The EU AI Act (Regulation 2024/1689) is the European Union's law that sorts AI systems into risk categories, each with its own obligations. It also applies to Turkish companies that place AI-enabled products or services on the EU market, or whose AI output is used in the EU. Start with an inventory of every AI use and its risk category.
Why a Turkish company should care
At the time of writing, Türkiye has no AI-specific law in force. Its main reference point is the personal data protection law, KVKK (Law No. 6698), which is broadly modelled on the EU's older data protection rules. So many managers in Türkiye file the AI Act under "Brussels' problem".
That reading is risky. Like the GDPR, the AI Act looks at where a system is placed on the market and where its output is used, not where the company is registered. Three situations bring a Turkish business into scope: selling software, machinery or services with an AI component to EU customers (you become a "provider"); running an AI system through an EU subsidiary or branch (a "deployer"); and using output produced in Türkiye, such as a score or a classification, about people in the EU.
Then there is the indirect route. EU buyers push regulatory risk down their supply chains through contracts and questionnaires, as Turkish exporters have already seen with the NIS2 supplier requirements and CBAM carbon reporting. It would be no surprise to see AI questionnaires from EU customers follow the same pattern.
What is the EU AI Act and how does it classify risk?
The AI Act regulates the purpose, not the technology. The same language model can be minimal risk when it summarises customer emails and high risk when it screens job applications. Classification therefore happens per use case, not per product.
| Risk category | Typical use | Core obligation |
|---|---|---|
| Unacceptable (prohibited) | Emotion recognition in the workplace, social scoring, manipulation that exploits vulnerabilities | Banned |
| High risk | CV screening, employee performance evaluation, credit scoring, safety components of critical infrastructure, safety functions in machinery or lifts | Risk management, data governance, technical documentation, logging, human oversight, conformity assessment |
| Limited risk (transparency) | Customer service chatbots, AI-generated images, audio or text | Tell people they are dealing with AI; mark generative output in a machine-readable way; disclose deepfakes and AI-generated text published to inform the public |
| Minimal risk | Spam filters, demand forecasts, email triage, visual inspection without a safety function | No extra obligations beyond AI literacy; voluntary codes of conduct |
General-purpose AI (GPAI) models sit in a separate layer. Those rules target the companies that build large models. A Turkish manufacturer or distributor that uses such a model inside its own processes normally carries the obligations of its own use case, not the GPAI rules.
The timeline: what applies when
The act was phased in rather than switched on overnight. According to the European Commission's AI Act regulatory framework page, it entered into force on 1 August 2024. Prohibited practices and the AI literacy obligation have applied since 2 February 2025, the GPAI rules since 2 August 2025, and the act became broadly applicable on 2 August 2026.
High-risk deadlines moved. The same Commission page explains that the Digital Omnibus, in force since 27 July 2026, postponed the high-risk rules to 2 December 2027 for systems in areas such as biometrics, critical infrastructure, education and employment, and to 2 August 2028 for AI embedded in products such as lifts and toys. Transparency rules have applied since August 2026. The same package added a ban, from December 2026, on systems such as "nudification" apps that generate non-consensual sexually explicit content, and extended simplified requirements for SMEs, such as lighter technical documentation, to small mid-cap companies.
Treat the postponement as preparation time, not relief. Technical documentation, data governance and logging for a high-risk system are not built in a sprint. And the bans and the literacy duty are already live.
The cost of waiting: fines and stalled projects
Because fines are tied to worldwide turnover, a small EU sales line can expose the whole group. Article 99 of the AI Act sets the ceilings:
Up to €35 million or 7% of worldwide annual turnover for prohibited practices, €15 million or 3% for breaches of other obligations, and €7.5 million or 1% for supplying incorrect or incomplete information to authorities, whichever is higher. For SMEs, the lower of the two caps applies.
Uncertainty is a cost in its own right. In TurkStat's AI Statistics 2025 bulletin, 62.4% of Turkish enterprises that considered AI but did not adopt it cited unclear legal consequences. The Turkish Ministry of Trade's E-Commerce Outlook Report 2025 found the same: legal uncertainty was the top barrier, named by 70.3% of surveyed e-commerce businesses as holding back their AI use.
