Legal note · updated 23 Oct 2026
84 funds fully liquidated47 funds still in liquidation1 mn TL interim payment cap per fund (Law 7596)
Is ChatGPT confidential? Not in the way a conversation with your lawyer is. In United States v. Heppner, a New York federal court held in February 2026 that a defendant's own chats with an AI assistant were neither privileged nor work product, and in the OpenAI copyright litigation courts ordered ChatGPT logs preserved and produced. This analysis explains those rulings, the courts that disagree, and how Turkish law answers the same questions through the Attorneys' Act, the CMK, the HMK and the KVKK.
EN 18286 is the first harmonised standard under the EU AI Act: a quality management system standard whose reference was published in the Official Journal on 14 October 2026. Providers of high-risk AI systems that apply it now benefit from a presumption of conformity with Article 17. This analysis compares EN 18286 with ISO/IEC 42001, explains what the presumption covers and where it stops, why certification is a different thing, and what it means for Turkish and Korean exporters ahead of the 2027 and 2028 deadlines.
The AI Act nudification ban applies from 2 December 2026, when AI systems that generate non-consensual intimate images of real people or child sexual abuse material become prohibited in the EU. This analysis explains what the Digital Omnibus added to Article 5, who it reaches, the Article 50(2) marking deadline for systems already on the market, and how Turkish and Korean law treat the same images.
On 8 October 2026 Türkiye's data protection authority published Board principle decision No. 2026/2035 of 16 September 2026 on employers' monitoring of corporate e-mail and work channels. Its sixteen points hold that owning a tool is not a licence to monitor it without limit, that a general "e-mail may be monitored" notice does not by itself satisfy Article 10, that consent is suspect in employment, and that content review as a rule needs a concrete suspicion and must not be general or continuous. The decision never mentions AI. We explain why it nonetheless sets the limits for AI e-mail scanning, productivity analytics and sentiment scoring, set against Constitutional Court case law, Bărbulescu, the EU AI Act and Korean law.
On 29 September 2026 the European Commission opened a targeted consultation on copyright and AI that puts unusually concrete options on paper: EU standards and a registry for text-and-data-mining opt-outs, a duty on crawlers and AI agents to identify themselves, a rebuttable presumption of use where AI providers fail their AI Act transparency duties, confidential disclosure in place of the published domain list, and new compensation and remuneration rights. This analysis reads the questionnaire itself, sets it against Articles 3 and 4 of the DSM Directive, Article 53 of the AI Act and the German case law, and explains what it means for Turkish and Korean developers and rights holders. Responses close on 3 November 2026.
On 29 September 2026 the US Court of Appeals for the Third Circuit held in Thomson Reuters v. ROSS Intelligence that Westlaw's headnotes are original and that copying them to train a competing, non-generative AI legal-research tool was not fair use. It rejected ROSS's intermediate-copying defence because the judicial opinions themselves were freely available: "ease is not a justification for copying". It also recognised harm to a developing market for licensing headnotes as AI training data, while setting generative AI aside in a footnote. This analysis looks at the four factors as the court applied them, what the ruling means for Bartz, Kadrey and the OpenAI litigation, and how the same facts would be treated under EU law, Turkish FSEK and Korea's fair-use clause.
On 21 September 2026 the Independent International Scientific Panel on AI published its first thematic brief, and it did something no multilateral body had done before. It took the three conditions that safety researchers have argued for two decades would be required for humans to lose control of an AI system, and reported that all three had converged inside the production infrastructure of a frontier developer, rather than in a laboratory or in a red-team exercise designed to produce that result. The brief is an advance unedited version. It carries no binding force. It will nevertheless be among the most cited AI governance documents of the year, because it converts a contested prediction into a documented event, and law responds to events in a way it never responds to predictions.
