A Proposed Turkish AI Act: Data, Copyright, Transparency and Liability

Correction (19 October 2026): Three statements have been corrected: the EU is Turkey's largest trading partner but does not account for half of its foreign trade; since the 2024 amendments, the KVKK allows transfers abroad on the basis of adequacy decisions or appropriate safeguards, with explicit consent only for occasional transfers; and whether data sent to foreign AI providers is used for training depends on the service and its terms.

An earlier article in this series looked at the socio-economic side of the artificial intelligence (AI) revolution: how far automation could cause unemployment across sectors and what quota measures might protect human employment.

A state cannot, however, approach technology in purely economic terms. Behind the economics sits the "legal infrastructure" that has to absorb these socio-economic shocks and keep the system standing. AI systems are more than lines of code: they act autonomously, making decisions, producing content, diagnosing illnesses, creating artworks, and sometimes "making mistakes." If a medical AI misdiagnoses a patient, whom does the patient sue? If a generative AI writes a new book by copying the style of a world-renowned author, who owns the copyright? May the health, financial, and educational data of citizens of the Republic of Turkey be used to train AI models on US-based servers?

This third and most detailed part examines the legal, ethical, and national security dimensions of the AI Act that Turkey should draft. It is intended as a reference for policymakers, legal professionals, data scientists, and anyone interested in the social impact of technology.

One of the most fundamental principles of law is the duty of justification: whether the decision is a court ruling, a bank's refusal of a loan, or the rejection of a job application, the person affected has the right to know why it was made. Modern AI systems built on deep learning and neural networks, however, work as a "black box" that even the engineers who created them cannot fully decode.

1.1 Explainability of Decisions (Explainable AI - XAI)

Millions of data points go into an AI system (input), and the system produces a result (output). Yet we cannot know exactly which of its billions of internal parameters carried weight, or which data point was preferred over another in reaching that result. This is the first major problem a prospective Turkish AI Act must solve.

Imagine a citizen applies for a loan and the bank's AI algorithm rejects the application in seconds. When the citizen asks the customer representative "Why was I rejected?", the answer cannot be: "The system decided so; we don't know how the algorithm works either." The law must give citizens a "Right to Request an Explanation." The European Union's AI Act regulates this issue strictly under its "High-Risk Systems" category.

1.2 Algorithmic Bias and Systematic Discrimination

AI does not emerge from a vacuum; it is built by humans and trained on historical data that humans produced. If an AI is trained on a dataset in which most engineers hired in the past were men, the system learns the damaging bias that "a good engineer is male" and starts automatically filtering out resumes from women. Amazon's now-abandoned AI recruiting tool did exactly this.

In Turkey, the same problem could touch even more sensitive social fault lines. An algorithm that filters out candidates by birthplace, the high school they attended, or the district they live in (postal code) would breach the constitutional principle of equality by technological means. The Act should provide for independent Algorithm Audit Firms to conduct Equality Audits and should require these algorithms to pass a "Discrimination Test" annually.

The Turkish Code of Obligations (TBK) and Turkish criminal law are built on the principle of fault (negligence). When damage occurs, the law looks for a human whose will was at fault. AI shakes this concept of human will to its core. If a fully autonomous vehicle hits a pedestrian, or an AI-assisted surgical robot cuts the wrong nerve, who is liable?

• The Software Developer? The developer might argue, "I just wrote the code; the system learned on its own (machine learning) and made this decision."
• The Manufacturing Company? The company might claim, "Our hardware was flawless; the user fed incorrect data into the system."
• The User (Doctor/Driver)? The user might state, "The system was autonomous; I had no chance to intervene."

This "liability gap" is one of the biggest obstacles to the widespread adoption of the technology: where there is no legal certainty, insurers cannot write policies, and where there is no insurance, investors will not take risks.

2.1 Strict Liability and "Mandatory AI Insurance"

The Turkish AI Act should adopt the principle of "Strict Liability" (Liability for Danger) for damage caused by autonomous systems. As with the liability of vehicle operators under the Highway Traffic Act or of operators of hazardous facilities under the Environmental Law, a company (operator) that places an AI system on the market for commercial purposes and profits from it should be liable, even without fault, for damage arising from decisions the system makes through self-learning.

2.2 Legal Personality and "Electronic Personhood" Debates

The European Parliament once debated a special "Electronic Personhood" status for highly advanced autonomous robots, but the idea has been shelved. For a Turkish law, granting AI legal personality (the capacity to hold rights and obligations) would be premature and dangerous. AI should be treated not as a "person" but as an advanced "tool/product" for which its owner or operator bears legal responsibility.

Generative AI models such as ChatGPT, Midjourney, DALL-E, and Claude do not appear out of thin air. They are "smart" only because they are trained on billions of articles, tables, lines of code, books, photos, and videos taken from the internet by "web scraping." The vast majority of that material is human-made and protected by copyright.

The copyright lawsuit brought by The New York Times against OpenAI and Getty Images' lawsuits against Stability AI are the first international signs of this crisis. Turkey's Law on Intellectual and Artistic Works (FSEK) dates from 1951, when AI was barely imaginable even in science fiction. The law has to be brought up to date.

