AI regulation in Türkiye: current rules and what companies should do before an AI law passes

As of 14 October 2026, every AI bill I have checked on the Grand National Assembly (TBMM) website is listed as “in committee”.

On 26 March 2026 the chair of Parliament’s AI inquiry commission said the country needs its own AI regulation. The government’s Türkiye AI Action Plan (2026-2030) says the framework will rest on a general statute.

The AI bills in Parliament

Bill 2/2234 (“Yapay Zeka Kanun Teklifi”), submitted on 24 June 2024, would set up a regulatory framework for AI systems. Later bills, tabled between November 2025 and October 2026, include:

• Bill 2/3358, tabled on 7 November 2025, which would amend several laws to make provisions on AI systems.
• Bill 2/3404, tabled on 3 December 2025, which would require content providers to visibly mark all AI-generated audio, written or visual messages as AI-generated under Law No. 5651 and would punish breaches under Penal Code Article 217/A, the offence of publicly spreading misleading information.
• Bill 2/3465, tabled on 8 January 2026, which would amend Law No. 6698. Under this bill, a social media tool or digital platform that allowed AI-generated audio, written or visual messages to be shared without the person’s permission would face an administrative fine of 5% of previous-year turnover, applied separately for each message.
• Bill 2/3909, tabled on 2 October 2026, which deals with digital copyright.

The inquiry commission (TBMM Yapay Zeka Araştırma Komisyonu) is separate from the standing committees where the bills sit. It presented its report to the Speaker on 26 February 2026. According to TBMM, the chair said the report contains 100 recommendations, including a risk-based regulatory model.

The Türkiye AI Action Plan (2026-2030)

Presidential Circular 2026/9, published in Official Gazette No. 33344 on 18 August 2026, instructs public institutions and bodies to carry out their duties under the plan. It does not bind private companies today.

Action 4 calls for a framework that takes account of the EU’s proportionate, risk-based approach, with obligations tiered by risk:

• Low-risk uses would rely on checklists.
• Medium-risk uses would rely on a short algorithmic impact assessment.
• High-impact uses would rely on an extended assessment, a public model summary (a model card) and a detailed technical file for supervisory authorities.

The plan would define high-impact systems to cover:

• Health
• Education
• Employment
• Social assistance
• Credit assessment
• Biometric recognition
• Law enforcement and justice processes
• Applications that directly affect children and vulnerable groups

A national AI ethics board would give guidance, carry out ethical reviews and route applications. Binding supervision and sanctions would rest with sector regulators.

Personal data in AI tools under Law No. 6698

Law No. 6698 on the Protection of Personal Data already governs AI tools that process personal data. The Personal Data Protection Authority (KVKK) guide of 24 November 2025, “Üretken Yapay Zekâ ve Kişisel Verilerin Korunması Rehberi (15 Soruda)”, shows how the Authority reads that Law for generative AI:

• The guide says legitimate interest cannot be relied on where training on publicly available personal data could have a negative result for the person, as with a model that imitates a face, voice or writing style.
• It warns that a vague stated purpose such as “using in our generative AI systems” may breach the purpose principle in Article 4.

Where personal data leaves Türkiye, Article 9 of Law No. 6698 applies. A regulation published in Official Gazette No. 32598 on 10 July 2024 sets out the procedure. The routes run in order, and the first two also need a legal basis under Article 5 or 6:

• First, a KVKK Board adequacy decision;
• Second, an Article 9(4) safeguard such as a standard contract, provided the person can exercise their rights and seek effective remedies in the destination country. A standard contract must be notified to the KVKK within five business days of signature;
• Third, an Article 9(6) ground for an occasional transfer.

In March 2026 the KVKK published two further papers:

• “İş Yerlerinde Üretken Yapay Zekâ Araçlarının Kullanımı” (5 March), which defines “Gölge YZ” (shadow AI) as employees using generative AI tools at work without the organisation’s knowledge, approval or control. In the workplace paper’s view, outright bans will not work in practice, as they may push staff to use the tools out of sight.
• “Etken Yapay Zekâ (Agentic AI)” (12 March), which looks at systems that, as autonomy grows, can start actions without human intervention, and stresses the need to define when human oversight applies.

