Skip to main content

    AI by country · Middle East

    AI in Türkiye: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Türkiye know before starting with AI?

    Türkiye has no dedicated AI law as of 29 October 2026. The Personal Data Protection Law No. 6698 (KVKK) applies to AI that uses personal data, and it gives people a right to object to results produced solely by automated analysis. Since 2024, transfers abroad need an adequacy decision or a safeguard such as the Board's standard contract, which matters for any cloud AI service.

    At a glance

    Türkiye at a glance

    Key facts about Türkiye
    Data protection lawPersonal Data Protection Law No. 6698 (2016), amended by Law No. 7499 in 2024
    RegulatorPersonal Data Protection Authority (KVKK) and its Board
    AI policyTürkiye Artificial Intelligence Action Plan 2026 to 2030 (Presidential Circular No. 2026/9). No dedicated AI law as of 29 October 2026
    Time zoneTRT, UTC+3 all year (India is 2.5 hours ahead)
    CurrencyTRY (Turkish lira)
    Business languageTurkish, with English used in international business

    Why now

    Why Türkiye is worth watching

    Each point links to the document it comes from.

    • The Türkiye Artificial Intelligence Action Plan for 2026 to 2030 was published as Presidential Circular No. 2026/9 in the Official Gazette of 18 August 2026.[4]

    • A law-firm summary says the plan targets 10,000 advanced AI specialists, 100,000 AI application professionals and regulatory sandboxes in at least five priority sectors.[5]

    • The KVKK published a guide on generative AI and personal data protection on 24 November 2025, covering the AI life cycle, risks and duties of data controllers.[3]

    • Law No. 7499 changed the rules on sensitive data and transfers abroad, with most changes in force from 1 June 2024.[6]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Personal Data Protection Law No. 6698

    In force2016People can object to a result against them that comes from analysing their data solely through automated systems (Article 11). Controllers must take technical and organisational security measures (Article 12). If data is obtained by others unlawfully, the controller must tell the person and the Board within the shortest time (Article 12), which the Board has read as 72 hours. Fines for breaching duties such as notice and security are set in Article 18 and revalued each year.[1]

    Transfers abroad under amended Article 9 (Law No. 7499)

    In force2024Data can go abroad if a legal basis applies and the Board has made an adequacy decision for the country or sector. Without one, a safeguard is needed, such as binding corporate rules, a written undertaking approved by the Board, or the Board's standard contract. A signed standard contract must be notified to the Authority within five business days.[1]

    KVKK Board Decision 2019/10 on breach notification

    In force2019A law-firm summary says this decision of 24 January 2019 reads Article 12(5) as requiring notice to the Board within 72 hours of learning of a breach. A December 2025 decision limits how long breach notices stay public on the KVKK website to 60 days.[2]

    Where AI fits first

    Where AI fits first

    Banking and finance

    Credit pre-checks, fraud alerts and Turkish-language customer service, with staff reviewing declines.

    Article 11 lets people object to results from solely automated analysis, so keep a human review route.[1]

    E-commerce and retail

    Product search, recommendations and customer service assistants.

    If the model or hosting is outside Türkiye, the Article 9 transfer rules apply, including notice of signed standard contracts within five business days.[1]

    Manufacturing and exports

    Quality inspection from images and demand forecasting.

    Mostly non-personal data. The 2026 to 2030 plan's sandboxes may cover priority sectors; check which ones as they are announced.[5]

    Workplace use of generative AI

    Drafting, summarising and coding assistants for staff.

    The KVKK generative AI guide gives direction to data controllers across the AI life cycle and to individual users.[3]

    Your first steps

    Your first steps

    1. Identify the legal basis for each AI use of personal data under the KVKK, and record it.
    2. List decisions made solely by automated analysis and set up a way for people to object and get a human review.
    3. Check where your AI provider stores and processes data, and put a standard contract or other Article 9 safeguard in place.
    4. Notify the Authority of any signed standard contract within five business days.
    5. Set up a breach process that can reach the Board within 72 hours.
    6. Read the KVKK generative AI guide before rolling out AI tools to staff.
    7. Follow the 2026 to 2030 Action Plan for sandboxes and secondary rules in your sector.

