What is AI regulation in Turkey?

How it works

The current model: layered regulation, not one AI code

As at 6 June 2026, Turkey's AI framework is best understood in four layers:

Existing binding laws that apply to AI depending on the use case. Official policy instruments, especially the National Artificial Intelligence Strategy 2021-2025 and its updated action planning. Regulator guidance and soft law, led by KVKK on personal data and AI. Draft legislation and standards activity that may become more important as Turkey moves from strategy to implementation.

This means the legal answer depends on what the AI system does. A recruitment scoring tool, a customer chatbot, a biometric identity system, a medical triage tool, a credit risk model and a generative AI content tool may all sit under different combinations of rules.

Turkey has not yet adopted the EU AI Act. It has not yet enacted a full domestic equivalent. However, the proposed bills show that Turkish legislators are considering risk assessment, high-risk systems, conformity assessment, registration, deepfake content controls, platform responsibility, dataset governance and penalties.

The National Artificial Intelligence Strategy 2021-2025

Turkey's National Artificial Intelligence Strategy 2021-2025 was prepared by the Presidency Digital Transformation Office and the Ministry of Industry and Technology. It is a policy framework, not a directly enforceable AI statute.

The strategy sets six broad priorities:

Training AI experts and increasing employment in the field. Supporting research, entrepreneurship and innovation. Expanding access to quality data and technical infrastructure. Making regulatory arrangements for social and economic adaptation. Strengthening international cooperation. Accelerating structural and labour transformation.

For governance, the strategy describes a two-layer structure. One layer is for high-level steering and strategic alignment. The other is for administrative, technical and legal coordination, including AI values and principles. It also refers to working groups on trustworthy and responsible AI, AI law and ethics, regulatory sandbox frameworks, guides, data spaces, a public AI ecosystem and an AI portal.

For businesses, the strategy is not a checklist of binding duties. It is still important because it shows the direction of travel: data governance, accountable AI, trustworthy AI, legal coordination and public sector capability are central themes.

KVKK and personal data protection

KVKK is the main binding law for many AI systems in Turkey. It applies to natural persons whose personal data is processed and to natural or legal persons processing that data by automated means, or by non-automated means where the processing forms part of a filing system.

For AI, the most important KVKK duties are likely to include:

identifying a lawful basis for processing personal data meeting transparency obligations when collecting personal data limiting data to specified, explicit and legitimate purposes keeping data relevant, limited and proportionate applying security measures respecting data subject rights controlling special category data managing processor and controller roles handling retention, erasure, destruction or anonymisation assessing cross-border transfer routes for cloud, model hosting and vendor access

KVKK has also published AI-specific recommendations. These are not the same as a binding AI statute, but they are highly relevant to regulator expectations. KVKK's AI recommendations emphasise fundamental rights, lawfulness, fairness, proportionality, accountability, transparency, accuracy, limited use, security, privacy by design and privacy impact assessment where personal data processing creates high risk.

More recently, KVKK has published material on workplace use of publicly accessible generative AI tools and agentic AI. The workplace guidance highlights the risk that employees may use public AI tools without a clear organisational policy, making monitoring and control difficult. The agentic AI material reflects the growing concern that AI systems which plan, adapt and take actions can create more complex data protection issues across their lifecycle.

Cross-border data transfers and cloud AI

Cross-border transfers are a practical pressure point for AI in Turkey. Many AI systems rely on cloud hosting, model APIs, overseas analytics, remote support, global product teams or multi-country data lakes.

In 2024, Article 9 of KVKK on international transfers was amended by Law No. 7499. KVKK then published English translations of the By-Law on the Procedures and Principles for the Transfer of Personal Data Abroad and standard contract texts. This matters because AI vendors and deployers may need to map when Turkish personal data is sent outside Turkey or made accessible from abroad, and then select a lawful transfer route.

For leaders, the key point is that AI vendor review in Turkey is not only a model risk question. It is also a data flow, hosting, access control, contractual and transfer mechanism question.

Draft AI and AI-related legislation

Turkey has several AI-related proposals before Parliament. Their status matters because they indicate policy direction, but they should not be treated as enacted law unless and until passed.

The 2024 Artificial Intelligence Law Bill, registered as TBMM bill 2/2234, is a broad draft AI law. It covers AI system providers, distributors, users, importers, distributors and affected persons. The proposal includes principles such as security, transparency, fairness, accountability and privacy. It also refers to risk assessment, special measures for high-risk systems, conformity assessment, registration, monitoring, supervision and sanctions.

A later proposal, TBMM bill 2/3358, is a set of amendments to several laws rather than a single AI code. The draft would add an AI system definition to the internet law, address AI-related criminal responsibility, set content blocking and removal requirements for certain deepfake or unlawful AI-generated content, add dataset requirements into KVKK, give powers to BTK in urgent AI content cases and add cybersecurity-related duties for AI service providers. As at the research date, the TBMM record showed this bill as in commission.

Another narrower 2026 proposal, TBMM bill 2/3465, would amend KVKK Article 18 to impose fines on social media tools or digital platforms that allow the sharing of AI-generated audio, text or image messages without the person's permission. This too should be treated as proposed law, not enacted law, unless its parliamentary status changes.

The Trustworthy AI Seal and standards activity

Turkey is also developing a standards and certification layer. The Turkish Standards Institution has published information on the "Guvenilir Yapay Zeka Damgasi", or Trustworthy AI Seal, under the National Artificial Intelligence Strategy.

TSE describes the seal as a planned certification approach for assessing whether AI systems are developed and used ethically, securely, transparently and accountably, with reference to national and international standards. The stated assessment topics include technical infrastructure, data management, algorithmic transparency, human rights effects, bias and discrimination controls, security measures and accountability mechanisms.

The exact operational status needs checking at the point of use. TSE's public page describes the model and application route, while also stating that practical certification activity had not yet started at the stage described and would follow completion of infrastructure and process preparation. Leaders should not present the seal as a mature mandatory approval system unless confirmed by TSE's live process.

Turkey, the EU and the Council of Europe

Turkey is EU-adjacent in trade, data, supply chain and digital policy terms, but it is not an EU Member State and the EU AI Act does not automatically apply as Turkish domestic law.

However, the EU AI Act may affect Turkish organisations indirectly. This can happen where a Turkish provider places AI systems on the EU market, where an AI system's output is used in the EU, where a Turkish business supplies an EU-regulated customer, or where contracts require EU AI Act alignment.

Turkey is also a Council of Europe member and participated in the broader Council of Europe AI policy environment. The Council of Europe Framework Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law is relevant because it sets a human rights, democracy and rule of law model for AI governance. As at the research date, official sources confirmed the Convention and its principles, but public treaty listings and related public materials did not establish Turkey as having signed or ratified CETS No. 225. This point should be checked against the live Council of Europe Treaty Office record before publication updates.