1. Introduction
Artificial intelligence is no longer merely a technological innovation. It has become core infrastructure that shapes law, the economy, public order and social life as a whole. Its reach, learning capacity and scalability offer revolutionary opportunities in almost every field, from manufacturing to healthcare and from education to financial systems, and make possible a transformation in efficiency, speed and decision-support mechanisms that has no precedent in human history. This vast potential has become a competitive factor that gives countries a strategic edge, while also bringing individuals significant gains in comfort and accessibility in their daily lives.
Alongside the broad opportunities it creates, however, this rapid development also brings new legal debates, ethical challenges and regulatory needs. Issues such as the protection of personality rights, data security, the risk of discrimination, content manipulation, security threats and effects on democratic processes arise as structural questions that must be resolved alongside the possibilities AI offers. For this reason, it is becoming increasingly unavoidable to build a robust legal framework that can manage and balance the risks while still benefiting from the substantial advantages the technology provides.
In Türkiye, in response to similar needs, the Artificial Intelligence Bill (Yapay Zekâya İlişkin Kanun Teklifi) has been submitted to the Grand National Assembly of Türkiye (TBMM) in order to fill the legal gaps created by the rapid spread of AI technologies and to prevent possible misuse. The bill provides for rules in critical areas such as the definition of AI systems, the responsibilities of developers and users, the protection of personality rights, the prohibition of discriminatory datasets, requirements for deepfake content and administrative sanctions where public security is threatened. It is of great importance that Türkiye does not fall behind the fast-moving global regulatory trend in this field, and that it establishes a balanced legal framework that does not limit the potential of the technology while effectively controlling the risks of misuse. In this article, we assess the bill submitted to the Grand National Assembly in terms of its legal requirements, its impact and the areas open to debate.
2. General Framework of the Bill
The Artificial Intelligence Bill submitted to the Grand National Assembly takes a holistic approach aimed at determining the legal status of AI systems and bringing under control the risks that may arise from their use. The bill seeks to clarify the legal responsibilities of both users and developers, and introduces new norms for the protection of personality rights, public order and democratic processes. The regulation is built mainly around four pillars:
(1) Definition and scope: For the first time in Turkish law, the bill introduces a broad and technical definition of an "artificial intelligence system", setting out clearly which systems fall within its scope. The aim appears to be to prevent differing interpretations from arising in the future.
(2) Criminal liability: Where AI systems are used to produce content that constitutes a criminal offence, the user who gave the prompt is to be held liable as the perpetrator, while developers who made that outcome possible through the system's design or training may face an increased penalty. This approach is consistent with classical criminal law principles that place the human will behind the act at the centre.
(3) Access blocking and content removal: Content that threatens public security, violates personality rights or constitutes a deepfake must be removed within 6 hours. This time limit provides for a very fast intervention mechanism compared with current practice and imposes joint liability on content providers and developers.
(4) Datasets, discrimination and security: The bill aims to prohibit discriminatory datasets expressly and to make the principles of anonymity, legitimacy and data security mandatory elements of AI training processes. It also grants the Information and Communication Technologies Authority (BTK) and other relevant authorities the power to intervene swiftly against AI content that threatens public order or election security.
Within this framework, the bill aims both to manage the risks arising from the technology and to establish a basic architecture for the safe use of AI-based systems. In the following sections, we examine the elements of this architecture in more detail, article by article.
3. Article-by-Article Legal Assessment
3.1. Definition of an AI system (Article 1 – Law No. 5651, Art. 2)
The first article of the bill introduces a comprehensive definition of an AI system into Turkish law. The definition is drawn broadly to cover all models that "produce outputs autonomously or semi-autonomously" through machine learning, deep learning, artificial neural networks, algorithms and similar methods. This broad scope may create both advantages and debate in practice. Its advantage is that it offers a future-proof framework that keeps pace with technological developments. On the other hand, the very breadth of the definition may lead practitioners to differing interpretations as to which systems are genuinely to be treated as "artificial intelligence". Considering the European Union AI Act's definitional approach, which relies on more technical criteria and is tied to risk categories, the Turkish definition can be described as inclusive but with boundaries that are open to debate.
3.2. User and developer liability (Article 2 — Turkish Criminal Code, Art. 125)
The paragraph added to Article 125 of the Turkish Criminal Code (TCK) provides that where AI is used to commit offences such as "insult", the user who gave the prompt is to be deemed the direct perpetrator. It further provides that the penalty for a developer who made such acts possible through the system's design or training is to be increased by one half. This provision offers a framework consistent with the principle of individual criminal responsibility and the "human will in criminal liability" approach. Nevertheless, the increased liability imposed on developers may create uncertainty as to which design or training conduct will, technically, be regarded as "enabling an offence". This area may call for secondary legislation in the future, particularly so that innovation is not stifled by criminal risk.
3.3. Access blocking and content removal obligation (Article 3 – Law No. 5651, Art. 8)
The requirement to remove AI-generated content that violates personality rights, threatens public security or constitutes a deepfake within 6 hours is one of the most striking provisions of the bill. This time limit establishes a very fast and ambitious intervention mechanism compared with the access-blocking orders applied in current practice. Moreover, imposing joint liability on content providers and developers may give rise to debate in relation to developers whose technical capacity to intervene is limited. While it is a strong step in combating deepfakes, it is clear that a balance will need to be struck in terms of enforceability and technical reality.
