"Will Türkiye enact an AI law, and what should companies prepare for?" is a question that organizations bringing AI into their business processes ask often. The most solid answer available today comes from the report of the research commission that the Türkiye Büyük Millet Meclisi (TBMM, the Turkish Parliament) set up for AI. Dated March 2026 and carrying parliamentary serial number 260, the report ends with a table of 100 recommendations. It reached the public on 27 March 2026.
In this article, we first clarify the legal nature of the report, then summarize the recommendations that directly concern organizations and list the preparation steps that can be taken today.
First, the framework: the report is not a law
Understanding correctly what the report is prevents both unnecessary alarm and unnecessary complacency. The commission is a parliamentary research commission set up under Article 98 of the Constitution and the TBMM Rules of Procedure (İçtüzük). According to the Constitution, parliamentary research on a specific subject is a review conducted to obtain information. The recommendations in the report are therefore not binding on their own; a separate legislative process is required for them to become law.
There is extensive work behind the report. The commission began its work in January 2025; it held 13 meetings, heard 119 people from institutions, civil society and academia, and collected 48 briefing notes and reports from stakeholders.
The legislative side also deserves a look. On the TBMM website, the "Yapay Zeka Kanun Teklifi" (AI Bill, Esas No 2/2234), submitted on 24 June 2024, showed the status "In Committee" at the check made on 5 October 2026. In short, a comprehensive framework law specific to AI is, for Türkiye, still a proposal today; the report matters because it gives the most detailed official indication of the direction such a law could take.
The proposed law's character: flexible, but not empty
Recommendation 27 of the report calls for the preparation of a "Türkiye AI Law" (Türkiye Yapay Zekâ Kanunu). The law described is a framework that does not copy existing regulations and is human-centered and in line with ethical principles, while also being flexible and innovation-focused. It is recommended that the details be left to secondary legislation and guidelines.
This flexibility does not mean there will be no obligations. The same recommendation speaks of introducing management processes such as a trustworthy-AI mark, certification and conformity assessment criteria, after risk-management and transparency analyses in the necessary areas. On institutional structure, it proposes establishing, in the long term, a Türkiye AI Authority (Türkiye Yapay Zekâ Kurumu) to coordinate existing institutions.
Recommendations that directly concern organizations
Some of the report's 100 recommendations focus on the public sector, education and research. Those that could affect how companies do business can be summarized as follows (all taken from the report's recommendation table):
- Human oversight (recommendations 31 and 51): Positioning AI in the judiciary, healthcare and education as a decision-support tool rather than a substitute for people; control mechanisms that prevent decisions based on AI output without meaningful human oversight.
- Personal data (recommendation 36): In KVKK (Türkiye's data-protection law), a right for the data subject to request human intervention and to object in fully automated AI decisions and profiling; making the privacy-by-design principle and the data protection impact assessment mandatory.
- Independent audit (recommendation 42): Audit and certification processes to be carried out by an accredited body; making independent audit mandatory for high-risk applications.
- Transparency and content labeling (recommendations 52 and 55): A design that lets people know they are interacting with AI; making AI-generated content detectable through watermarks and metadata.
- Product liability (recommendation 34): Updating the product safety and liability framework, starting with Law No. 7223 (the Product Safety and Technical Regulations Law), so that it covers software and AI systems.
- Prohibited practices (recommendation 32): Banning systems that manipulate human will and cause significant harm.
- Sector-specific rules (recommendation 59): Standards for model risk management, auditability and data governance in the financial sector.
The report does not propose only obligations. Regulatory sandboxes, GPU pools for small-scale ventures, and the AI infrastructure of public institutions such as TÜBİTAK (the Scientific and Technological Research Council of Türkiye) being opened to the private sector are also among the recommendations. Grants, incentives, low-interest loans and tax reductions or exemptions for SMEs and entrepreneurs are also recommended.
The link to the EU also stands out. On AI-driven discrimination, the report recommends legislative work that takes alignment with existing EU rules into account. The general logic of the obligations (human oversight, transparency, audit for high risk) is a language that companies supplying products or services to the EU already know. We covered the EU-side timeline in our EU AI Act article.
Steps you can take today
Because the content and timeline of the law are not yet clear, it is not possible to produce a definitive compliance list. However, the themes that stand out in the report point to preparations that will be useful whichever regulation arrives. The steps below are a general framework derived from these themes:
- Build an AI inventory. List which tool or model is used in which process, and with which data. Include the embedded features in purchased software as well.
- Classify uses by impact. Flag separately the uses that produce outcomes about people (such as recruitment, credit, performance appraisal and customer assessment); the report's audit and human-oversight recommendations target this area most.
- Define human approval points. Put in writing the threshold at which an automated decision goes to an employee for approval and how objections will be handled.
- Address the personal-data dimension under today's rules. Existing KVKK obligations apply to AI use as well; for a policy on employees' use of generative AI, see our KVKK guide article.
- Build a documentation habit. If model or tool selection, test results and known limitations are on record, preparation time is shorter when a conformity assessment or independent audit is requested later.
- Label AI-generated content. Clearly stating the use of AI in text, images or chatbot interactions that reach customers is a low-cost step consistent with the report's transparency recommendations.
- Follow the support programs and sandboxes. If the sandbox, public computing infrastructure and incentive recommendations are put into practice, organizations with a ready inventory and a clear use case can take advantage of these opportunities faster.
- Assign regulatory monitoring to someone responsible. As bills in the TBMM and secondary regulations change, update the assessment together with the legal and compliance teams.
Conclusion
The TBMM commission report is the most comprehensive official text showing which direction AI regulation in Türkiye could take; but it is a roadmap, not a law. The proposed framework is described as flexible and innovation-oriented, yet it draws a clear direction on topics such as human oversight, transparency, personal data and audit for high risk.
For organizations, the sensible stance is not to wait for the law but to start today with steps that create value in every scenario, such as inventory, classification and documentation. From Orient Global's perspective, this preparation should be treated not as a separate compliance project but as a natural part of the AI roadmap.
Why logistics experience matters here. In warehouse and transport operations, the AI uses that produce outcomes about people, such as performance evaluation across large teams, are the ones the report's human-oversight and audit recommendations target most. The habits these steps call for will be familiar to anyone who has run a distribution network: a current inventory of what is in the network, a named owner and an approval point at every hand-off, and records that stand up to audit. One of Orient Global's consultants brings more than 30 years in operations, logistics and supply chain, including end-to-end responsibility for logistics, warehousing, technical service and administrative operations at a technology distribution company of roughly one billion dollars in scale, and management of nationwide warehouse and transport operations at leading retail, logistics and distribution organizations. An industrial engineer, he now brings that supply-chain discipline to SMEs through AI and automation. Meet our consultants.
This article is for general information purposes only and is not a substitute for legal advice.
#interimmanagement #forwarddeployedengineering