AI Insights
AI Insights
Practical notes on AI regulation, governance, and the law of building with machine learning.
Is ChatGPT Confidential? AI Chats, Privilege and Turkish Law
Is ChatGPT confidential? Not in the way a conversation with your lawyer is. In United States v. Heppner, a New York federal court held in February 2026 that a defendant's own chats with an AI assistant were neither privileged nor work product, and in the OpenAI copyright litigation courts ordered ChatGPT logs preserved and produced. This analysis explains those rulings, the courts that disagree, and how Turkish law answers the same questions through the Attorneys' Act, the CMK, the HMK and the KVKK.
Read →
EN 18286 vs ISO 42001: The First Harmonised EU AI Act Standard
EN 18286 is the first harmonised standard under the EU AI Act: a quality management system standard whose reference was published in the Official Journal on 14 October 2026. Providers of high-risk AI systems that apply it now benefit from a presumption of conformity with Article 17. This analysis compares EN 18286 with ISO/IEC 42001, explains what the presumption covers and where it stops, why certification is a different thing, and what it means for Turkish and Korean exporters ahead of the 2027 and 2028 deadlines.
Read →
AI Act Nudification Ban: What Changes on 2 December 2026
The AI Act nudification ban applies from 2 December 2026, when AI systems that generate non-consensual intimate images of real people or child sexual abuse material become prohibited in the EU. This analysis explains what the Digital Omnibus added to Article 5, who it reaches, the Article 50(2) marking deadline for systems already on the market, and how Turkish and Korean law treat the same images.
Read →
KVKK's Employee E-mail Monitoring Principles and AI Tools
On 8 October 2026 Türkiye's data protection authority published Board principle decision No. 2026/2035 of 16 September 2026 on employers' monitoring of corporate e-mail and work channels. Its sixteen points hold that owning a tool is not a licence to monitor it without limit, that a general "e-mail may be monitored" notice does not by itself satisfy Article 10, that consent is suspect in employment, and that content review as a rule needs a concrete suspicion and must not be general or continuous. The decision never mentions AI. We explain why it nonetheless sets the limits for AI e-mail scanning, productivity analytics and sentiment scoring, set against Constitutional Court case law, Bărbulescu, the EU AI Act and Korean law.
Read →
EU Copyright and AI Consultation: Opt-Outs, Presumptions and Payment
On 29 September 2026 the European Commission opened a targeted consultation on copyright and AI that puts unusually concrete options on paper: EU standards and a registry for text-and-data-mining opt-outs, a duty on crawlers and AI agents to identify themselves, a rebuttable presumption of use where AI providers fail their AI Act transparency duties, confidential disclosure in place of the published domain list, and new compensation and remuneration rights. This analysis reads the questionnaire itself, sets it against Articles 3 and 4 of the DSM Directive, Article 53 of the AI Act and the German case law, and explains what it means for Turkish and Korean developers and rights holders. Responses close on 3 November 2026.
Read →
Thomson Reuters v. ROSS: Third Circuit Rejects AI Training Fair Use
On 29 September 2026 the US Court of Appeals for the Third Circuit held in Thomson Reuters v. ROSS Intelligence that Westlaw's headnotes are original and that copying them to train a competing, non-generative AI legal-research tool was not fair use. It rejected ROSS's intermediate-copying defence because the judicial opinions themselves were freely available: "ease is not a justification for copying". It also recognised harm to a developing market for licensing headnotes as AI training data, while setting generative AI aside in a footnote. This analysis looks at the four factors as the court applied them, what the ruling means for Bartz, Kadrey and the OpenAI litigation, and how the same facts would be treated under EU law, Turkish FSEK and Korea's fair-use clause.
Read →
UN AI Panel's First Brief: Loss of Control and the Legal Questions
The UN's AI Scientific Panel published its first thematic brief on 21 September 2026, on AI agents and the risk of losing human control, built around the OpenAI and Hugging Face incident. This note checks the brief against OpenAI's, METR's and Hugging Face's reports, explains who counted the agents, notes that the brief issues no recommendations, and shows where it touches the EU AI Act, California's SB 53 and Turkish law.
Read →
The AI Slowdown Antitrust Suit: Is Safety Coordination a Cartel?
On 18 September 2026, four paying subscribers filed a putative nationwide class action in the Northern District of California against Anthropic, OpenAI, Google and SpaceXAI. They do not allege that these companies built something dangerous; they allege that the companies agreed with one another to build it more slowly, that the industry's public commitment to decelerate capability development in the name of safety was a collusive restraint, and that subscribers paid for products made deliberately worse. Whatever one thinks of the merits, the case forces a question that AI governance has spent three years carefully not asking: when regulators and international bodies demand that competing developers coordinate on safety, are they demanding something competition law forbids?