On 18 September 2026, four paying subscribers filed a putative nationwide class action in the Northern District of California against Anthropic, OpenAI, Google and SpaceXAI. They do not allege that these companies built something dangerous; they allege that the companies agreed with one another to build it more slowly, that the industry's public commitment to decelerate capability development in the name of safety was a collusive restraint, and that subscribers paid for products made deliberately worse. Whatever one thinks of the merits, the case forces a question that AI governance has spent three years carefully not asking: when regulators and international bodies demand that competing developers coordinate on safety, are they demanding something competition law forbids?
As of 14 September 2026 a public database maintained by the researcher Damien Charlotin records 2,041 court decisions worldwide in which a party relied on AI-fabricated material and a court responded. Nearly 1,400 are American; 217 are Canadian, 111 Australian, 69 British, 57 Israeli. Türkiye is not yet counted, but it has its own case: an Ankara lawyer facing both a criminal investigation and a bar inquiry after Court of Cassation citations produced with a generative tool turned out to carry docket numbers that could not be found (he says the decisions themselves are genuine). Three years after the first sanctioned filing, the pattern is no longer a novelty to be laughed at but a professional-liability problem with its own case law, its own escalation ladder and, in Türkiye since 28 August 2026, its own soft-law rulebook.
A year ago, California became the first US state to enact a law aimed specifically at the most powerful AI models. Senate Bill 53, the Transparency in Frontier Artificial Intelligence Act, was signed on 29 September 2025 and has applied since 1 January 2026. It does not tell developers how to build their models. Instead, it requires the largest of them to publish how they manage catastrophic risks, report serious safety incidents to the state, and protect employees who raise the alarm. This analysis explains how the law works, how it compares with the EU's approach, what its first months have revealed, and what a country like Turkey can learn from a "transparency first" model of frontier AI governance.
Case database
80decisions · 20 jurisdictions
Decision of the day
Australia · 26 September 2025
In what the Commissioner called the first civil penalty case under the Online Safety Act, the court penalised deepfake posting and defiance of a removal notice.
Decision. On 26 September 2025 Longbottom J declared that the respondent had contravened section 75 on 12 occasions and had also contravened sections 80 and 83(3).
Read the summaryResources · EU AI Act
Blank templates you can fill in yourself. No sign-up.
Six ready-to-fill templates plus a compliance register, for the transparency obligations.
Download 02Shadow AI, prohibited input categories and a data-leakage incident protocol.
Download 03Scope, role and Article 6 / Annex III classification, with the Article 99 thresholds.
Download 04Limits of authority, human approval thresholds, disclosure and rollback.
Download 05Ownership, provider terms and infringement screening for images, text and code.
Download 06Indirect discrimination screening, human oversight and a candidate notice.
DownloadThe practice
Burhan Doğuş Ayparlar is an attorney at law (Türkiye). His practice areas include AI regulation, data protection and technology contracts, in particular under the EU AI Act, GDPR and KVKK.
The notes and analyses on this site are for general information only and do not constitute legal advice.
Practice areas
Guidance on risk classification, conformity pathways, and drafting technical and transparency documentation for regulatory submission.
Establishing lawful processing bases, conducting data protection impact assessments (DPIAs), and structuring cross-border data transfers for compliance.
Gap analysis and legal opinions on the conformity of AI systems with applicable regulation.
Drafting and implementation of internal AI governance policies, including model card frameworks, human-in-the-loop designs, and response protocols.
Drafting and negotiation of AI-specific contracts: data licensing, vendor agreements, IP ownership, and allocation of liability.
Legal review of early-stage AI projects in preparation for regulatory scrutiny.
Method
Mapping the systems, data flows and legal obligations relevant to the specific project.
OutputSystem and data-flow mapA risk-based, prioritised gap analysis against the EU AI Act, KVKK and the GDPR.
OutputPrioritised gap listPhased revision of compliance documentation, internal policies and AI-specific contract terms.
OutputUpdated policies and contractsA signed legal opinion summarising the review process and the resulting compliance status.
OutputSigned legal opinion