Advertising and competition rules in Türkiye

A regulation published in Official Gazette No. 33297 on 1 July 2026 amended the Commercial Advertising and Unfair Commercial Practices Regulation. The amendment has been in force since 1 August 2026. Two provisions deal with AI in advertisements:

• Article 18(8) requires a clear, understandable and distinguishable statement where an advertisement uses AI or other software in a way that would materially affect consumers’ economic behaviour regarding a good or service, or where it features digital characters created with AI that cannot be told apart from humans.
• Article 27(12) provides that advertisements may not use an AI-generated digital copy of a real person that falsely gives the impression that the person personally experienced or used a good or service, or recommends it.

On 7 April 2026 the Competition Authority announced a comprehensive sector inquiry into foundation models, access to data and computing power, and integration into large digital platforms.

How the EU AI Act reaches Turkish companies

The AI Act, Regulation (EU) 2024/1689, applies beyond the EU’s borders. Under Article 2(1), its scope includes:

• Article 2(1)(a), covering providers placing AI systems or general-purpose AI models on the EU market, or putting AI systems into service in the EU, wherever established;
• Article 2(1)(b), covering deployers in the EU;
• Article 2(1)(c), covering third-country providers and deployers where the output is used in the EU;
• Article 2(1)(d), covering importers and distributors.

Applied to a Turkish company or group:

• An EU subsidiary using a tool built in Türkiye would usually be a deployer.
• The Turkish company is a provider of that tool if it developed it, or had it developed, and places it on the EU market or puts it into service under its own name or trademark.
• A Turkish provider or deployer of an AI system whose output is used in the EU may fall under Article 2(1)(c).

Key EU AI Act dates, 2025 to 2028

Regulation (EU) 2026/1744 (Digital Omnibus on AI) entered into force on 27 July 2026. The dates for prohibitions and transparency are:

• 2 February 2025: Original prohibitions apply.
• 2 August 2026: Article 50 transparency duties apply.
• 2 December 2026 (output marking): Providers of generative systems placed on the market before 2 August 2026 have until this date to meet Article 50(2), the duty to mark AI-generated or manipulated output in a machine-readable and detectable way.
• 2 December 2026 (prohibitions): Article 5(1)(ba) and (bb), with Article 5(1a) and (1b), apply from this date. Point (ba) covers AI systems that generate or manipulate realistic images, video, audio or similar material of an identifiable person’s intimate parts or sexually explicit activity, without freely given, specific, informed, unambiguous and explicit consent. Point (bb) covers child sexual abuse material, subject to national “without right” defences.

Placing such a system on the market or putting it into service is banned only where that output is its intended purpose or, if the system lacks adequate safeguards, a reasonably foreseeable and reproducible outcome without significant technical modification. Use is banned only where that is the deployer’s purpose.

Edits that neither increase exposure of intimate parts nor alter the nature of the depicted sexually explicit activity are not manipulation.

The main high-risk obligations (Chapter III, Sections 1 to 3, except Article 6(5)) start on:

• 2 December 2027 for systems that are high-risk under Article 6(2) and Annex III;
• 2 August 2028 for systems that are high-risk under Article 6(1) and Annex I.

Annex I Section B products, and high-risk systems already on the market, have narrower rules.

What should companies do now?

• Inventory. List the AI tools in use, including the ones staff picked up on their own, and record an owner for each, the data it touches and where that data goes. Tell staff which tools, tasks and inputs are allowed, and train them.
• Personal data. Set a legal basis and a specific purpose. If personal data will leave Türkiye, pick an Article 9 route and diary the five-business-day KVKK notification for any standard contract.
• Contracts. Before you sign with an AI vendor, ask whether it trains on your data, how long it keeps prompts and which other suppliers handle the data.
• EU exposure. Work out your role under Article 2 and whether the output is used in the EU. Check the duties already in force, such as Article 4 on staff AI literacy, Article 50 transparency and the rules for general-purpose AI models, then diary the later dates.
• Controls. Have a person check outputs before anyone relies on them and keep final decisions with people, as the workplace paper suggests. Define when human oversight applies for agentic tools. Check the advertising rules before a Turkish campaign.
• Watch list. Keep an eye on the bills above, new KVKK papers, the competition inquiry and the plan’s first-year targets for a risk guide, sector annexes and the ethics board.

Next: The EU AI Act on 2 August 2026: what actually applies →