Türkiye AI law 2026: what is enacted and what is proposed

The short answer: according to the information this guide is based on, Türkiye has no AI-specific law in force. AI is regulated indirectly, through existing rules on personal data, consumer protection, competition, online content and copyright. Several AI bills have been submitted to parliament, but they remain proposals, not enacted law.

A word of caution: this area moves quickly, and some details below still need verification. To confirm the position as of October 2026, check the Turkish parliament's bill database, the Official Gazette (Resmî Gazete), and the websites of the data protection authority and the Presidency's Digital Transformation Office.

Does Türkiye have an AI law?

Not as far as the latest available information shows. AI systems fall under laws written for other purposes, most importantly Law No. 6698 on the Protection of Personal Data, known as KVKK.

Other relevant rules include consumer and competition law, Law No. 5651 on internet publications, and the copyright law (FSEK, No. 5846). Sector regulators such as BDDK (banking), SPK (capital markets) and BTK (telecoms) apply their general rules to AI use, but there is no indication of comprehensive AI-specific rules from them.

A related, though separate, development is the Cybersecurity Law No. 7545, reportedly enacted in March 2025. It is not an AI law, but it can shape the security duties of organisations running AI systems.

What is the status of the AI bill in the Turkish parliament?

In June 2024, an MP from the governing AK Party submitted an 'Artificial Intelligence Law Proposal' to the Grand National Assembly (TBMM). Regulations.ai lists it under docket number 2/2234. It is a short text of roughly eight articles, broadly modelled on the EU AI Act.

The proposal sets out risk-based classification, principles of safety, transparency, fairness, privacy and accountability, and registration of systems with the relevant authorities. It also includes large turnover-linked administrative fines for prohibited practices, though the exact amounts should be checked against the official text.

At last report it had been referred to committee but not debated or passed. Proposals submitted by a single MP often stay in committee or lapse at the end of a legislative term.

More proposals followed in 2025. Regulations.ai records a bill titled 'Amendments to Certain Laws Regarding Artificial Intelligence' under docket 2/3358, and law-firm analyses describe three AI proposals submitted to parliament between 2024 and 2025. We have no information that any of them has become law.

There were also reports of a parliamentary research commission on AI formed around late 2024 or early 2025, and of proposed changes to the Penal Code and Law 5651 targeting deepfakes. Whether the commission has published its report, and whether any deepfake provisions passed in a judicial package, should be checked separately.

What is Türkiye's National AI Strategy?

The National Artificial Intelligence Strategy 2021–2025 was published in August 2021 by the Presidency's Digital Transformation Office and the Ministry of Industry and Technology. It contains 6 strategic priorities, 24 objectives and 119 measures, aimed at growing AI's economic contribution, building a skilled workforce and climbing international rankings.

A 2024–2025 Action Plan followed in 2024, aligned with the 12th Development Plan (2024–2028). The development plan also refers to building a legal framework consistent with international standards.

Keep in mind that strategies and action plans are policy documents. They do not create legal obligations for companies or citizens. The strategy ran until the end of 2025, so check the Digital Transformation Office's site for any successor strategy or action plan.

What does KVKK say about AI?

The Personal Data Protection Authority has issued several AI documents. Its September 2021 recommendations on personal data in AI emphasise privacy by design, data minimisation, impact assessments, anonymisation and transparency.

On 24 November 2025 the authority published a guide on generative AI and personal data, structured as 15 questions. According to law-firm summaries, it later released guidance on agentic AI systems as well.

All of these documents are non-binding guidance. The binding duties come from Law No. 6698 itself. Article 11, for instance, gives people the right to object to an outcome against them that results solely from automated analysis.

A significant change for AI training and cloud services came with Law No. 7499, in force since 1 June 2024. It introduced adequacy decisions, standard contracts and binding corporate rules for cross-border data transfers. Standard contracts must be notified to the authority within five business days of signing.

Does the EU AI Act apply to Turkish companies?

Yes, if they reach the EU market. Regulation (EU) 2024/1689 entered into force on 1 August 2024 and applies to non-EU providers placing AI systems on the EU market, and to systems whose output is used in the EU. Türkiye is not bound domestically, but a Turkish company selling into the EU must comply.

The obligations phase in. Bans on prohibited practices and AI-literacy duties started on 2 February 2025, and rules for general-purpose AI models on 2 August 2025. Most high-risk and transparency duties were scheduled for 2 August 2026, and high-risk AI embedded in regulated products for 2 August 2027.

However, in November 2025 the European Commission proposed a 'Digital Omnibus' package that could push back high-risk obligations. Whether it has been adopted directly affects which deadlines apply now, so verify it.

Export-heavy sectors such as automotive, white goods and machinery are exposed through EU product-safety rules and CE marking, a link reinforced by the EU–Türkiye Customs Union. Non-EU providers of high-risk systems or general-purpose models must appoint an authorised representative in the EU. Fines reach €35 million or 7% of global turnover for prohibited practices, and €15 million or 3% for most other breaches.

What should companies in Türkiye do now?

Existing obligations apply even without a dedicated AI law. A sensible start is to map the AI tools in use and the personal data flowing into them, then review KVKK compliance, especially cross-border transfers.

If you serve EU customers, work out which EU AI Act risk category your systems fall into. Because the Turkish proposals borrow from the EU model, that groundwork may also ease compliance with any future Turkish law. For concrete decisions, rely on current legislation and qualified legal advice.