a policy, or an HR team screening CVs with an algorithm are all processing personal data through automated analysis, and all of them can face an objection if the outcome is adverse to the individual. The practical response is architectural rather than legal: build a route by which a human can review and, where appropriate, override the model, and keep a record showing that the route exists and is used.

Everything else that governs the data side of an AI system is ordinary personal data protection law, a lawful basis for each processing activity, transparency in clear and accessible language, data minimisation and purpose limitation, and compliant safeguards where models, vendors or cloud infrastructure sit abroad. The differences between KVKK and the GDPR matter here, and they are set out in our guide to KVKK for foreign companies.

If your AI system touches personal data, treat compliance as a data-protection project first and an “AI project” second. In Türkiye, the fastest route to a fine is not a novel AI theory of harm, it is an ordinary KVKK breach hidden inside a clever model.

• Recommendations on the Protection of Personal Data in the Field of Artificial Intelligence: addressed to developers, manufacturers and service providers and to decision-makers.
• Generative Artificial Intelligence and Personal Data Protection: A Guide in 15 Questions: published by the Authority in November 2025. It covers content generation, the lifecycle of generative models, use cases and risks, assesses the resulting processing under Law No. 6698, and addresses what individuals, and parents of children using these tools, should watch for.
• Agentic AI: an assessment published in March 2026, covering what agentic systems are, the functions of AI agents, use cases, risks and data-protection considerations across the lifecycle.

None of these is binding. All three are worth reading before a deployment, because they are the closest thing Türkiye has to a supervisory position on AI, and a documented decision that follows them is materially easier to defend than one that does not.

It nonetheless matters to anyone running AI infrastructure, because an AI system operating in cyberspace is squarely within its scope and its sanctions are severe. Article 16 carries criminal penalties including one to three years’ imprisonment plus a judicial fine of 500 to 1,500 days for withholding information, documents, software, data or hardware from authorised bodies or inspectors; two to four years plus 1,000 to 2,000 days for operating without the required approval, authorisation or permit; four to eight years for breach of the confidentiality duty; three to five years for making leaked personal or critical-public-service institutional data accessible, sharing it or offering it for sale without consent; two to five years for fabricating or spreading false claims of a data leak in order to create alarm or to target institutions or persons; and eight to twelve years for cyber-attacks on elements of Türkiye’s national power in cyberspace, rising to ten to fifteen years for disseminating, transmitting or offering for sale data so obtained. Under Article 16(7) these are increased by one third where the offence is committed by a public official, by one half where committed by more than one person, and by between one half and double where committed within the activity of an organisation.

The administrative fine bands sit in Article 16(10) and (11). As enacted on 19 March 2025 they run from TRY 1,000,000 to TRY 10,000,000 for failure to discharge the duties in Article 7(1)(b) and (c), and from TRY 10,000,000 to TRY 100,000,000 for failure to discharge the duties in Article 18. A breach of Article 8(4) attracts TRY 100,000 to TRY 1,000,000, rising, where the breach is by a commercial company, to up to 5% of the gross sales revenue shown in its audited annual financial statements and in any event not less than TRY 100,000. Since 31 July 2026, Law No. 7590 has extended the first band in Article 16(10) to failures under Article 7(1)(a) as well. Article 17(2) adds that where one person is found to have committed several of the Law’s administrative offences before a sanction decision is issued, a single fine is imposed increased by up to double, and that where a benefit was obtained or a loss caused, the fine may be no less than three and no more than five times that benefit or loss.

Those lira figures should not be read as current-year figures. Under Article 17(7) of the Misdemeanours Law No. 5326, administrative fines expressed as fixed sums are increased at the start of each calendar year by the revaluation rate announced under the Tax Procedure Law No. 213, so the band in force for the year in question has to be checked for that year. The turnover-based element is a proportional fine and falls outside that annual revaluation.

