Correction (19 October 2026): Several supporting references have been corrected: the Turkish-law note to Article 8 now names the Administrative Judicial Procedure Law No. 2577 (İYUK), the UK body is now called the AI Security Institute, the 2023 US Executive Order 14110 cited for watermarking was revoked in January 2025, not "all" AI laws exclude military uses, and the "10 times a search" electricity figure is now presented as a contested 2024 estimate.

A Draft Artificial Intelligence Act for Turkey: A 100-Article Blueprint

This draft bill turns the socio-economic analysis in the first 4 parts of our report series into statutory text. It is intended as more than a list of prohibitions: a pioneering text that protects employment, secures copyright, makes room for innovation, and, above all, places human dignity at its center.
PART ONE: Purpose, Scope, and Basic Principles (Articles 1-10)

Article 1: Purpose of the Act

The purpose of this act is to ensure that AI systems are developed, deployed, and used in a manner consistent with human dignity, fundamental rights, and democratic values, and to protect employment and public safety while supporting technological innovation.
  • Rationale: To put the rule of law and human beings, rather than technological determinism, at the heart of the legislation.
  • Global Context: Similar to the EU AI Act (Article 1) but distinguished by its strong emphasis on employment.
  • Turkish Law: Directly linked to Article 5 of the Constitution (Fundamental Aims and Duties of the State).

Article 2: Scope

This act applies to all public institutions, natural persons, and legal entities that develop, deploy, import, or use AI systems within the borders of the Republic of Turkey. AI systems intended solely for national security and military purposes fall outside the scope of this act.
  • Rationale: To regulate civil and commercial life without tying the hands of the defense industry (e.g., UAV/UCAVs).
  • Global Context: Major AI laws, such as the EU AI Act (Art. 2(3)), exclude military, defence and national-security uses.
  • Turkish Law: Leaves room for Defense Industry Agency legislation.

Article 3: Extraterritorial Effect

All AI systems whose outputs affect users in Turkey or that process the data of Turkish citizens are subject to this Act, even if their developers or servers are located abroad.
  • Rationale: To prevent US tech giants (such as OpenAI and Google) from claiming an exemption on the ground that "our headquarters are in the US."
  • Global Context: The "Brussels Effect" logic of the GDPR and the EU AI Act.
  • Turkish Law: Compatible with the extraterritorial doctrine in KVKK (Data Protection Law) and Internet Law No. 5651.

Article 4: Definition of Artificial Intelligence

AI System: A machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.
  • Rationale: To distinguish between a simple calculator and a learning algorithm.
  • Global Context: Based on the OECD's updated 2023 definition, widely recognized as the international standard.
  • Turkish Law: Provides the clear definition that the principle of legal certainty requires before penalties can be imposed.

Article 5: Human-Centricity and the Human Decision Principle

AI serves as an assistant or advisor that augments human capacity; it does not replace humans as the final decision-maker. In critical matters, the final decision always rests with a human.
  • Rationale: To build a society that governs the machine rather than submitting to it.
  • Global Context: UNESCO Recommendation on the Ethics of AI.
  • Turkish Law: Ensures that administrative acts (e.g., tax penalties) are issued by human officials, not machines.

Article 6: Principle of Transparency

Individuals interacting with an AI system must be able to understand clearly and easily that they are dealing with a machine, not a human being.
  • Rationale: To prevent emotional manipulation and deception (e.g., in customer service).
  • Global Context: Transparency obligations under the EU AI Act.
  • Turkish Law: Consumer Protection Law - The right to accurate information.

Article 7: Ban on Algorithmic Discrimination

AI systems may not be trained or used to discriminate based on race, language, religion, gender, political opinion, philosophical belief, or regional affiliation (zip code).
  • Rationale: To prevent algorithms from exhibiting latent racism or bias in hiring or credit scoring.
  • Global Context: US Algorithmic Accountability Act (Draft).
  • Turkish Law: Constitution Article 10 (Equality before the law).

