AI Regulation in the EU and Türkiye
Artificial intelligence is no longer a peripheral technological development. It is now embedded in core business and decision-making processes—particularly in areas such as credit assessment, fraud detection, and automated risk analysis.
As AI systems begin to influence outcomes with direct legal and financial consequences, a key question emerges: how should these systems be regulated in a way that ensures both innovation and legal certainty?
A closer look at the European Union and Türkiye reveals two distinct regulatory approaches. While the EU has opted for a structured and binding legal framework, Türkiye is, at least for now, pursuing a more gradual and adaptive path.
1. The European Union: Structured and Preventive Regulation
With the adoption of the Artificial Intelligence Act (Regulation (EU) 2024/1689), the European Union has taken a decisive step toward establishing a comprehensive legal framework for AI. The Regulation is designed not only to support innovation, but also to ensure a high level of protection of fundamental rights—such as data protection, non-discrimination, and human dignity—while creating a harmonised regulatory environment across the internal market.
At the centre of this framework lies a risk-based classification system. Rather than regulating all AI systems uniformly, the EU differentiates between levels of risk and tailors its approach accordingly. Certain AI practices are prohibited altogether, particularly where they involve manipulation of individuals or the creation of social scoring mechanisms. High-risk systems—such as those used in financial services, including credit scoring—are subject to extensive compliance obligations. These obligations encompass the establishment of robust risk management processes, the implementation of strict data governance and quality standards, the incorporation of human oversight mechanisms, and the preparation of comprehensive technical documentation. Other AI systems are subject to transparency requirements, while low-risk applications remain largely outside the scope of strict regulation.
This layered structure reflects a clear regulatory philosophy. AI is not treated merely as a technological tool, but as a potential source of legal and societal risk that must be addressed in advance through clearly defined and enforceable rules. Importantly, the AI Act also has an extraterritorial dimension. Where the output of an AI system is used within the European Union, the Regulation may apply irrespective of where the provider is established.
2. Türkiye: A Gradual and Adaptive Approach
Türkiye has not yet adopted a dedicated AI law comparable to the EU’s AI Act. Instead, the current framework is shaped by a combination of existing legislation and strategic policy documents, most notably the National Artificial Intelligence Strategy (2021–2025).
This approach reflects a regulatory mindset that prioritises flexibility and gradual alignment rather than immediate and comprehensive codification. Rather than imposing binding obligations at this stage, Türkiye appears to favour an incremental approach in which regulatory tools evolve alongside technological developments.
In practical terms, legal issues arising from the use of AI systems in Türkiye are currently addressed through the application of general legal frameworks. Liability is assessed under the Turkish Code of Obligations, data-related issues fall within the scope of the Law on the Protection of Personal Data, and sector-specific regulations continue to play a decisive role.
3. Two Different Regulatory Logics
The divergence between the European Union and Türkiye reflects two fundamentally different regulatory logics. The EU model is preventive and codified, while Türkiye’s approach is adaptive and evolving.
Compliance with the AI Act does not automatically ensure compliance in Türkiye. Conversely, the absence of a dedicated AI law in Türkiye should not be interpreted as an absence of legal risk. On the contrary, it requires a more nuanced legal assessment.
4. Where the Real Legal Risk Lies
In Türkiye, legal risk in the context of AI arises primarily from the application of existing laws to new technological realities. This creates a system that is inherently less predictable and more dependent on interpretation and evolving practice.
5. Conclusion
Artificial intelligence is transforming not only business models, but also the foundations of legal responsibility. The EU and Türkiye represent two distinct responses to this transformation.
Legal risk does not arise only from what is regulated, but also from what is not yet regulated.
