As the number of applications grows, human resources (HR) teams are turning to AI tools that screen CVs, rank candidates or analyze video interviews. Managers' question is also becoming clearer: is using these tools legally risky, and what should they pay attention to?
The topic is on the agenda in Türkiye as well. On 25 September 2026, the Kişisel Verileri Koruma Kurumu (Türkiye's Personal Data Protection Authority, "the Authority") announced that, together with İbn Haldun University, it will hold the "Symposium on Artificial Intelligence in Employment and the Protection of Personal Data" on 3-4 December 2026. The headings that stand out in the announcement are privacy, discrimination, transparency and accountability.
The data confirms that the issue is real in practice. According to the 2 October 2026 bulletin of TÜİK (the Turkish Statistical Institute), 16.6% of enterprises that use AI reported that they process personal data, such as gender, age, education level or facial images, with these technologies. Among enterprises that do not use AI but are considering it, 66.4% cited uncertainty over legal consequences and 65.4% cited data protection and privacy concerns as their reasons for not using it.
This article looks at three texts: the prohibition of discrimination in Law No. 6701 (on the Human Rights and Equality Institution of Türkiye), Law No. 6698 (KVKK, Türkiye's Personal Data Protection Law) and, for companies that assess candidates in the EU, the EU AI Act.
The prohibition of discrimination expressly covers hiring
Article 6 of Law No. 6701 on the Human Rights and Equality Institution of Türkiye (the "Institution") provides that an employer, and any person the employer has authorized, may not discriminate against a person applying for a job in any work-related process, including access to information, application, selection criteria and hiring conditions. The article also covers job advertisements. Article 3 of the Law prohibits discrimination based on grounds such as gender, ethnic origin, marital status, health status, disability and age.
The concept that matters most for AI is indirect discrimination. The Law defines it as a situation in which practices that appear non-discriminatory on their face leave a person, in connection with these grounds, in a disadvantaged position that cannot be objectively justified. Not giving a model an "age" or "gender" column is not a safeguard in itself; variables such as graduation year, career breaks or address can push the result in the same direction. The assessment looks not at the model's input but at its outcome for candidates.
Two more provisions matter for employers. Article 3 obliges the natural persons and private-law legal entities that are responsible under the prohibition of discrimination to take, within their own spheres of authority, the measures necessary to detect and eliminate discrimination. Under Article 21, in applications to the Institution, if the applicant presents strong indications of discrimination, the burden of proving that no discrimination took place shifts to the other party. An employer that cannot document how the tool works and what results it produces may therefore find itself in a weak position.
KVKK: accuracy, proportionality, notice and objection
The principles in Article 4 of Law No. 6698 apply directly to candidate assessment: data must be accurate and, where necessary, up to date; processed for specific and legitimate purposes; and relevant to the purpose, limited and proportionate. Feeding a model social media data that a position does not require can be called into question under these principles.
In video interview analysis, the risk of special-category data also deserves attention. Article 6 of the Law treats health, appearance and attire, biometric and genetic data as special-category data and, as a rule, prohibits their processing; processing is possible only in the limited cases listed in the Law.
On the transparency side, Article 10 requires that, when data is collected, the data subject be informed of the purpose of processing, the parties to whom the data will be transferred, and the method of collection and legal basis. Within this framework, the candidate privacy notice should clearly describe the existence of AI-assisted pre-screening. Article 11(g), for its part, gives a person the right to object to a result against them arising from the analysis of their data exclusively by automated systems. Where automated screening is used, to whom and how such an objection can be submitted should be designed in advance.
Who the data controller is, and how the legal basis is chosen, when an HR unit scores CVs with an off-the-shelf language model were covered in the in-house policy article in which we summarized the Authority's guide on generative AI; they are not repeated here.
For companies assessing candidates in the EU
Annex III of the EU AI Act classifies systems used for recruitment and selection as high-risk, in particular systems that place targeted job advertisements, analyze and filter applications, and evaluate candidates. With the AI Omnibus (the Digital Omnibus on AI), the application date of the rules on Annex III systems was moved to 2 December 2027. The situations in which the Act applies to Turkish companies, and the full timeline, are set out in our article on the AI Act timeline.
One provision relevant to hiring has not been postponed. Article 5(1)(f) of the Act prohibits the use of AI to infer people's emotions in workplaces and educational institutions, except for medical and safety purposes; the prohibitions have applied since 2 February 2025. The European Commission's non-binding guidelines on prohibited practices state that the concept of "workplace" also covers candidates in the selection and recruitment process, and that using an emotion recognition system in hiring is prohibited. A tool that claims to score a candidate's excitement or "sincerity" in a video interview should therefore be examined with care.
When the high-risk rules start to apply, the obligations of the employer that uses the system (the "deployer" in the Act's terminology) are listed in Article 26:
- Assigning human oversight to people with the necessary competence, training and authority,
- Ensuring that the input data it controls is relevant to the intended purpose and sufficiently representative,
- Informing workers' representatives and affected workers before the system is used in the workplace,
- For systems that make or assist in making decisions about natural persons, informing those persons that the system is being used.
Article 86 also grants a right to explanation of the role of the AI system in the decision and of the main elements of the decision, for decisions based on the output of Annex III systems that significantly affect a person.
A checklist for AI in hiring
The steps below are a starting framework derived from the provisions above:
- Build an inventory. List which AI features are switched on in your applicant system, job-posting platform and interview tool, including embedded features.
- Ask what the tool measures. Ask the vendor in writing for the variables used in scoring and whether any emotion, facial or voice analysis is performed.
- Compare outcomes across groups. Monitor screening rates at regular intervals by protected grounds such as age and gender, and investigate unexplained differences.
- Limit data to the position. Give the model only the information the job requires, and filter out fields that contain special-category data.
- Keep a human at the decision point. Make a rejection decision subject to the approval of a competent reviewer, and do not produce "exclusively automated" decisions.
- Inform the candidate and open a path to object. Describe the use of AI in the privacy notice, and spell out how an objection can be submitted.
- Document everything. Keep records of the tool's version, its settings, monitoring results and human decisions; in a dispute over the burden of proof, these records are the only support you have.
Conclusion
Using AI in hiring is not unlawful in itself; the risk arises when a tool is used without knowing what it measures and without monitoring its results. Under Turkish law, the prohibition of discrimination and KVKK apply today; for companies assessing candidates in the EU, the ban on emotion recognition is in force, while the high-risk obligations arrive at the end of 2027. The Authority's symposium in December shows that the topic will remain on the regulatory agenda.
The soundest place to start is to build an inventory of the tools in use and bring the HR, legal and information technology teams to the same table.
Why logistics experience matters here. Logistics and distribution businesses often hire in volume and in seasonal peaks. That is where automated screening is most tempting, and where an unexplained gap between groups goes unnoticed unless someone measures it. The controls in the checklist above will look familiar to anyone who has run a warehouse: a count of what is in use, a specification for what comes in, KPIs reviewed at regular intervals, a named owner at every hand-off and records that stand up to audit. One of Orient Global's consultants brings more than 30 years in operations, logistics and supply chain, including end-to-end responsibility for logistics, warehousing, technical service and administrative operations at a technology distribution company of roughly one billion dollars in scale, management of nationwide warehouse and transport operations, and building and leading teams of 100+ people. An industrial engineer, he brings that supply-chain discipline to SMEs through AI and automation. Meet our consultants.
This article is for general information purposes only and is not a substitute for legal advice.
#interimmanagement #forwarddeployedengineering