Article 8: Explainability (XAI) Principle

Where an AI decision adversely affects an individual (e.g., a loan denial or job rejection), the parameters on which it is based must be explained in language citizens can understand. The "black box" excuse is not accepted.
  • Rationale: Citizens cannot exercise their right of appeal without knowing the reasons for a decision.
  • Global Context: "Right to Explanation" (GDPR and EU AI Act).
  • Turkish Law: Constitution Art. 40 and the Administrative Judicial Procedure Law No. 2577 (İYUK) (right to a reasoned decision).

Article 9: Principle of Environmental Sustainability

Companies training Large Language Models (LLMs) must report annually on their servers' energy consumption, their carbon footprint, and their water use.
  • Rationale: By some 2024 estimates (IEA), a chatbot query used around ten times the electricity of a web search; later estimates vary widely.
  • Global Context: The Green AI doctrine.
  • Turkish Law: Integrated monitoring obligations under the Environmental Law.

Article 10: Pro-Innovation Principle

In applying this act, the utmost care shall be taken to ensure that administrative measures do not impose disproportionate bureaucratic burdens that would hold back local startups and academic research.
  • Rationale: To avoid creating a "Regulatory Capture" wall where only Big Tech can survive.
  • Global Context: The UK's Pro-Innovation approach to AI.
  • Turkish Law: Freedom of enterprise and R&D incentives.
PART TWO: Risk Classification and Banned Systems (Articles 11-20)

Article 11: Four-Tiered Risk Approach

AI systems are categorized into four tiers based on their potential to harm society: Unacceptable Risk, High Risk, Limited Risk, and Minimal Risk. Audits and obligations apply in proportion to the level of risk.
  • Rationale: So that a spam filter and an autonomous vehicle are not held to the same legal standard.
  • Global Context: The global standard risk pyramid adopted by the EU.
  • Turkish Law: Applies the administrative-law principle of proportionality to technology.

Article 12: Banned AI - Social Scoring

Systems operated by the state or by private companies that score citizens' general behavior or social media activity and, on the basis of those scores, deny them credit, travel, or public services are banned in Turkey.
  • Rationale: To prevent a "digital dictatorship" along the lines of China's model.
  • Global Context: EU AI Act Prohibited Practices (Article 5).
  • Turkish Law: An absolute violation of human rights and the principle of equality.

Article 13: Banned AI - Subliminal Manipulation

AI techniques that target the subconscious, impair free will, and alter behavior in ways that cause physical or psychological harm (impulsive consumption or self-harm) are banned.
  • Rationale: To prevent dark patterns that exploit the human mind.
  • Global Context: Neuro-rights and Cognitive Liberty movements.
  • Turkish Law: Penal Code (vitiation of will) and Consumer Law (unfair commercial practices).

Article 14: Banned AI - Real-Time Biometric Identification in Public Spaces

Real-time, non-consensual biometric facial recognition and profiling in public squares, streets, or shopping malls by private companies or institutions is banned. Law enforcement agencies are exempt only under strict conditions.
  • Rationale: The sense of constant surveillance (the Panopticon effect) damages society's psychological health.
  • Global Context: San Francisco facial recognition ban and EU AI Act exceptions.
  • Turkish Law: Violation of KVKK Article 6 (Special category personal data).

Article 15: Banned AI - Emotion Recognition in Workplace and Education

"Emotion Recognition" systems that analyze the micro-expressions or tone of voice of employees at work or students at school in order to measure and profile their fatigue, sadness, or productivity continuously are banned.
  • Rationale: So that employees are not kept permanently on edge under a machine's watch.
  • Global Context: The specific ban the EU AI Act introduced for workplaces and educational institutions.
  • Turkish Law: Labor Law (limits of employee surveillance and privacy).

Article 16: Banned AI - Biometric Categorization

The use and sale of AI systems that attempt to infer individuals' sexual orientation, political views, or religious beliefs from their facial features or biometric data are banned.
  • Rationale: To prevent the pseudoscience of phrenology from returning through AI.
  • Global Context: Ban on profiling contrary to human dignity.
  • Turkish Law: KVKK (Non-consensual inference of sensitive data).