The fix is rarely the law itself; it is knowing which category you fall into. Once the inventory and classification are done, most companies find that their planned projects are minimal risk and can go ahead, and they can focus effort on the few that are not.
EU AI Act compliance in seven steps
This sequence works for a mid-sized Turkish company that trades with the EU. Each step produces the input for the next.
- Build an AI inventory. List every use: AI features inside purchased software, generative AI tools employees use, and models you built yourself. If you have already done a KVKK personal data inventory, you know half the method.
- Establish your role. For each use case, record whether you are provider, deployer, importer or distributor. Most obligations depend on the role. A provider established outside the EU that places a high-risk system on the EU market must also appoint an authorised representative in the EU.
- Assign a risk category. Use the table above and look hard at HR and recruitment use cases. If the platform you shortlist during HR software selection ranks candidates or scores performance, that use case may be high risk.
- Stop anything prohibited. If a use falls in the unacceptable category, end it now; those rules have applied since February 2025.
- Cover literacy and policy. Take measures to build the AI literacy of staff who operate AI, and write the rules down in a company AI acceptable use policy.
- Add the transparency layer. Chatbots must tell users they are talking to AI, and deepfake images, audio and video, as well as AI-generated text published to inform the public, must be disclosed. If you provide a system that generates content, its output must also be marked so it can be detected as AI-generated. These rules have applied since August 2026.
- Document high-risk systems. Data sources, model versions, test results, human oversight steps and incident logs must be traceable. Running the model lifecycle through MLOps practices produces much of that evidence automatically.
The AI Act does not replace data protection law. Where an AI system processes personal data, the duties covered in our guide to AI and KVKK apply in parallel, and the GDPR applies to data about people in the EU. The good news is that the foundations overlap: data inventory, access rights and logging serve all three regimes.
Provider versus deployer: a compliance checklist
Obligations are split between whoever builds the system and whoever uses it. For a high-risk use case, the checklist below shows who must be able to prove what.
| Control | Provider (builds or sells) | Deployer (uses) |
|---|---|---|
| Risk management system | Establishes and maintains it | Follows the instructions for use |
| Training data quality and governance | Documents it | Ensures its own input data is relevant |
| Technical documentation and conformity assessment | Prepares them | Requests and keeps them |
| Automatic logging | Builds it into the system | Retains the logs |
| Human oversight | Designs it in | Assigns a competent person |
| Incident reporting | Reports to authorities | Informs the provider and authorities |
If you buy AI-enabled software, this table becomes part of your procurement specification. When evaluating AI project proposals, a vendor's answers on documentation, logging and human oversight should weigh as much as price.
How we handle AI Act readiness at Digital Bridge
Legal interpretation belongs with your lawyers; we build the technical and process side. Work starts with a discovery session in which we map which teams use which AI tools and which systems touch EU customers or staff. That inventory lives alongside the data inventory prepared under our data protection compliance service, so the two compliance efforts do not duplicate each other.
Next, we produce a gap report: a proposed role and risk category for each use case, the missing controls and an order of priority. For high-risk use cases, our data governance and quality work documents where training and input data come from, who owns it and which quality rules apply.
On the build side, we add logging, human approval steps and transparency notices to new or existing systems as part of an AI integration project. A pilot of an enterprise LLM assistant that keeps company data in-house often tackles literacy and data leakage together, because staff get a sanctioned tool instead of pasting data into public ones. Access control, logging and incident response are tied into the same framework through our cyber security consultancy.
We apply the same principles in our own Smart360 product family. SmartOperator, our AI customer agent for websites, shows step by step in its panel which information each answer was based on, hands the conversation to your team when it is unsure, and waits for the visitor's confirmation before important steps such as placing an order or submitting a form. In SmartMail and SmartFiles, AI is a separate permission granted person by person, so who may use AI on which data is defined in the system itself.
If you are only starting with AI, the order changes. We begin with where to start with AI in business and design the first project as low risk and documented from day one, so there is far less to rewrite later for compliance. More articles on the subject are collected on our artificial intelligence topic page.
Next step
If you sell products, software or services into the EU, begin with an AI inventory and risk classification; it shows exactly how tight your timeline really is. Get in touch and we will review your current AI use with you, place each use case in its category and set out where to start.