Turkey - AI Law Amendments (Esas No. 2/3358)

Overview

The Bill on Amendments to Certain Laws Regarding Artificial Intelligence (Esas No. 2/3358) is a multi‑article proposal submitted to the Grand National Assembly of Turkey (TBMM) on 7 November 2025. The draft does not create a new standalone AI law but amends existing statutes (including Law No. 5651 on Internet Publications, the Turkish Penal Code No. 5237, the Personal Data Protection Law No. 6698, the Electronic Communications Law No. 5809, and the Cybersecurity Law No. 7545) to introduce AI‑specific definitions, liabilities and technical obligations. The proposal emphasizes protecting personality rights, public order and election security while creating administrative and criminal accountability for misuse. The official bill text is published by the TBMM and is available as an official PDF on the TBMM site and summarized in TBMM docket entries. See the TBMM record and bill text: TBMM Kanun Teklifi (Esas No. 2/3358) and the bill PDF: Bill PDF (TBMM).

Definitions

Article 1 of the draft adds a legal definition of "AI system" into the Internet Publications Law (No. 5651). The statutory definition covers software, models and algorithmic assemblies that, with limited or no human intervention, process data to perform specific tasks (including machine learning, deep learning, neural networks and similar techniques) and produce outputs such as decisions, recommendations or content. The definition is purposive: it reaches both fully automated and semi‑autonomous systems and is designed to clarify which systems and outputs are subject to the bill's obligations (e.g., labeling, takedown duties and dataset requirements).

Governance and Institutional Framework

The draft relies on existing Turkish institutions rather than creating a new standalone AI regulator. Primary enforcement and technical supervision powers are assigned to the Electronic Communications Authority (BTK — BTK) for online content enforcement, and the Personal Data Protection Authority (KVKK — KVKK) for data‑related obligations. Cybersecurity obligations and sanctions flow through the structures established under the Cybersecurity Law (No. 7545), and criminal‑law changes will be applied by judicial authorities under the Turkish Penal Code. The TBMM bill text also envisions coordination with the Ministry of Industry and Technology and references Turkey's National AI Strategy (2021‑2025) as contextual policy support. Enforcement is therefore multi‑agency: BTK for content blocking, KVKK for dataset/data security violations, cybersecurity authorities for technical security failures, and judicial organs for criminal enforcement.

Key Focus Areas

The bill's substantive measures converge on a small set of core regulatory objectives: (1) rapid removal and blocking of AI‑generated content that violates personality rights or threatens public order (deepfakes), with a maximum operational window of six hours for takedown decisions; (2) mandatory labeling of AI‑generated audiovisual, audio and textual content with a persistent, clear statement (for example, "Produced by Artificial Intelligence"); (3) expanded criminal liability rules that treat the user directing an AI to commit a crime as the perpetrator and increase penalties for developers/designers whose systems enable criminal acts; (4) data governance obligations under KVKK ensuring datasets used in AI are anonymized as appropriate, free from discriminatory sampling and processed lawfully; (5) enhanced cybersecurity and technical obligations for AI service providers (dataset transparency, verification mechanisms to prevent manipulative/false information, algorithmic controls to reduce hallucinations, mandatory human oversight for high‑risk uses, and periodic security/vulnerability testing); and (6) administrative sanctions and fines calibrated to deter noncompliance (ranging in draft provisions from hundreds of thousands to multiple millions of Turkish Lira) and temporary activity suspensions for severe public order threats. The general rationale repeatedly frames the measures as proportionate steps to protect rights and public order while facilitating innovation under clear responsibilities.

Implementation Framework

Operationally the bill amends existing procedural pathways: BTK gains emergency access‑blocking/removal authority in cases where AI content threatens public order or election integrity, and may levy administrative fines (the text proposes amounts up to 10 million TL in some cases). Cybersecurity law amendments impose concrete technical duties on providers operating AI systems — including dataset transparency and verifiability, content verification tools to avoid manipulative information, algorithmic checks for hallucinations, human‑in‑the‑loop mechanisms for high‑risk applications, and routine cyber‑security testing. Social network operators are explicitly drawn into responsibility regimes that already apply under Law No. 5651; criminal‑law expansions are drafted to enable prosecution of users and enhanced punishments for developers who facilitate offences through system design or training. The bill leaves detailed technical standards and implementation guidance to be developed by BTK and other relevant agencies through secondary regulations and technical guidance documents.

Monitoring and Evaluation

Monitoring is assigned to the authorities empowered under the amended statutes: BTK for content‑related enforcement and technical supervision, KVKK for data governance compliance, and cybersecurity authorities for technical testing and incident reporting. The bill anticipates that BTK will have authority to conduct audits, publish guidance and use technical monitoring tools; it also contemplates administrative penalty regimes to incentivize compliance. The text implies interagency coordination mechanisms will be necessary to evaluate efficacy, but it does not prescribe a formal interministerial committee; such structures would likely arise in secondary implementation instruments or commission reports.

Penalties, Liability, and Appeals

Penalties in the draft mix administrative fines and criminal‑law consequences. Administrative sanctions include monetary fines in tiers (examples in the text: 500,000 TL to 5,000,000 TL for failure to label or systematic violations; up to 10,000,000 TL where BTK finds breaches that threaten election security/public order), and temporary activity suspensions for grave threats to public order. Criminal‑law changes provide that a user who directs an AI to commit a crime is the perpetrator and that a developer/designer who enabled the offence by design/training faces an increased sentence (penalty increased by half). Appeal procedures would follow existing administrative‑law and judicial review avenues applicable to BTK and other agency decisions, while criminal penalties remain subject to ordinary criminal procedure and appeal rights under Turkish law.

Relationship to Other Instruments

The bill amends and interacts with multiple existing legal instruments: Law No. 5651 (Internet Publications), Law No. 5237 (Turkish Penal Code), Law No. 6698 (KVKK), Law No. 5809 (Electronic Communications) and Law No. 7545 (Cybersecurity). It does not repeal these laws but inserts AI‑specific provisions into them. It also references Turkey's National AI Strategy (2021‑2025) as policy context for the legislative changes. The draft therefore uses sector‑specific statutes as vehicles for AI rules rather than consolidating AI governance in one new code.

International Alignment

The draft shows conceptual alignment with global policy trends — focusing on transparency, human oversight in high‑risk settings, data governance and sectoral enforcement — broadly consistent with EU AI Act debates and other international approaches that combine risk‑based controls, labeling of synthetic content and obligations for providers. At the same time, the bill emphasizes national public order and election security priorities (notably emergency BTK powers and compressed removal timelines), reflecting domestic regulatory priorities. The bill’s multi‑agency enforcement model mirrors other jurisdictions that rely on existing sectoral authorities rather than a single AI regulator.

Implementation Timeline

Sources and References