Article 17: Banned AI - Exploitation of Vulnerabilities

AI systems that exploit vulnerabilities arising from the age, health, or social situation of children, older people, or people with mental or physical disabilities, and thereby cause them pecuniary or non-pecuniary harm, are banned.
  • Rationale: Protecting disadvantaged groups from AI bots that approach them as "friends."
  • Global Context: UNICEF AI Ethics guidelines.
  • Turkish Law: Civil Code (Incapacity) and Penal Code (Fraud).

Article 18: Banned AI - Predictive Policing (Minority Report)

Judicial AI systems that use an individual's past data to calculate the percentage probability that they will commit a crime in the future, and recommend preventive arrest or detention on the basis of that prediction, are banned.
  • Rationale: To protect the presumption of innocence (innocent until proven guilty).
  • Global Context: A safeguard against scandals such as the US COMPAS system's unjust treatment of minorities.
  • Turkish Law: Principle of the presumption of innocence under the Criminal Procedure Code (CMK).

Article 19: Scope Exceptions for Bans

The bans in Articles 12 to 18 may be relaxed, by way of exception, in emergencies involving counter-terrorism, serious organized crime, or national security, and only under an order from an independent court (judicial authorization).
  • Rationale: So that the state is not left powerless in a serious national security crisis (e.g., tracking a suicide bomber).
  • Global Context: The law enforcement exception in the EU AI Act.
  • Turkish Law: Constitution Article 13 (Restriction of fundamental rights by law for public safety).

Article 20: Penalties for Violating Bans

Companies that develop, sell, or deploy the banned (Unacceptable Risk) AI systems specified in this Part in the Turkish market are subject to administrative fines of up to 7% of their global turnover or 500 Million TL (whichever is higher).
  • Rationale: To maximize deterrence, so that Big Tech cannot treat breaching the bans as a mere "cost of doing business."
  • Global Context: An asymmetric, proportional penalty structure similar to those of the GDPR and the EU AI Act.
  • Turkish Law: Turnover-based penalty model similar to Competition Authority fines.
PART THREE: High-Risk Systems and Transparency (Articles 21-30)

Article 21: Definition of High-Risk AI Systems

AI systems used in critical infrastructure management, transport (autonomous vehicles), education (grading), employment (CV screening algorithms), law enforcement, and judicial systems are considered "High-Risk" and are subject to strict audits before being placed on the market.
  • Rationale: Identifies the sectors in which AI can permanently change people's lives.
  • Global Context: The "Annex III" list forming the core of AI laws.
  • Turkish Law: An umbrella definition for sectoral regulations (Ministry of Health, BRSA).

Article 22: Algorithmic Impact Assessment

Providers deploying a high-risk AI system must prepare and submit to the Authority an "AI Impact Assessment Report" analyzing the system's effects on fundamental rights, employment, and the environment.
  • Rationale: To deal with risks before a product is sold, rather than selling it and then denying responsibility.
  • Global Context: Canada's Algorithmic Impact Assessment (AIA) model.
  • Turkish Law: EIA (Environmental Impact Assessment) logic from the Environmental Law.

Article 23: Data Quality and Bias Testing

Datasets used to train high-risk systems must reflect Turkey's demographic realities and cultural makeup and, to prevent discrimination, must be free of erroneous or missing data. Data quality must be documented.
  • Rationale: AI trained on flawed data makes flawed decisions ("garbage in, garbage out").
  • Global Context: Data governance and model training transparency standards.
  • Turkish Law: Compliance with the standards of the Human Rights and Equality Institution of Turkey (TİHEK).

Article 24: Human Oversight and the Kill-Switch

High-risk AI systems must be designed so that a human can understand them at any time and intervene in or disable them instantly, through a hardware or software "Manual Kill-Switch" mechanism.
  • Rationale: Provides the physical means to stop an autonomous system before it spirals out of control (emergent behavior) and causes a disaster.
  • Global Context: Asimov's Laws of Robotics and modern "Stop-Button" regulations.
  • Turkish Law: The emergency stop button logic found in Occupational Health and Safety machinery regulations.

