Artificial intelligence (AI) tools can speed up many business processes, such as drafting texts, customer service, human resources, sales forecasting, fraud detection and decision support. However, the fact that a service is easily accessible does not mean that its use within a business is automatically lawful.

Legal risk does not arise only from AI producing incorrect results. The data entered into the system, the service provider’s terms of use, how the output is used and who makes the final decision are also important in determining liability.

First, draw up an inventory of use

In businesses, the use of AI often begins not with a central purchasing decision but with employees trying out general-purpose tools in their daily work. It should therefore be established which department uses which tool, for what purpose and with which data.

Free accounts, browser extensions, meeting recording and summarising tools, and AI features added later to existing software should also be included in the inventory.

For each use, it should be examined whether the system only produces drafts, whether it makes assessments about a person, whether it makes automated decisions and to what extent the result affects customers or employees. Writing a product description does not carry the same level of risk as making assessments in recruitment, pricing, credit or health.

Personal data should not be entered into AI tools without control

An employee uploading a customer file, a CV, health information or communication records to an AI service may amount to processing of personal data and, depending on the circumstances, a data transfer.

The fact that data was lawfully obtained in the first place does not automatically make its use in an AI system for a new purpose lawful. The purpose of processing, the legal basis, proportionality, the retention period and the information given to the data subject (ilgili kişi) must be reassessed.

Where possible, personal data should be removed or genuinely anonymised before it is entered into the system. Replacing names with codes is not always anonymisation. If the data can be linked back to a specific person using other information, it remains personal data.

Transfers of data abroad should be assessed

The servers or the provider of an AI service may be located abroad. If data is sent to a system abroad, there must be a transfer mechanism that complies with the provisions on transfers abroad of the Law on the Protection of Personal Data No. 6698 (KVKK).

It should be examined in which countries the service provider stores data, whether it uses sub-processors, whether it uses inputs to train its models and how it deletes data when the account is closed. A single privacy setting in the application does not replace the necessary legal review and transfer mechanism.

Confidential information and trade secrets should be protected

Even where they do not contain personal data, price lists, source code, strategy documents, unpublished financial results, customer contracts and legal opinions may qualify as confidential information or trade secrets of the business.

Entering this information into a publicly available AI tool may breach not only the business’s own security policies but also the confidentiality obligations it has undertaken towards customers and business partners.

The corporate policy should clearly show which information must never be entered into external services, which tools are approved and how requests for exceptions will be assessed.

AI outputs should be verified

Generative AI systems may produce information that is convincing but wrong, out of date or entirely fabricated. An employee approving a decision on screen does not in itself amount to effective human oversight.

The person carrying out the oversight must have the knowledge to question the result, sufficient time and the authority to change the decision. The greater the harm that could result from using the output, the higher the level of verification should be.

A legal, financial or health-related text to be sent to a customer, a recruitment or disciplinary decision, or software code or technical instructions that pose a security risk must always be checked by competent persons against independent sources.

The risk of discrimination should be taken into account

A system trained on past data may repeat past inequalities or produce more errors for certain groups. This risk is particularly important in recruitment, performance evaluation, credit, insurance, pricing and customer risk scoring.

It should be tested whether the variables used in the system produce direct or indirect discrimination. The representativeness of the data set, how error rates vary between groups, the explainability of the decision and the person’s ability to challenge the result should be assessed.

The supplier describing its system as “neutral” does not remove the business’s responsibility to examine the consequences of the way it uses the system.

Intellectual property rights should be examined

It should not be assumed that every output created by AI will be protected by copyright or will belong exclusively to the business. The human contribution to creating the output, the contractual terms of the service used and the nature of the specific content may affect the legal outcome.

Outputs that resemble text, images, trademarks, designs or software code belonging to third parties may be the subject of infringement claims. A similarity and ownership review should be carried out before commercial use.

It is useful for employee, software developer or agency contracts to include provisions on the use of AI, the source of inputs, rights in outputs and liability for third-party claims.

The supplier contract should be reviewed carefully

The standard terms of use of AI services may not meet the needs of the business with regard to rights to use data, service levels, model changes, notification of security incidents and limitation of liability.

In particular, for critical uses, the following issues should be clarified:

The purpose of the service, its performance limits and prohibited uses,
Who may use the inputs and outputs,
Whether the inputs will be used to train the model,
Retention, deletion and transfer abroad of data,
The use of sub-processors,
Security standards and the deadline for breach notification,
Notification of significant changes to the model,
Sharing of liability for incorrect outputs and third-party claims.

A service contract does not fully transfer the business’s own purpose of use and its control obligations in practice to the supplier.

Transparency towards consumers should be ensured

Where a chatbot is used in customer service, automated recommendations are generated or personalised pricing is applied, consumers must not be misled. Where necessary, it should be stated clearly whether the user is communicating with a human or with an automated system.

Advertising and promotional material produced by AI must not contain claims that are untrue, unverified or likely to mislead consumers. Responsibility for publishing the final content and using it in commercial communications cannot be left solely to the tool used.

Turkish and European Union rules may apply together

In Türkiye, depending on the area of use, the rules on personal data protection, consumer, employment, competition, intellectual property, contract and tort law may apply together to the use of AI. In regulated sectors such as health, finance and electronic communications, special rules may also come into play.

The European Union Artificial Intelligence Regulation (AI Act), for its part, establishes a risk-based system and provides different rules for prohibited practices, high-risk systems and certain transparency obligations.

The fact that a business is established in Türkiye does not rule out the possibility of falling within the scope of the Regulation, for example where it places a system on the European Union market or where the system’s outputs are used in the European Union. The obligations that apply must be determined separately according to the role of the business and the risk class of the system.

How can a corporate AI policy be created?

The systems in use and their purposes are identified.
Uses are classified according to the risk they carry.
Approved tools and information that must not be entered into the system are set out.
Rules for human oversight and verification of outputs are established.
A personal data impact assessment and, where necessary, a fundamental rights impact assessment are carried out.
The supplier review and contract check are completed.
Employees receive training appropriate to their roles.
A reporting channel is set up for errors, discrimination and security incidents.
Changes to models and legislation are monitored regularly.

Conclusion

The key question in the use of AI is not only “What can this tool do?” Which data is processed for what purpose, whom the output affects, who makes the final decision and how liability will be managed in the event of an error must all be addressed together.

An inventory of use, risk classification, human oversight and clear corporate rules help businesses keep their legal risks under control while benefiting from technological innovation.

The area of use of the AI system, the data processed, the roles of the parties and the markets concerned must be assessed separately in each specific case.

Use of AI in Business: A First Look at the Legal Risks