Burhan Doğuş Ayparlar — AI and Technology Law Notes

AI Hub

Where to start

Reading paths through the site's AI-law pages, from beginner to advanced.

AI Insights Latest analysis All →

Legal Privilege · October 20, 2026

Is ChatGPT Confidential? AI Chats, Privilege and Turkish Law

Is ChatGPT confidential? Not in the way a conversation with your lawyer is. In United States v. Heppner, a New York federal court held in February 2026 that a defendant's own chats with an AI assistant were neither privileged nor work product, and in the OpenAI copyright litigation courts ordered ChatGPT logs preserved and produced. This analysis explains those rulings, the courts that disagree, and how Turkish law answers the same questions through the Attorneys' Act, the CMK, the HMK and the KVKK.

EU AI Act · October 20, 2026

EN 18286 vs ISO 42001: The First Harmonised EU AI Act Standard

EN 18286 is the first harmonised standard under the EU AI Act: a quality management system standard whose reference was published in the Official Journal on 14 October 2026. Providers of high-risk AI systems that apply it now benefit from a presumption of conformity with Article 17. This analysis compares EN 18286 with ISO/IEC 42001, explains what the presumption covers and where it stops, why certification is a different thing, and what it means for Turkish and Korean exporters ahead of the 2027 and 2028 deadlines.

EU AI Act · October 20, 2026

AI Act Nudification Ban: What Changes on 2 December 2026

The AI Act nudification ban applies from 2 December 2026, when AI systems that generate non-consensual intimate images of real people or child sexual abuse material become prohibited in the EU. This analysis explains what the Digital Omnibus added to Article 5, who it reaches, the Article 50(2) marking deadline for systems already on the market, and how Turkish and Korean law treat the same images.

KVKK · October 8, 2026

KVKK's Employee E-mail Monitoring Principles and AI Tools

On 8 October 2026 Türkiye's data protection authority published Board principle decision No. 2026/2035 of 16 September 2026 on employers' monitoring of corporate e-mail and work channels. Its sixteen points hold that owning a tool is not a licence to monitor it without limit, that a general "e-mail may be monitored" notice does not by itself satisfy Article 10, that consent is suspect in employment, and that content review as a rule needs a concrete suspicion and must not be general or continuous. The decision never mentions AI. We explain why it nonetheless sets the limits for AI e-mail scanning, productivity analytics and sentiment scoring, set against Constitutional Court case law, Bărbulescu, the EU AI Act and Korean law.

EU Copyright and AI Consultation: Opt-Outs, Presumptions and Payment

On 29 September 2026 the European Commission opened a targeted consultation on copyright and AI that puts unusually concrete options on paper: EU standards and a registry for text-and-data-mining opt-outs, a duty on crawlers and AI agents to identify themselves, a rebuttable presumption of use where AI providers fail their AI Act transparency duties, confidential disclosure in place of the published domain list, and new compensation and remuneration rights. This analysis reads the questionnaire itself, sets it against Articles 3 and 4 of the DSM Directive, Article 53 of the AI Act and the German case law, and explains what it means for Turkish and Korean developers and rights holders. Responses close on 3 November 2026.

Thomson Reuters v. ROSS: Third Circuit Rejects AI Training Fair Use

On 29 September 2026 the US Court of Appeals for the Third Circuit held in Thomson Reuters v. ROSS Intelligence that Westlaw's headnotes are original and that copying them to train a competing, non-generative AI legal-research tool was not fair use. It rejected ROSS's intermediate-copying defence because the judicial opinions themselves were freely available: "ease is not a justification for copying". It also recognised harm to a developing market for licensing headnotes as AI training data, while setting generative AI aside in a footnote. This analysis looks at the four factors as the court applied them, what the ruling means for Kadrey and the OpenAI litigation, and how the same facts would be treated under EU law, Turkish FSEK and Korea's fair-use clause.

AI Safety · September 21, 2026

UN AI Panel's First Brief: Loss of Control and the Legal Questions

The UN's AI Scientific Panel published its first thematic brief on 21 September 2026, on AI agents and the risk of losing human control, built around the OpenAI and Hugging Face incident. This note checks the brief against OpenAI's, METR's and Hugging Face's reports, explains who counted the agents, notes that the brief issues no recommendations, and shows where it touches the EU AI Act, California's SB 53 and Turkish law.

Legal Practice · September 17, 2026

AI Hallucination Cases: What Fabricated Citations Mean for Lawyers

A public database listed 2,246 court decisions worldwide on AI-fabricated legal material on 2 November 2026, and Türkiye has its own reported case in Ankara. This note sets out what courts have done, from small fines to setting judgments aside, what the Turkish Bar's guide of 28 August 2026 says, what is known about the Ankara inquiry, and what checking a citation actually requires.