Article 25: Logging and Record-Keeping Obligation

High-risk systems must maintain a cryptographically immutable "event log" of the critical decisions they make, the errors that occur, and the human interventions made throughout their lifecycle.
  • Rationale: Creates digital evidence, so that the "black box" excuse cannot be raised in court when an AI error leads to litigation.
  • Global Context: EU AI Act Article 12 (Record-keeping).
  • Turkish Law: Logging (digital footprint) obligation under Law No. 5651.

Article 26: Limited Risk: Transparency in Generative AI

Systems that generate text, audio, images, or video (ChatGPT, Midjourney, etc.) must clearly inform the user: "This content was generated by artificial intelligence."

Article 27: Deepfake and Watermark Mandate

All Generative AI platforms operating in Turkey must embed an indelible digital watermark in the pixel or frequency data (metadata) of the images, video, and audio they produce.
  • Rationale: Allows fake evidence and influence operations to be detected immediately during elections or criminal proceedings. This is a matter of national security.
  • Global Context: The watermarking provisions of the 2023 White House Executive Order 14110 on AI (revoked in January 2025).
  • Turkish Law: Provides the infrastructure to detect forgery and disinformation offenses under the Penal Code.

Article 28: Identity Disclosure in Chatbots

Companion AIs used for customer service, therapy, psychological support, or friendship must state "I am not a human; I am AI software" at the start of a conversation and periodically during it.
  • Rationale: To prevent dangerous "emotional bonds" (parasocial interaction) and false impressions, especially among children and lonely adults.

Article 29: TR-AI Conformity Mark (CE Equivalent)

High-risk AI systems must obtain a "TR-AI Safety Mark" before being placed on the market, certifying that they meet the safety, transparency, and ethical requirements of this act. Systems without this mark may not be sold or used.

Article 30: Post-Market Surveillance

Because AI systems keep changing through machine learning, the Authority audits them periodically while they are in use, even after approval. Systems that exhibit model drift are recalled from the market.
PART FOUR: Governance - Turkey Artificial Intelligence Authority (Articles 31-40)

Article 31: Establishment of the Turkey Artificial Intelligence Authority (TAIA)

The Turkey Artificial Intelligence Authority (TAIA) is hereby established, with administrative and financial autonomy, to implement this act, carry out audits, and execute the national AI strategy.
  • Rationale: No single existing institution can handle AI violations in health, finance, or agriculture. A horizontal technology needs a horizontal, independent supervisory authority.
  • Global Context: The UK AI Security Institute (formerly the AI Safety Institute) and the EU AI Office.

Article 32: TAIA Staff Structure and Merit

The Authority's staff may not consist solely of lawyers and bureaucrats. At least fifty percent of its staff must be data scientists, algorithm engineers, sociologists, and ethicists.
  • Rationale: A bureaucracy that does not understand technology cannot audit code and model weights. The Authority must be able to match Big Tech in speed and expertise.

Article 33: Digital Forensics Powers (Black Box Review)

Where there is a complaint or a suspected serious violation, TAIA may, under a court order, examine the source code and training datasets of technology companies' proprietary algorithms in a laboratory setting.

Article 34: Open Source Incentive

The Authority allocates dedicated funds to help academic institutions and startups in Turkey develop "Open Source" AI models. Because open-source systems are inherently transparent, they are exempt from certain administrative audits.

Article 35: Coordination with Sectoral Regulators

Medical AI systems are audited by joint commissions of TAIA and the Ministry of Health, and financial AI systems by joint commissions of TAIA and the BRSA. TAIA sets the umbrella rules; sectoral regulators conduct vertical audits.

Article 36: An Independent Algorithm Audit Sector

TAIA licenses "Authorized Private Algorithm Audit Firms" to test AI systems on the market. Much like certified public accountants, these firms conduct independent ethics and security audits of AI systems.
  • Rationale: The state cannot examine every piece of software on its own. A new private-sector field of employment, "Algorithm Auditing," must be created.

