Turkey
Turkey has a draft AI framework law before parliament, introduced in 2024 and modeled loosely on the EU's risk-based approach, but it has not been enacted. Binding exposure today comes from the KVKK data protection regime, which the authority has applied to AI processing, and from the new Cybersecurity Law in force since March 19, 2025.
Key points
- A draft AI law introduced in 2024 remains pending; timing is uncertain.
- KVKK, Turkey's data protection law, applies to AI systems processing personal data, with authority guidance.
- The Cybersecurity Law entered into force on March 19, 2025 and reaches AI systems in critical infrastructure.
Laws and instruments
Draft AI framework law
Pending framework legislation drawing on the EU's risk-based structure. Not law; monitor for committee movement.
Cybersecurity Law
Turkey's cybersecurity statute, in force since March 19, 2025, with obligations relevant to AI systems in critical national infrastructure.
Timeline
- 2024Draft AI framework law introduced in parliament.
- March 19, 2025Cybersecurity Law in force.
- 2026Further digital legislation expected, including child-focused platform rules.
Who it applies to
AI systems processing personal data of people in Turkey fall under KVKK now; critical-infrastructure AI faces the Cybersecurity Law. AI-specific duties await the pending framework.
Penalties
KVKK administrative fines and cybersecurity sanctions apply. No AI-specific penalties yet.
Common questions
Does Turkey have a comprehensive AI law?
What are the penalties for AI violations in Turkey?
Who does AI regulation in Turkey apply to?
Artificial Intelligence Regulations, "AI Regulation in Turkey," reviewed July 16, 2026, https://artificialintelligenceregulations.com/jurisdictions/turkey.html.
Entries state the position as of the review date and link to the primary text for verification.