Frontier AI · September 14, 2026

California's SB 53 One Year On: Frontier AI Transparency Explained

California's SB 53 requires the largest frontier AI developers to publish how they manage catastrophic risk and requires frontier developers to report critical safety incidents to the state. It was signed on 29 September 2025 and has applied since 1 January 2026. This note explains who is covered, what the text requires, what is known about its first ten months, and how it compares with the EU AI Act, with points for Türkiye.

Data Protection · September 13, 2026

Korea's PIPA Amendment: AI Training on Personal Data Without Consent

South Korea has amended its Personal Information Protection Act so that personal data collected for other purposes may be used to develop AI without consent, but only with approval from its data protection commission. Law No. 21910 was promulgated on 8 September 2026 and applies from 9 March 2027. This note sets out the three requirements, the procedure and open questions, and compares the EU and Turkish positions.

Swipe right to see more analyses

Legislation covered

EU AI Act
GDPR
KVKK
FSEK
EO 14110
CAIA
NAIS
SDAIA
PDPL

Case database

AI jurisprudence

Open the database

99decisions · 22 jurisdictions

Decision of the day

Brazil · 2 July 2024

Brazil’s data protection authority halts Meta’s use of personal data to train generative AI

Brazil’s ANPD ordered Meta to suspend the AI-training part of its new privacy policy and the related processing, on pain of a daily fine.

Decision. On 2 July 2024 the Board ordered, until further decision, the immediate suspension in Brazil of the part of Meta’s new privacy policy covering the use of personal data to train generative AI, and of the processing of personal data for that purpose across all…

Read the summary

Resources · EU AI Act

Compliance kits

Blank templates you can fill in yourself. No sign-up.

All guides

Article 50 compliance kit

Six ready-to-fill templates plus a compliance register, for the transparency obligations.

Download 02

Corporate AI use policy

Shadow AI, prohibited input categories and a data-leakage incident protocol.

Download 03

High-risk classification form

Scope, role and Article 6 / Annex III classification, with the Article 99 thresholds.

Download 04

AI agent authorisation protocol

Limits of authority, human approval thresholds, disclosure and rollback.

Download 05

Copyright and commercial-use checklist

Ownership, provider terms and infringement screening for images, text and code.

Download 06

AI hiring discrimination risk form

Indirect discrimination screening, human oversight and a candidate notice.

Download

The practice

AI regulation, data protection and technology contracts.

Burhan Doğuş Ayparlar is an attorney at law (Türkiye). His practice areas include AI regulation, data protection and technology contracts, in particular under the EU AI Act, GDPR and KVKK.

The notes and analyses on this site are for general information only and do not constitute legal advice.

Practice areas

EU AI Act conformity

Guidance on risk classification, conformity pathways, and drafting technical and transparency documentation for regulatory submission.

KVKK & GDPR data governance

Establishing lawful processing bases, conducting data protection impact assessments (DPIAs), and structuring cross-border data transfers for compliance.

Legal & ethical compliance review

Gap analysis and legal opinions on the conformity of AI systems with applicable regulation.

AI governance & policy

Drafting and implementation of internal AI governance policies, including model card frameworks, human-in-the-loop designs, and response protocols.

Contracts & IP for AI

Drafting and negotiation of AI-specific contracts: data licensing, vendor agreements, IP ownership, and allocation of liability.

Early-stage projects

Legal review of early-stage AI projects in preparation for regulatory scrutiny.

Method

A defensible, documented path.

Scope Definition and Mapping

Mapping the systems, data flows and legal obligations relevant to the specific project.
OutputSystem and data-flow map
Risk and Compliance Analysis

A risk-based, prioritised gap analysis against the EU AI Act, KVKK and the GDPR.
OutputPrioritised gap list
Improvement and Integration

Phased revision of compliance documentation, internal policies and AI-specific contract terms.
OutputUpdated policies and contracts
Legal Certification and Opinion

A signed legal opinion summarising the review process and the resulting compliance status.
OutputSigned legal opinion

131 funds in liquidation: when will they be paid?

AI Washing: Korea Drafts a Guideline on AI Advertising

Judge Used AI: 5th Circuit Vacates Injunction and Reassigns Case

Digital Omnibus GDPR Changes: The Council's Position Explained

SCHUFA BGH Ruling: When a Credit Score Is an Automated Decision

Machinery Regulation and AI: Türkiye Adopts EU 2023/1230 Rules

EU AI Act Enforcement Begins: AI Office Questions Frontier Labs

States Suing OpenAI: Eight AGs Allege ChatGPT Misled Parents

Law No. 7596: How Investors in Liquidated Turkish Funds Are Paid