Two further points of structure. A transitional provision of the Law provides that the regulations governing its implementation were to be brought into force within one year, that is, by 19 March 2026, with existing rules not contrary to the Law continuing to apply until then. And Article 19(3) of Law No. 7545 is itself the instrument that amended Article 10 of Law No. 5651 with effect from 19 March 2025.

Do not read Law No. 7545 as an AI code. Read it as the reason your AI infrastructure needs the same security, authorisation and incident discipline as the rest of your estate, with criminal, not merely administrative, consequences attached.

The baseline dates are these. The Regulation entered into force on 1 August 2024. The prohibited-practices and AI-literacy provisions applied from 2 February 2025. The governance rules and the general-purpose AI model obligations applied from 2 August 2025. General application follows on 2 August 2026. The two new prohibitions in Article 5(1), points (ba) and (bb), added by Regulation (EU) 2026/1744, apply from 2 December 2026.

The high-risk timetable then changed. Regulation (EU) 2026/1744 of 8 July 2026, amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence, the “Digital Omnibus on AI”, was published in the Official Journal on 24 July 2026 and enters into force on the third day following publication. It postpones the application of Chapter III, Sections 1, 2 and 3:

• to 2 December 2027 for the Annex III use-case high-risk systems; and
• to 2 August 2028 for systems classified as high-risk under Article 6(1), the Annex I product-embedded ones.

The commercially significant point is what was not postponed. Article 50, the transparency obligations for providers and deployers of certain AI systems, including the marking of AI-generated or manipulated content, keeps its original application date. The amending Regulation rewrites Article 50(7), replacing the Commission’s power to approve codes of practice by implementing act with an adequacy assessment while keeping its power to adopt common rules where a code is inadequate, and adds a transitional rule in a new Article 111(4): providers of AI systems generating synthetic audio, image, video or text content that were placed on the market before 2 August 2026 must comply with the marking obligation in Article 50(2) by 2 December 2026. A Turkish company that reads the omnibus as a general reprieve and stops work on disclosure and content-marking is reading it wrongly. The amending Regulation also adds two new prohibited practices to Article 5(1), points (ba) and (bb), covering AI systems that generate non-consensual intimate imagery of an identifiable person or child sexual abuse material, applicable from 2 December 2026.

For a Turkish business the practical first step is unchanged: list every product or service in which an AI system’s output could reach an EU user, then classify each against the Act’s tiers. Most systems will land in the minimal-risk category and need little more than good documentation. Discovering late that a flagship product is high-risk under EU rules forces an expensive redesign that early classification would have avoided, and the postponed dates are a scheduling opportunity, not a cancellation.

• Conformity. Under Article 4(1), a product must comply with its technical regulation; a non-conforming product cannot be placed on the market, made available or put into service until the non-conformity is removed.
• Documentation and testing. Under Article 7(1)(b), where the legislation requires it, the manufacturer draws up the technical file, carries out or commissions the conformity assessment, issues the declaration of conformity and affixes the conformity marking. Under Article 7(1)(c), the file and documents are kept for the period in the technical regulation or, where none is set, for at least ten years from the date the product was placed on the market. Article 7(1)(d) adds sample testing in proportion to the risks and a record of complaints, non-conforming products and recalls.
• Supervision. Market surveillance is the job of the “competent authority” that prepares or enforces the technical regulation for that product (Articles 3(1)(ş) and 15), not of an AI body. A certificate or conformity marking does not stop that authority from inspecting the product and acting against it (Article 15(6)).
• Damage. Under Article 6(1), the manufacturer or importer must compensate damage the product causes to a person or property; the injured party proves the damage and the causal link between the non-conformity and the damage (Article 6(2)); terms that remove or reduce this liability are void (Article 6(4)); and the claim is time-barred three years after the injured party learns of the damage and the liable party, and in any event ten years after the damage arises (Article 6(6)).