3.4. Prohibition of discriminatory datasets (Article 4 — KVKK, Art. 12(6))
This article requires datasets used in AI training to comply with the principles of anonymity, non-discrimination and legitimacy. It also treats "use of a discriminatory dataset" as a data security breach in itself. While this provision is consistent with the constitutional principle of equality and the fundamental principles of Law No. 6698 on the Protection of Personal Data (KVKK), it reflects an approach parallel to the "bias mitigation" obligations in the European Union AI Act. In practice, how discrimination analyses are to be carried out, how supervision will operate and what technical standards will apply in identifying breaches will need to be regulated separately.
3.5. BTK's emergency intervention power (Article 5 – Law No. 5809, Art. 6)
Granting BTK an emergency access-blocking power over AI content that threatens election security or public order strengthens the security-focused dimension of the bill. Rapid intervention is needed against manipulative AI content (for example, deepfake videos), particularly during election periods. Nevertheless, administrative fines of up to TRY 10 million and broad discretionary powers may give rise to debate about proportionality and legal foreseeability.
3.6. Technical obligations for service providers (Article 6 – Law No. 7545, Art. 7)
This article imposes five core obligations on service providers: — dataset transparency, — content verification mechanisms, — reduction of hallucination risk, — human approval in high-risk applications, — regular cybersecurity testing.
This approach parallels the "safe AI" principles found in the regulations of many countries and is particularly reminiscent of the AI Act's obligations for high-risk systems. In Türkiye, however, questions such as how these obligations will be supervised, against which technical standards they will be measured and which authority will be competent must be clarified in the future.
3.7. Mandatory deepfake labelling (Article 7 — Additional Article 5)
The bill requires fake visual, audio and text content generated by AI to be labelled clearly and indelibly with the words "Generated by Artificial Intelligence" ("Yapay Zekâ Tarafından Üretilmiştir"). This is a very important step, particularly for election security, the prevention of public opinion manipulation and the protection of personality rights. Nevertheless, the fact that deepfake detection is not always technically possible, the requirement to make removal of the label technically impossible, and the question of how this obligation will be enforced against cross-border digital platforms will create significant areas of debate.
3.8. Expansion of the scope of offences (Article 8 – Law No. 5651, Art. 8)
Expressly adding certain offences that may be associated with AI systems to the scope of Law No. 5651 provides a strong legal tool for protecting public order and personality rights. However, the fact that access blocks can be technically circumvented, and their relationship with freedom of expression, must always be weighed in a balanced manner.
3.9. Liability of social network providers (Article 9 – Law No. 5651, Art. 8/A)
This provision brings AI-based social network providers within the liability regime in respect of certain provisions of the Turkish Criminal Code. While this approach increases the responsibility of social media platforms for AI generation processes of an editorial nature, it raises the question of which obligations will apply, and how, to AI systems with limited capacity for technical oversight.
4. AI Law Around the World: Common Trends
Although regulatory approaches to the rapid development of AI differ across regions of the world, certain common trends are becoming increasingly clear. The European Union is the first major regional regulator to bring comprehensive and binding AI legislation into force. With its risk-based approach, the AI Act divides AI applications into categories such as "prohibited practices", "high-risk applications" and "limited-risk systems", and imposes detailed supervision, transparency and security obligations on high-risk systems. Because it is the most systematic and binding regulatory model adopted anywhere in the world, most countries regard this approach as a reference point.
In the United States, by contrast, there is no binding AI law at federal level. Instead, the Executive Order on Safe, Secure, and Trustworthy AI issued by the White House in 2023 set comprehensive principles for federal agencies, and the guidance document entitled AI Bill of Rights set out fundamental rights-focused principles for technology development processes, such as safety, prevention of discrimination and explainability. The US regulatory approach is largely sectoral, spread across agencies and guidance-based.
The United Kingdom has expressly positioned itself as a country that adopts a "pro-innovation" approach. It has not yet enacted a comprehensive AI law and prefers different regulators to publish guidance within their own fields. This framework aims to create flexible regulation without restricting innovation.
In Canada, the Artificial Intelligence and Data Act (AIDA) is still a bill and has not yet entered into force. The bill sets out a framework providing for obligations for high-impact AI systems; at this stage, however, it does not have the status of binding law.
China stands out in the AI field for regulations in force covering, in particular, algorithmic recommendation systems, deep synthesis (deepfake) content and generative AI applications. These regulations impose transparency, content moderation and security obligations on developers, with particular emphasis on public order and security.
Looking at this picture, although regulation around the world is advancing through different methods, the common trends emerging are clear: — transparency in AI systems, — prevention of discrimination and manipulation, — human oversight of high-risk systems, — security testing, — sensitivity to public order and election security are the themes that indisputably come to the fore in most countries.
For this reason, taking into account the common principles taking shape worldwide is of critical importance for Türkiye to build a legal architecture that both supports technological development and manages risks effectively.
