Turkey has published multiple guidelines on the use of AI in various sectors; Turkish government expected to enact AI-specific regulation in the near future.

Laws/Regulations directly regulating AI (the “AI Regulations”)

Currently, there is no specific law or regulation that directly regulates AI in Turkey, though it is anticipated that this may change in the foreseeable future. The government is keen to encourage the responsible use of AI through various measures, including the creation of "AI hubs" to support Turkish businesses, and such measures have been reflected in Turkey's National Strategic Plans since 2021.

The Turkish Personal Data Protection Authority (the "KVKK¹") has published a series of privacy-focused guidelines concerning the implementation of AI solutions in different sectors. The KVKK's "Recommendations on the Protection of Personal Data in the Field of Artificial Intelligence" (the "AI Recommendations²") set out the KVKK's expectations regarding respect for fundamental human rights and freedoms, and imposing limits on the use of personal data in AI applications. Further, the KVKK's "Guidelines on Good Practices regarding the Protection of Personal Data in Banking Sector³" provide recommendations for financial institutions and banks processing personal data through, among others, AI-based products. Finally, the KVKK's "Guidelines on Protection of Privacy in Mobile Applications"⁴ clarify that AI-based mobile applications should adhere to the principles of transparency and predictability. Although these guidelines are non-binding, they illustrate the KVKK's current stance on AI.

Status of the AI Regulations

As noted above, there are currently no specific laws or regulations that directly regulate AI in Turkey. The Digital Transformation Office of the Presidency of Turkey (the Digital Transformation Office ) created in 2018 as the policy-making body to spearhead digital and technological developments in the country, is actively working on building a legal framework to support and regulate AI. To date, the Digital Transformation Office has published a series of strategic planning notes related to promoting the use and development of AI in Turkey (e.g., by investing in education, training, research, and infrastructure), but nothing related to the regulation of AI.

Other laws affecting AI

Turkey has in place a broad legislative framework around technology, including cybersecurity, internet, and social media, which may affect the use of AI, including:

• The Law on Consumer Protection (No. 6502) and the Law on Regulating Electronic Commerce Law (No. 6563) – both laws regulate practices that influence consumer behavior (e.g., advertising) and rights, which may have implications on the use of AI in e-commerce
• The Turkish Criminal Code (No. 5237) criminalizes "misinformation" and "fake news" on the internet, which may have implications on AI-generated content
• The Law on Highway Traffics (No. 2918) regulates highway traffic, navigation, and roadmaps, and may have implications on the use of AI in these services, as well as in self-driving cars and other automated vehicles
• The Law on Industrial Property (No. 6769) is the umbrella legislation covering copyright, trademark and patent rights, and may have implications on AI-generated content and works
• The Law on Protection of Personal Data (No. 6698) regulates the collection, use, processing, and localization of personal information, and may have implications over all uses of AI that relies on personal data
• The Law on Regulation of Broadcasts through Internet and Combatting of Crimes Committed Through Such Publications (No. 5651) regulates criminal content online, including on social media platforms, and may have implications on AI-generated content, as well as on the use of AI in other functions of these platforms such as personalized advertising
• The Regulation on the ID Process Verification of the Applicant in the Electronic Communication Sector (no. 2021/31523) and the Regulation Remote ID Verification Methods to be Used and Electronic/Digital Contracts to be Executed by Financial Leasing, Factoring, Financing, and Saving Financing Companies (no. 2022/31716) – both regulate the use of electronic IDs and verification of personal information, which may have implications on AI-based verification systems
• The Draft Regulation on Cryptocurrency Assets (no. 6362; currently pending before the Turkish National Assembly) envisions the use of AI for the prevention of money laundering activities

Definition of “AI”

There is currently no specific definition of AI under Turkish Law. The KVKK suggests in its AI Recommendations that the term AI refers broadly to computation ability to execute tasks normally associated with humans, such as thinking, interpreting, and making decisions. Further, Turkey's National Artificial Intelligence Strategy, published by the Digital Transformation Office in 2021 (the National AI Strategy⁶) offers a similar interpretation.

Territorial scope

As noted above, there are currently no specific laws or regulations in Turkey that directly regulate AI.

Sectoral scope

The strategic plans and guidelines the Turkish government has published so far suggest that the expected AI regulations will focus on the sectors of banking, finance, legal, health, automotive, personal data (privacy), e-commerce, intellectual property, capital markets, national security and e-government. In particular, the National AI Strategy focuses on promoting the use and development of AI, specifically generative AI, to support and assist the following sectors:

• National security and cybersecurity
• Telecommunications, 5G, and blockchain
• Electronic judiciary systems
• Automation of trademark and patent procedures
• Automation of record keeping in export/import transactions
• Preventative medicine and vaccination
• Prevention of fraud and money laundering
• E-finance

Compliance roles

As noted above, there are currently no specific laws or regulations in Turkey that directly regulate AI. Accordingly, there are currently no legal obligations specifically assigned to developers, users, operators and/or deployers of AI systems. The KVKK's AI Recommendations provide definitions of data processors, developers, manufacturers, and service providers, but do not make any compliance recommendations for any of these roles specifically.

