Artificial Intelligence Compliance and Policies
Whether your employees use artificial intelligence tools is no longer the question; the real question is the rules they follow when they do. We design your company’s strategy on the use of AI, prepare internal policies that protect personal data, trade secrets and intellectual property, and identify your obligations under rules such as the EU Artificial Intelligence Act.
What is an AI policy?
An AI policy is an internal rule setting out which AI tools may be used in the company, for what purposes and within what limits. It covers approved tools, information that must not be entered into them (personal data, trade secrets, client information), responsibility for checking the output, intellectual property questions and what happens if the rules are breached.
Every AI tool used without a policy is an uncontrolled data flow: an employee uploading a client contract or an employee list to a tool hosted abroad may cause both a cross-border data transfer and a breach of confidentiality.
What is the EU Artificial Intelligence Act?
The EU Artificial Intelligence Act (AI Act) classifies AI systems by risk level; it entered into force in 2024 and applies in stages. It prohibits certain practices outright, imposes strict obligations on high-risk systems and sets transparency rules for others. Turkish companies that place AI systems on the EU market, or whose AI output is used in the Union, may also be affected.
Scope
- Designing the company’s AI strategy and preparing policies
- Assessing the AI systems used and developed under the KVKK and the EU Artificial Intelligence Act
- Reviewing agreements with AI service providers
- AI literacy and safe-use training for employees
How We Work
- Identifying, together with the departments, the AI tools and use cases in the company
- Assessing the personal data, confidentiality, intellectual property and contractual risks of each use
- Setting the list of approved tools and the rules of use, and drafting the AI policy
- Putting in place agreements with service providers and data transfer mechanisms
- Training employees and updating the policy at regular intervals
Team
Frequently Asked Questions
Does the EU Artificial Intelligence Act affect Turkish companies?
Turkish companies that place AI systems on the EU market, or whose AI output is used in the Union, may fall within the scope of the Act. A company that uses AI only in Türkiye for its own internal processes is generally not directly within scope; however, its European customers and business partners may ask for similar safeguards in their contracts.
Is it a KVKK risk for employees to use tools such as ChatGPT?
Yes, when personal data is entered into the tool. In that case the data is often transferred to a provider abroad, which raises the legal basis for the transfer, the duty to inform and data security obligations. Enterprise versions and the right agreements can manage this risk to a large extent; the policy makes clear which tool may be used with which information.
Does content generated with AI belong to our company?
This is still an open question. Under Turkish law, a work is an intellectual and artistic product bearing the characteristics of its author, and the author is the person who created it; content generated entirely by AI may therefore not be protected. The degree of human contribution and the terms of use of the tool are decisive.
How often should the AI policy be updated?
Because tools and regulations change quickly, we recommend reviewing the policy at least once a year, and immediately whenever a new tool comes into use.
Would you like to discuss this service? Schedule a meeting with us — the first meeting is free of charge.
Schedule a meetingRelated Publications
- Deepfake Technology – Legal Challenges and Key Questions 17.11.2023
- Rights Over a Person’s Image and Photograph 15.10.2024
- Can the Corporate E-mail Histories of Employees Who Leave Their Jobs Be Made Available to Another Employee? – An Evaluation in the Context of the Law on the Protection of Personal Data 06.05.2024
- Push Notifications in Turkish Law: Legal Obligations and User Rights 25.10.2023