5. Legal and Strategic Impact Analysis for Türkiye: Positioning Against International Models
The Artificial Intelligence Bill submitted to the Grand National Assembly does not merely create a technical regulation by amending certain provisions; it also sends important signals about the position Türkiye has chosen to take in the AI ecosystem. In this respect, the bill has the potential to establish a strategic framework both in domestic law and in relation to global regulatory trends.
5.1. Legal Impact:
The bill contains important provisions that fill existing gaps in Turkish law in areas such as the definition of AI, the clarification of user and developer responsibilities, the prohibition of discriminatory datasets and intervention against deepfake content. In particular, defining AI for the first time, clarifying the criminal liability regime and providing rapid intervention mechanisms to combat manipulative content offer a positive framework in terms of legal foreseeability. However, matters such as how these rules will be applied in practice, how technical standards will be set and which authorities will act within which limits of competence may lead to uncertainty unless supported by secondary legislation.
5.2. Impact on the Technology Ecosystem and Developers:
The criminal and administrative liabilities that the bill imposes, particularly on developers, increase legal risk and have the potential to put pressure on innovation. The absence of clear standards on which technical conduct in the training and design of AI models will be regarded as "enabling an offence" or "using a discriminatory dataset" is a significant area of debate for practitioners and entrepreneurs. The regulation should therefore be applied with a balance that does not hinder development while keeping liability and supervision at a reasonable level.
5.3. Public Order, Election Security and Deepfake Risk:
The bill contains provisions enabling rapid intervention against manipulative AI content that may emerge, particularly during election periods. Mandatory labelling of deepfake content, its removal within 6 hours and the grant to BTK of broad powers to intervene against content that threatens public order represent a strong approach to protecting democratic processes. However, unless the scope of these powers and the manner of their exercise are carefully limited in line with the principle of proportionality, they may create problems for freedom of expression.
5.4. Positioning Against International Models:
AI regulation around the world follows different approaches. While the European Union AI Act establishes a risk-based and binding architecture, the US favours a flexible, sectoral guidance approach, the United Kingdom a light-touch model that encourages innovation, and China a strict, security-focused control system. Türkiye's bill takes a mixed position among these models: while it aligns with the EU approach on the prohibition of discrimination and dataset transparency, it moves closer to a more security-focused line in its emergency intervention powers and deepfake rules. On developer liability and content removal deadlines, it offers a more interventionist framework than the free-market-oriented model of the US and the United Kingdom. This mixed approach shows that Türkiye aims both to control risks and to regulate quickly without entirely stifling innovation.
6. Conclusion and Overall Assessment
The Artificial Intelligence Bill submitted to the Grand National Assembly is one of the most important steps taken towards establishing a comprehensive and systematic legal framework for AI in Türkiye. The bill contains notable innovations in areas such as the definition of AI systems, the determination of the responsibilities of users and developers, the prohibition of discriminatory datasets, clear labelling of deepfake content and rapid intervention mechanisms where public order is threatened. In this respect, the regulation is a strong start towards filling gaps that have long been felt in Turkish law.
One of the bill's most important contributions is that, by giving AI a legal definition, it makes it more foreseeable which systems will be subject to which obligations. In addition, clarifying user and developer responsibilities reduces uncertainty in criminal law and reinforces an approach centred on human will. The intervention mechanisms for deepfake content and the obligation to block access to or remove content within 6 hours create a critical area of protection, particularly for election security, public order and the protection of personality rights. Furthermore, the express prohibition of discriminatory datasets is an important step towards Türkiye giving concrete effect to the constitutional principle of equality in the digital sphere.
Nevertheless, the implementation of the bill raises some significant questions. Matters such as the limits of developers' criminal liability, how the concept of "enabling an offence" will be determined technically, who will define transparency and dataset standards, how deepfake labelling will be supervised technically and how the 6-hour removal deadline will operate in practice remain unanswered. Unless clarity is achieved in these areas, the foreseeability that the regulation aims for may be weakened, and legal risk may increase, particularly for technology start-ups. The bill must therefore be supported by secondary legislation, technical guidelines and sector-specific rules.
From an international perspective, Türkiye has adopted a mixed but pragmatic approach with this bill. The regulation moves closer to the European Union AI Act on the prohibition of discrimination, dataset transparency and control mechanisms for high-risk applications, while containing provisions closer to China's interventionist model on the security and public order axis. At the same time, it bears traces of the US and UK frameworks that do not entirely stifle innovation. This shows that Türkiye is developing a hybrid regulatory approach suited to its own needs rather than committing to a single model.
In conclusion, the Artificial Intelligence Bill is not merely a technical regulation for Türkiye; it is a tool for strategic positioning in terms of digital sovereignty, economic competitiveness, public security and the protection of fundamental rights. Although the regulation is a strong start, its success depends on establishing a balanced, proportionate implementation framework, consistent with technical reality, that can manage risks without slowing technological development. If Türkiye pursues a consistent regulatory policy in this field, it will be able not only to strengthen its domestic law but also to develop an AI law model that serves as a reference at regional and global level.
GlobalB Law
Att. Sara Civiler