Core issues that the AI Regulations seek to address

There are currently no specific laws or regulations in Turkey which directly regulate AI. However, both the AI Recommendations and the National AI Strategy underline the need for "ethical AI." We expect the notions of responsibility, transparency, and predictability to be the core elements of regulation of AI in Turkey.

Turkey is known to closely observe the legal developments in the European Union (e.g., EU AI Act), which it frequently relies on as models for national legislation. We can expect Turkey to regulate AI in a manner consistent and compatible with the relevant EU regulations.

On a broader level, the National AI Strategy focuses on the integration of AI as a political priority to increase the social welfare and strengthen the country's national security. Turkey also aims to increase its global competitiveness, achieve economic and technological independence, and undertake policies and practices that will lead to breakthroughs in critical technologies, including AI. These will be the other key considerations for Turkey in regulating AI.

Risk categorization

Because Turkey currently has no AI-specific laws or regulations in Turkey, there is no official risk categorization.

The National AI Strategy states that "standardization and certification" will be promoted to reduce the risks of AI use. The National AI Strategy also envisions the use of AI to support responses to national and global crises such as pandemics and natural disasters.

On a broader level, Turkey has recently taken measures to combat misinformation, hate speech and financial fraud online. These are high-risk areas where Turkey may rely on AI to address these problems more effectively while also restricting any use of AI that could exacerbate them.

Key compliance requirements

As noted above, there are currently no specific laws or regulations in Turkey that directly regulate AI. That said, in light of the AI Recommendations and National AI Strategy, we expect that the key compliance requirements will focus on the principles of transparency, accountability, protection of privacy and personal data, safety of individuals and specifically children, non-discrimination and reliability of information.

Regulators

There is currently no AI-specific regulation or regulator in Turkey. The KVKK is the main privacy regulator under Turkey's Personal Data Protection Law (No. 6698⁷) and may indirectly regulate the AI field through various privacy-focused regulations that are in place in Turkey. The Information and Communications Technologies Authority, the Financial Crimes Investigation Board, the Capital Markets Board, the Banking Regulation and Supervision Agency, the Advertising Board and the Turkish Competition Authority, may each indirectly regulate AI within their own spheres. Turkey's anticipated AI regulations may create a new regulator specifically to regulate AI or distribute specific roles and duties among the existing regulators.

Enforcement powers and penalties

As stated above, there is no specific regulation that directly regulates AI in Turkey. However, other laws and regulations that may indirectly regulate AI (please refer to "Other laws affecting AI" section above) provide the Turkish regulators with a large toolbox of enforcement measures and penalties. For example, under Turkey's Law on Protection of Personal Data (No. 6698), sanctions for non-compliance include administrative fines. Under the Law on Regulation of Broadcasts through Internet and Combatting of Crimes Committed Through Such Publications (No. 5651), sanctions for non-compliance include, in addition to administrative fines, advertising bans and bandwidth reduction.

In September 2023, the Advertising Board imposed fines⁸ on advertisers to sanction practices that rely on AI-generated information to promote their products without "any factual research" proving "product or brand superiority." For example, one clothing brand claimed in its online advertisements that it is "the biggest fashion retailer in Turkey according to ChatGPT," which the Advertising Board found to be "unreliable" because there was no research or independent resource to support that claim and answers generated by ChatGPT may not always be "accurate or up to date." Finally, to the extent AI is used to commit any of the offences set out in the Turkish Criminal Code (No. 5237), penalties envisioned therein will apply.

1 See here
2 Recommendations on the Protection of Personal Data in the Field of Artificial Intelligence
3 Guidelines on Good Practices regarding the Protection of Personal Data in Banking Sector (available in Turkish only)
4 Guidelines on Protection of Privacy in Mobile Applications (available in Turkish only)
5 See the website of the Digital Transformation Office of the Presidency of Turkey
6 See here
7 Personal Data Protection Law (No. 6698)
8 https://ticaret.gov.tr/haberler/reklam-kurulu-yapay-zeka-reklamlarini-ilk-kez-incelemeye-aldi (available in Turkish only)

Cameron Lee (Trainee Solicitor, White & Case, London) and Selin Kaledelen (Associate, White & Case, Istanbul) contributed to this publication.

[View source.]