SCH-Legal advises companies that develop artificial intelligence or use it in their business processes. Assessing the data used to train AI systems under the KVKK and intellectual property law, determining rights over generated content and code, and allocating liability through contracts are at the centre of this work.
Risk classification and obligations under the EU Artificial Intelligence Act (AI Act), internal AI use policies, supplier and licence agreements and user-facing texts for AI-powered products are prepared, and legal risk assessments are carried out during product development.
What we do
- AI use policies and employee guidelines are prepared
- Rights over training data, outputs and code are assessed under the KVKK and intellectual property law
- Risk classification and a compliance roadmap are prepared under the EU AI Act
- AI procurement, licence and service agreements are drafted
- Terms of use and liability texts are prepared for AI-powered products
Frequently asked questions
Common questions on AI law
Training data, copyright, the EU AI Act and contracts.
Can the data we use to train our model cause legal problems?
There are two separate questions. If the data includes personal data, the KVKK rules on legal basis, notice and purpose limitation apply. If the content is protected by copyright, whether text, images or code, you need the author’s permission or an exception under the law.
The most useful step in practice is to record from the start what data came from where and on what terms. Working this out afterwards is close to impossible.
Who owns the copyright in content or code generated by AI?
Under Turkish law only a natural person can be an author, so whether output generated entirely by AI is protected as a work is open to debate. Where human creative input is decisive, protection is possible.
Because of this uncertainty, we advise companies producing AI-assisted work to secure their rights through contracts and internal rules. Waiting for the law to fill the gap is risky.
Does the EU AI Act apply to companies in Turkey?
Yes, in two cases: if you place an AI system on the EU market, or if the output of your system is used in the EU. These companies first need to determine their systems’ risk category. The rules on prohibited practices and general-purpose models already apply, and the obligations for high-risk systems are being phased in.
Do we need a company policy on employees using tools like ChatGPT?
Yes. An employee pasting a client contract or a staff list into a public AI tool can breach both data protection rules and trade secret obligations. A short, clear policy setting out which tools may be used, with what data and for which tasks, removes most of that risk.
What should we look for in the contract when buying an AI service?
The first thing to check is whether the provider can use your data to train its own models. After that come rights in the output, who bears the loss caused by wrong output, service levels, data security and data processor obligations.
Providers’ standard terms usually favour the provider on these points, and they are open to negotiation in enterprise agreements.
Team
Our team in this area
View all →
Contact
How can we help?
Tell us briefly about your matter and the relevant team will get back to you.
info@sch-legal.com · +90 212 709 08 50