Read →
AI Hallucination Cases: What Fabricated Citations Mean for Lawyers
A public database listed 2,246 court decisions worldwide on AI-fabricated legal material on 2 November 2026, and Türkiye has its own reported case in Ankara. This note sets out what courts have done, from small fines to setting judgments aside, what the Turkish Bar's guide of 28 August 2026 says, what is known about the Ankara inquiry, and what checking a citation actually requires.
Read →
California's SB 53 One Year On: Frontier AI Transparency Explained
California's SB 53 requires the largest frontier AI developers to publish how they manage catastrophic risk and requires frontier developers to report critical safety incidents to the state. It was signed on 29 September 2025 and has applied since 1 January 2026. This note explains who is covered, what the text requires, what is known about its first ten months, and how it compares with the EU AI Act, with points for Türkiye.
Read →
Korea's PIPA Amendment: AI Training on Personal Data Without Consent
South Korea has amended its Personal Information Protection Act so that personal data collected for other purposes may be used to develop AI without consent, but only with approval from its data protection commission. Law No. 21910 was promulgated on 8 September 2026 and applies from 9 March 2027. This note sets out the three requirements, the procedure and open questions, and compares the EU and Turkish positions.
Read →
Turkish Board v Meta: Interim Order on WhatsApp and Rival AI
Türkiye's Competition Board opened an investigation into Meta on 14 May 2026 and ordered it, as an interim measure, to let rival AI chatbots offer their services through WhatsApp while the case runs. No infringement has been found. This note sets out what the Board's announcement says, how it compares with the Italian and European Commission orders, which articles of Law No. 4054 apply, and what remains unknown.
Read →
Can Software Mediate Consumer Disputes? Turkish Law and the AI Act
Türkiye has not launched a "robot mediator" for consumer disputes. What began on 1 September 2026 was Alo Adalet 135, an AI-assisted voice line for applications about long-running court files. This article explains how consumer disputes are actually resolved under Law No. 6502 and the Mediation Law No. 6325, why current law requires a human mediator, where AI could help, and why the EU AI Act treats AI used in dispute resolution as high-risk.
Read →
AI Recreations of Deceased Singers: Korea's Digital Inheritance Gap
Korean broadcasters have already used AI to bring deceased singers back to the screen, including an AI-generated version of Kim Kwang-seok's voice on SBS in 2021. Korean law has not settled who may consent to this after death. The publicity provision added to the Unfair Competition Prevention Act in 2021 is silent on death, and a proposed Civil Act amendment creating a 30-year inheritable right has yet to be enacted. We compare Türkiye, the EU and the US.
Read →
Türkiye's AI Action Plan 2026-2030: A Legal Review
Presidential Circular 2026/9, published in the Official Gazette on 18 August 2026, put Türkiye's AI Action Plan (2026-2030) into effect. Based on the plan text, this review explains its four axes and sixteen actions, its targets (1 GW of compute, 1,000 SME vouchers, sandboxes in priority sectors), its governance under the National AI Council, and what it means legally, including the general AI law it announces.
Read →
Mandatory AI Watermarking: EU, US, China, Korea and Türkiye Compared
For most of human history, the strongest proof of truth has been our own eyes. If you saw an event with your own eyes, or heard a recording with your own ears, it had happened. By 2026, with generative AI able to produce near-perfect fakes, "seeing is believing" has become one of the most outdated and dangerous assumptions we hold.
Read →
AI and K-Pop: Virtual Idols, Voice Cloning and the Law of Consent
Virtual idol groups such as PLAVE and MAVE:, both launched in 2023, and fully AI-generated acts now share the K-pop stage. This rewritten article sets out what can be verified: fan backlash against AI chatbots of real artists, a 2026 coalition of Korean music rights bodies demanding consent for AI training, KOMCA's short-lived rule on AI-assisted songs, and how Korean, EU and Turkish law treat AI music and voice cloning.
Read →
South Korea's Deepfake Law: What Korean Criminal Law Actually Punishes
South Korea has punished sexual deepfakes since 2020. In 2024 it raised the maximum to seven years, made creation a crime even without distribution, and criminalised possessing and viewing such material; campaign deepfakes have been banned in the 90 days before an election since January 2024. We explain how these laws work, how the Supreme Court applies them, what the enforcement data show, the pending bill on fictional persons, and how Türkiye and the EU compare.
Read →
Who Owns the Copyright of AI-Generated Images?
Throughout the history of art, "creativity" has been regarded as a divine spark belonging to the human mind alone. From the first figures drawn on cave walls to Renaissance masterpieces, and from the invention of the camera to digital graphic design, the tools have constantly changed. But the will behind the brush, the shutter or the mouse click, the one making the "decision," has always been human. That held until generative AI models such as Midjourney, DALL-E, and Stable Diffusion arrived.
Read →
If Medical AI Makes a Misdiagnosis, Who is Sued?
Throughout the history of medicine, the relationship between physician and patient has rested on "trust" and "human judgment." When a patient lies on the operating table or receives a prescription, there is a living human on the other side who can be held accountable, ordered to pay compensation, or even imprisoned if negligence is proven. In the 21st century, however, medicine is changing fundamentally as a "digital third mind" enters the examination room: Artificial Intelligence (AI).