Articles 37-40: International Cooperation, Literacy, Whistleblowers, and Annual Reports

TAIA may sign information-sharing agreements with AI authorities in other countries. It runs "Algorithm Literacy" campaigns for the public. Engineers who blow the whistle on dangerous AI models are protected by law from dismissal. TAIA submits an annual "State of AI Report" to Parliament, with quantitative data on the impact on employment and the economy.
PART FIVE: Employment, Quotas, and Working Life (Articles 41-50)

Article 41: Sectoral "Human-in-the-Loop" Quota

In labor-intensive service sectors such as call centers, banking, and retail, handing 100% of customer transactions end to end to AI bots is banned. Businesses must employ human support staff to handle at least 25% of the transaction volume.
  • Rationale: To stop companies from plunging the country into mass unemployment in pursuit of lower costs, and to give consumers the right to "speak to a real person."

Article 42: The AI-as-Assistant Doctrine

In decisions that directly affect a person's health, liberty, or career (medical diagnosis, judicial rulings, recruitment), AI may never be the final "Decision Maker"; it may be used only as an "Assistant." The signature and final approval must always be a human's.

Article 43: AI Automation Tax

If a business replaces human workers (e.g., 10 people) with licensed AI software running on a single computer and its net headcount falls as a result, it must pay an "Automation Tax" of 15% of the resulting savings in labor costs (salaries and social security contributions).
  • Rationale: To stop companies from shifting the cost of mass unemployment onto the state (and so onto society) while they profit, and to regulate this transfer of wealth.

Article 44: Universal Reskilling Fund

Revenues from the Automation Tax (Article 43) are paid directly into a "Reskilling Fund" rather than to the Treasury. The fund may be used solely to finance training for new technology roles (data analyst, drone pilot, etc.) for people who lose their jobs to AI.

Article 45: Employment Impact Assessment Report (EIAR)

Businesses with more than 250 employees must submit an EIAR to the state and to the workplace union at least 6 months before moving to large-scale AI automation. The report must state how many people will be displaced and set out the plan for redeploying them to other departments (rotation).

Article 46: Human-AI Synergy Corporate Tax Deduction

A business that adopts AI without reducing total employment, and instead maintains or increases it by using AI-driven productivity to create new departments, receives a "Synergy Corporate Tax Deduction" (5%).

Article 47: Ban on Algorithmic Performance Profiling (Workplace Tyranny)

AI systems that track employees' bathroom breaks, screen time, and typing speed second by second to generate a "Productivity Score," forcing them to work at a superhuman, machine-like pace, are banned in the workplace.

Article 48: Algorithmic Management and Union Transparency

The core logic of the AI algorithms that set wages, shifts, and penalties for couriers and drivers on gig-economy platforms must be transparent and disclosed to their labor unions.

Article 49: Algorithmic Interview Limits in HR

Using AI in video interviews to screen out candidates by analyzing biometric data such as tone of voice, pupil movement, or sweating and labeling them "lying" or "unsuitable" is strictly prohibited. CV-screening bots may consider only objective criteria (years of experience, education).

Article 50: AI and the Right to Disconnect

The fact that AI assistants run 24/7 does not mean human employees can be expected to respond 24/7. The law guarantees a "Right to Disconnect," allowing employees to turn off AI notifications and emails outside working hours.
PART SIX: Data Sovereignty, Privacy, and Security (Articles 51-60)

Article 51: Local LLM Mandate for Critical Infrastructure

AI assistants integrated into the state's critical infrastructure, such as defense, health, justice (UYAP), and energy grids, must be "Local" AI models whose servers are physically located within Turkish borders and whose source code is open to the state. Foreign cloud APIs may not be integrated into these systems.

Articles 52-55: Synthetic Data, Data Localization, Cloud Audit, and Machine Unlearning

Public health and financial data used to train AI must first be converted into "Synthetic Data." Bulk transfers of Turkish users' behavioral data abroad by global tech giants require TAIA's permission and are subject to a data tax. Citizens whose data was scraped without consent may demand "Machine Unlearning" under the KVKK, and companies must retrain their models if necessary.

Articles 56-60: Cybersecurity and Data Poisoning

External "Data Poisoning" attacks on AI models are classified as "Hacking and Disrupting Information Systems" under the Penal Code. AI providers must secure their APIs to military-grade standards.
PART SEVEN: Copyright, Intellectual Property, and Media (Articles 61-70)

Article 61: Copyright in Training Data and the "Opt-Out" Mechanism

Training AI on copyrighted works without authorization is treated as temporary copying for the purposes of "Machine reading." Creators, however, have an absolute right to prohibit it by adding a simple "Opt-Out" code to their websites. Scraping data in disregard of an opt-out constitutes copyright infringement.