    AI services for Türkiye

    AI consulting and development for teams in Türkiye

    We work remotely with companies in Türkiye, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Türkiye is on UTC+3 all year and India on UTC+5:30, a 2.5 hour gap. Taking a 9:00 to 18:00 day in Türkiye and 9:30 to 18:30 in India, the overlap is about 7 hours, from 09:00 to 16:00 Türkiye time, Monday to Friday.

    Questions

    Common questions about AI in Türkiye

    Does Türkiye have an AI law?

    Not a dedicated one as of 29 October 2026. A law-firm summary says the 2026 to 2030 Action Plan does not itself create obligations for private AI developers or users, so the KVKK remains the main law.

    Can we use an AI service hosted outside Türkiye?

    Yes, if a legal basis applies and either an adequacy decision exists or you use a safeguard under Article 9, such as the Board's standard contract. The signed contract must be notified to the Authority within five business days.

    Can a customer challenge an automated decision?

    Yes. Article 11 gives people the right to object to a result against them that comes solely from automated analysis of their data.

    How fast must we report a data breach?

    The law says within the shortest time, and the Board's Decision 2019/10 sets that at 72 hours from learning of the breach, according to law-firm summaries.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Personal Data Protection Authority (KVKK), 2016-04-07. Personal Data Protection Law No. 6698 (English)(kvkk.gov.tr)
      Full title and what we used it for

      Personal Data Protection Law No. 6698 (English). Primary English text on the regulator's site, including the 2024 amendment to Article 9. Used for Articles 9, 11, 12 and 18. The date is the original Official Gazette publication; the Turkish text controls.

    2. [2] CMS, 2025-12-25. KVKK limits publication period for data breach notices to 60 days(cms.law)
      Full title and what we used it for

      KVKK limits publication period for data breach notices to 60 days. Law-firm summary, used for interpretation only: Decision 2019/10 (72 hours) and Decision 2025/2451 of 25 December 2025. The date is the decision date.

    3. [3] Personal Data Protection Authority (KVKK), 2025-11-24. Üretken Yapay Zekâ ve Kişisel Verilerin Korunması Rehberi (15 Soruda)(kvkk.gov.tr)
      Full title and what we used it for

      Üretken Yapay Zekâ ve Kişisel Verilerin Korunması Rehberi (15 Soruda). Primary announcement in Turkish of the generative AI guide. Used for its date and topics. The page does not state whether it is binding.

    4. [4] Official Gazette of the Republic of Türkiye (Resmî Gazete), 2026-08-18. Official Gazette No. 33344, 18 August 2026: Presidential Circular No. 2…(resmigazete.gov.tr)
      Full title and what we used it for

      Official Gazette No. 33344, 18 August 2026: Presidential Circular No. 2026/9 on the Türkiye AI Action Plan (2026 to 2030). Primary. Used to confirm the circular's number, title and publication date.

    5. [5] CMS, 2026-09-10. Türkiye unveils new AI action plan(cms.law)
      Full title and what we used it for

      Türkiye unveils new AI action plan. Law-firm summary, used for interpretation only: targets, sandboxes, and that the plan does not create directly applicable obligations for private-sector AI.

    6. [6] Egemenoglu (via Legal 500), 2024-03-20. Changes in the PDPL was published in the Official Gazette(legal500.com)
      Full title and what we used it for

      Changes in the PDPL was published in the Official Gazette. Law-firm summary, used for interpretation only: Law No. 7499 published on 12 March 2024, most changes in force from 1 June 2024, and the old Article 9 running in parallel until 1 September 2024.

    This is general information, not legal advice. Fine amounts in Türkiye are revalued each year, and some points here come from law-firm summaries. Check with a qualified lawyer in Türkiye before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Türkiye?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score