Read →
Should AI Liability Insurance Be Mandatory? EU, Korea and Türkiye
Throughout history, the law has looked for a "faulty will" before awarding compensation. In a traffic accident it asks about the driver's fatigue; in a medical error, the doctor's carelessness; in a workplace accident, the employer's negligence. But when the hand on the steering wheel, the scalpel, or the investment button belongs not to a human but to an autonomous Artificial Intelligence (AI) algorithm processing billions of data points per second, our existing compensation and insurance rules break down.
Read →
Does Algorithmic Error Attract Strict Liability?
When machines replaced muscle power, the Industrial Revolution shook the law to its foundations. As exploding steam boilers and snapping belts injured factory workers, owners defended themselves with "I had no intent or negligence," and it was this defense that gave birth to the modern concept of "Strict Liability." The law's answer was: "If you install this dangerous machine to make a profit, you are responsible for the harm it causes, even without fault."
Read →
A Proposed AI Act for Turkey: An Author's 100-Article Draft
This draft bill turns the socio-economic analysis in the first 4 parts of our report series into statutory text. It is intended as more than a list of prohibitions: a pioneering text that protects employment, secures copyright, makes room for innovation, and, above all, places human dignity at its center.
Read →
A Proposed Turkish AI Act: Governance, Oversight and Sanctions
The first three parts of this report series, which aims to put Turkey's artificial intelligence (AI) strategy on a sound legal footing, set out some major challenges. Part one examined sectoral job losses and quotas to protect human employment; part two, the "New Collar" professions AI will create; and part three, difficult legal questions such as copyright, strict liability, and data sovereignty.
Read →
A Proposed Turkish AI Act: Data, Copyright, Transparency and Liability
The legal framework a prospective Turkish AI Act needs: the black-box problem and explainability, the liability gap and mandatory AI insurance, copyright in generative AI, and data sovereignty.
Read →
A Proposed Turkish AI Act: Employment Protection and Sector Quotas
AI and automation threaten cognitive as well as physical work. A sector-by-sector map of Turkey's job-loss risk, and the human-in-the-loop quotas, AI tax and protected professions a Turkish AI Act should weigh.
Read →
Structuring Corporate AI Liability in Türkiye and the GCC
As artificial intelligence moves into core business operations across Türkiye and the Gulf Cooperation Council (GCC) region, corporate liability has moved from hypothetical debate to the boardroom. This article looks at how organizations can work within evolving legal frameworks, allocate risk in international AI vendor contracts, and protect their operations against algorithmic failures.
Read →
Cross-Border AI Training: Data Transfers Between Türkiye and the GCC
Data is the fuel of any enterprise AI system, but moving it across international borders to train or host models raises considerable legal complexity. In light of recent amendments to Türkiye’s KVKK and developments in GCC privacy law, this article analyzes the legal mechanics and cloud infrastructure strategies required to lawfully transfer training data between Türkiye, the Middle East, and global tech hubs.
Read →
EU AI Act High-Risk Deadline Moved to December 2027: What Changes
Regulation (EU) 2026/1744, in force since 27 July 2026, moved the EU AI Act's high-risk duties to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products. The bans, general-purpose AI rules and Article 50 did not move. This note explains what changed and what did not.
Read →
Agentic AI: who is accountable when your AI acts on its own?
When an AI agent acts on its own, the business that deployed it is usually the first to answer, because software has no legal personality. This note sets out the real routes: Turkish contract and tort law, the EU Product Liability Directive 2024/2853, and deployer duties under the EU AI Act.
Read →
Marking AI-Generated Content: What Article 50 of the AI Act Requires
Article 50 of the EU AI Act requires providers of generative AI to mark output in machine-readable form and deployers to disclose deepfakes and certain public-interest text. It has applied since 2 August 2026, with a transition to 2 December 2026 for marking by existing systems. The voluntary Code of Practice was assessed as adequate.
Read →
AI in Hiring: Discrimination Risk Under the EU AI Act, GDPR and KVKK
AI hiring tools can discriminate through proxies, and employers already carry legal risk under the GDPR, KVKK Article 11 and Turkish equality law. EU AI Act high-risk duties for recruitment systems start on 2 December 2027, but the ban on emotion recognition in recruitment has applied since February 2025.
Read →
Which EU AI Act risk tier are you in?
Your EU AI Act risk tier depends on what the system is used for, not on how advanced it is. This guide walks through Article 5, Article 6 with Annexes I and III, Article 50 and the residual tier, with examples and the application dates set by Regulation (EU) 2026/1744.
Read →
Training data: the KVKK and GDPR questions to settle first
Training an AI model on personal data requires a lawful basis under KVKK Article 5 and GDPR Article 6, a compatible purpose, and a valid route for any transfer abroad. This note sets out what the KVKK Board's 2025 guide and the EDPB's 2024 opinion say, and what could happen if a dataset fails these tests.
Read →