Articles 62-70: Dataset Transparency, Public Domain Output, Adapted Work, and Link Tax

Generative AI companies must publish Training Data Transparency Reports. Purely AI-generated output (produced from a prompt alone) falls immediately into the "Public Domain" and cannot be copyrighted. Where a human substantially edits an AI draft, however, the result is protected by copyright as an "Adapted Work." Scraping breaking news through LLMs triggers a mandatory "Link Tax" payable to publishers. Cloning a person's voice without consent constitutes aggravated fraud.
PART EIGHT: Legal Liability, Compensation, and Consumers (Articles 71-80)

Article 71: "Strict Liability" for High-Risk AI

If a high-risk AI system (e.g., a surgical robot) harms a person, the company deploying it cannot escape liability by claiming that the AI learned on its own (black box). The company is strictly liable for damages, whether or not it was directly at fault.

Articles 72-80: Burden of Proof, Mandatory Insurance, Algorithmic Pricing, and Joint Liability

The "Burden of Proof" shifts from the victim to the AI company. Commercial deployers of high-risk AI must hold "Mandatory AI Liability Insurance." Discriminatory, AI-driven "Dynamic Pricing" that exploits consumers' vulnerabilities is banned. Start-ups that fine-tune open-source models are jointly and severally liable with the original developer for major errors.
PART NINE: Education, Neuro-Rights, and Protection of Democracy (Articles 81-90)

Article 81: Neuro-Rights (Cognitive Liberty and Mental Privacy)

All AI systems that track, read, or manipulate citizens' brainwaves, thoughts, or neurological responses through wearables or Brain-Computer Interfaces (BCI) for commercial purposes are banned. "Mental Privacy" is constitutionally inviolable.

Articles 82-90: Child Protection, Educational Limits, Election Security, and Bot Transparency

Companion AI for under-18s requires parental consent and Age Verification. Screen time with AI tutors in schools is capped to protect children's social development. Spreading political "Deepfakes" in the 90 days before an election is punishable as "Usurpation of Democratic Will." Social media bots must be labeled with a "🤖 BOT" icon.
PART TEN: Sandbox, Sanctions, and Enforcement (Articles 91-100)

Article 91: Establishing a Regulatory Sandbox

TAIA operates a closed "Sandbox" in which local start-ups and universities can safely test new AI models before releasing them. During the testing period, entrepreneurs conducting R&D in the sandbox are exempt from heavy legal liability, bureaucracy, and fines.
  • Rationale: To keep fear of penalties from stifling innovation and talent.

Article 92: Proportional Administrative Fines (Asymmetric Sanctions)

Fines of up to 2% of global annual turnover (or 100M TL) apply to transparency violations; up to 4% (or 500M TL) to violations of the High-Risk rules; and up to 7% (or 1 Billion TL) to violations involving Banned Systems.
  • Rationale: Fixed fines are pocket change for Big Tech. Sanctions must be percentage-based to bite.

Article 93: Asymmetric Discounts for SMEs and Start-Ups

For local SMEs, newly established start-ups, and academic centers, the fines in Article 92 are reduced by 90%, or a first violation may result only in a "Warning/Correction."

Article 94: Personal Criminal Liability of Executives (Imprisonment)

In addition to corporate liability, CEOs, board members, and Chief Data Officers (CDO) who directly and knowingly approve the development of AI models that endanger human health, deliberately discriminate, or manipulate elections (deepfakes) face imprisonment in their personal capacity under the Penal Code.

Articles 95-100: Recall, Blocking, Grace Period, and Enforcement

Dangerous AI is subject to immediate Recall from the market and to blocking of its Cloud APIs under Law No. 5651. High-Risk AI already on the market has a 24-month Grace Period. TAIA will issue technical regulations within 6 months. The Act enters into force 1 year after its publication in the Official Gazette.