When the device is sold to a consumer, Law No. 6502 adds its own layer. A good is defective if it lacks a feature stated on its packaging, label, user manual, website or advertising, or the quality set in its technical regulation (Article 8(2)), and liability for a defective good is subject to a two-year limitation period from delivery unless a law or the contract sets a longer one (Article 12(1)). A seller marketing such devices by e-mail or text message needs the recipient’s prior consent under Article 6(1) of Law No. 6563. Recall duties are covered in our note on product recall under Law No. 7223, and online sales in our e-commerce and marketplace law practice.

• Contract: the relationships between developer, operator and users are usually contractual; well-drafted clauses are the first line of defence.
• Product liability: the manufacturer or importer compensates damage caused by the product under Article 6 of Law No. 7223, and a consumer buyer has the defective-goods remedies of Law No. 6502.
• Tort: fault-based claims under the Turkish Code of Obligations (No. 6098), though attributing fault to an autonomous system is difficult.
• Regulatory breach: most often a data-protection or intellectual property violation.

Open questions remain around the burden of proof, the attribution of fault in autonomous systems, and the applicable standard of care. A claimant may struggle to prove exactly how an opaque model produced a harmful output, and because Türkiye has no AI-specific liability statute, these questions are answered under the general rules of the Turkish Code of Obligations (No. 6098), Article 6 of Law No. 7223 for damage caused by products and, for consumer transactions, Law No. 6502. Until these questions are settled by legislation, the contract is where liability between businesses is really decided, and the logs are what decide the contract dispute. The contract has one limit: a term that excludes the manufacturer’s or importer’s liability towards the injured person is void, as explained in our note on why a contractual limitation of product liability is void.

Do not assume a court will untangle AI liability for you. If your agreements are silent on who owns the risk when the model is wrong, you have not avoided the question, you have simply left it to be answered against you.

• Documentation: record how the system was built, tested and validated, so you can evidence the correctness and integrity of inputs and outputs if challenged.
• Human oversight: build the review route that Article 11(1)(g) presupposes, and make sure a person can actually intervene in high-stakes decisions.
• Governance: adopt internal policies on transparent and accountable AI use, and assign clear ownership of AI risk within the organisation.
• Contracts: allocate responsibility, IP and indemnities expressly across every vendor and customer relationship, in your commercial contracts as well as your AI-specific agreements.
• Sector rules: regulated fields such as health carry their own authorisation and record-keeping duties that apply to an AI tool exactly as they apply to any other.
• Insurance: consider specialised liability cover for errors, bias or discrimination.

Taken together, these measures do more than reduce liability. They give you the paper trail that turns a defensible decision into a provable one, which is often the difference between resolving a dispute quickly and litigating it for years.

• AI governance and KVKK compliance: policies, data-protection impact assessments, automated-decision review routes and privacy safeguards.
• Intellectual property: protecting models, datasets and AI output, and settling ownership before disputes arise.
• EU AI Act readiness: classifying systems against the tiers, and scheduling Article 50 transparency work and postponed high-risk work to the correct dates.
• Cybersecurity compliance: assessing obligations and exposure under Law No. 7545 for AI infrastructure operating in cyberspace.
• Contracts and licensing: drafting development, data-sharing and service agreements that allocate risk.
• Liability and dispute resolution: assessing exposure and acting in AI-related disputes.

AI regulation in Türkiye will keep moving, and the shape of that movement is now reasonably clear: a research report before Parliament, a regulator publishing guidance faster than the legislature publishes law, and an EU regime that already binds anyone selling into Europe. Businesses that build compliance in from the start adapt far more cheaply than those forced to react to a statute after it appears.

• Real Estate & Property Law: Title deed due diligence, foreign property acquisitions, and Land Registry (TKGM) transfers.
• Intellectual Property & Trademark Litigation: Trademark, patent, and copyright enforcement before TÜRKPATENT and IP Courts.
• Personal Data Protection (KVKK/GDPR): VERBİS registration, data inventory mapping, and cross-border data transfer compliance.
• Legal Matters in Istanbul for Foreign Clients and Companies: Full-service commercial and civil advocacy before Istanbul courthouses.