AI Compliance and the EU AI Act
Risk classification of AI systems, obligations under the EU Artificial Intelligence Act, algorithmic liability and the design of compliance structures.
The EU Artificial Intelligence Act entered into full application for high-risk AI systems on 2 August 2026. The regulation has extraterritorial effect: Turkish companies that place products or services on the EU market fall within its scope.
The new framework requires not only technical conformity but also data governance, risk classification, transparency, human oversight and documentation processes.
In practice the decisive question is less whether liability can be established than how it is allocated at the contracting stage. Where a supply agreement does not define model performance, data quality, human oversight and incident notification obligations, the parties are left without any standard by which to apportion loss once damage occurs.
Common usage patterns
The AI usage patterns most frequently encountered in organisations, and the corresponding categories of legal risk:
| Departmental practice | Area of legal risk |
|---|---|
| Transferring the customer database to generative AI tools | Breach of KVKK art. 12 · cross-border data transfer |
| AI-based candidate assessment in HR processes | EU AI Act Annex III · high-risk system obligations |
| Submitting contracts and confidential commercial documents for AI analysis | Trade secret breach · contractual confidentiality obligations |
| Transferring closed source code to AI development tools | Intellectual property · licence breach · competition law |
| Processing meeting recordings through AI transcription services | KVKK art. 12 · absence of explicit consent · contractual liability |
Upper limits of administrative fines
| Breach | Upper limit |
|---|---|
| KVKK — breach of data security obligations (art. 12) | TRY 17,092,242 (2026) |
| KVKK — breach of the obligation to inform | TRY 1,709,200 (2026) |
| EU AI Act — prohibited practices (art. 5) | EUR 35,000,000 or 7 per cent of worldwide turnover |
| EU AI Act — breach relating to high-risk systems | EUR 15,000,000 or 3 per cent of worldwide turnover |
Areas of work
- AI system inventory and risk classification aligned with Annex III
- Acceptable use policy and tool authorisation framework
- Data classification rules and approval matrix
- AI procurement and development agreements
- AI liability clauses in supplier and customer agreements
- Algorithmic transparency and human oversight obligations
- Legal liability arising from the use of AI-enabled products
- Breach notification protocol and incident response plan
- AI literacy programme under art. 4 of the EU AI Act
Insights in this area