3.1 Violation Regarding Training Data (Input) and "Fair Use"

May an AI company, whether a global giant or a Turkish startup, scrape the novels of Yaşar Kemal, the lyrics of Sezen Aksu, or the poems of Sabahattin Ali without permission to train its model? Tech companies argue that this is akin to "reading and learning," just as a person reads thousands of books before writing their own, and should count as "Fair Use." Creators counter that it is plain "unauthorized reproduction and commercial exploitation," in other words theft.

3.2 Who Owns the Copyright of the Generated Output?

Under Turkish Copyright Law (FSEK), copyright in a work belongs to the "human" who created it. But if a citizen types a highly detailed, multi-page prompt into Midjourney (e.g., "Hot air balloons flying over Cappadocia at sunrise, in the style of Van Gogh's Starry Night, in 4K resolution, with cinematic lighting") and generates an image, who owns the copyright in that image?

• Is it the citizen's? (Because they wrote the prompt and conceptualized the idea).
• Is it the AI company's? (Because the algorithm applied the brushstrokes).
• Is it the original painters', whose work was used to train the AI?
• Or has the work fallen into the "public domain," free of copyright?

Data is the "oil" of AI models. In Turkey today, millions of citizens, private companies, and public institutions upload vast amounts of data to US-based models such as ChatGPT, Claude, and Google Gemini to get their work done. That data ranges from correspondence, trade secrets, and draft patents to financial statements, personal health records, and even critical code from state infrastructure.

4.1 Cloud Computing and Cross-Border Data Transfer

Since the amendments made by Law No. 7499, in force from 1 June 2024, Turkey's Personal Data Protection Law (KVKK) makes transfers of personal data abroad subject to an adequacy decision or to appropriate safeguards such as standard contracts, with explicit consent available only for occasional, non-recurring transfers. The everyday use of AI assistants, however, has outpaced the law. Depending on the service and its terms, data sent to servers overseas (the cloud) may be retained and, particularly in consumer services, used to train those models further. In other words, Turkey's accumulated knowledge and critical data can flow abroad free of charge to enrich "closed algorithms" owned by foreign corporations.

"In the world of the future, sovereignty will not be measured by possessing a piece of land, but by owning your citizens' data and ruling over the algorithms that process that data."

4.2 Mandatory Use of Domestic Models in Critical Infrastructure

"Data Sovereignty" must lie at the heart of the national security provisions of a prospective Turkish AI Act. The defense industry, energy grid management, telecommunications, core financial systems, and health databases should be designated "Critical Infrastructure."

The European Union (EU) is Turkey's largest trading partner: in 2025 it took about 43% of Turkey's exports and supplied about 35% of its imports. The EU has adopted the world's first comprehensive Artificial Intelligence Act (EU AI Act) and is now implementing it. The "Brussels Effect" describes how the EU uses the size of its internal market to turn its rules into a de facto global standard for the rest of the world (as it did with the GDPR).

If Turkey wants to continue exporting software, autonomous vehicle parts, e-commerce services, or AI-supported industrial products to Europe, it must bring its own law into line with EU norms. Otherwise, an AI product made in Turkey that has not passed safety testing to EU standards will not get through customs or digital borders.

5.1 The Heart of the EU Model: The Risk-Based Approach

Turkey's law should not put all AI systems in a "single basket"; like the EU, it should classify them by risk level. A spam filter cannot be governed by the same rules as a driverless car or a judicial decision-support system.

5.2 The Proposed Four-Tier Risk Pyramid

The Act should divide AI systems into four categories:

1. Unacceptable Risk (Banned Systems): Systems that manipulate people subconsciously to their harm, "Social Scoring" systems of the kind used in China that constantly monitor, score, and profile citizens, and real-time biometric facial recognition in public spaces should be banned outright in Turkey.
2. High Risk (Strict Audit): AI used in transport, education, critical infrastructure, law enforcement, recruitment algorithms, and medicine. These systems should be registered with the state before they reach the market and should pass rigorous tests of safety, accuracy, transparency, and human oversight.
3. Limited Risk (Transparency Obligation): Chatbots, customer service bots, and deepfake/generative AI software. The only obligation in this category is "Transparency": the system must clearly tell the person interacting with it, "You are currently speaking with an AI, not a human," or "This image was generated by AI."
4. Minimal/Zero Risk (Free Market): AI in video games, spam filters, and simple inventory management bots. These should be free to develop and use without additional regulation.

Drafting AI law is about more than solving today's problems (unemployment, copyright, liability); it will also decide where the country stands in the global digital economy for the next 50 years. A country that enacts an overly strict and prohibitive law will lose its start-ups, its best engineers, and its international investment to Silicon Valley or other innovation hubs. A country that sets no rules and says "let the market handle it" leaves its citizens' data, their personality rights, and its own national security at the mercy of a handful of global tech giants.

Turkey has the opportunity to adopt a model of "Human Rights and Ethics-Centric Innovation." What it needs is a draft law that strengthens the KVKK framework, strikes a balance in copyright (through an "Opt-Out" mechanism) that neither crushes content creators nor halts technological progress, mandates an "Explainable AI" (XAI) architecture, and grounds legal liability in strict liability backed by "mandatory insurance."

Combined with the sectoral quotas and new fields of employment discussed in the earlier parts of this report, a well-designed Turkish AI Act can turn the country from a mere consumer of technology into a fair, transparent, secure, and productive technology ecosystem with a place of its own on the world stage. We cannot stop technology, but we can train it, audit it, and steer it to serve human dignity and our national interests. What matters in the end is less how smart the machine is than how far-sighted the lawmaker is.