Legal review for projects built with AI
Project-specific legal texts, KVKK (Turkish data protection law) compliance and a lawyer's pre-launch review for websites and mobile apps built with AI tools.
10 critical risks in AI-generated legal texts
Click a heading to see the rule, the pattern commonly seen in AI output and the possible consequence.
01A privacy notice that does not describe the projectLaw No. 6698 (KVKK) Art. 10 · Communiqué on the Duty to Inform
The rule
A privacy notice must concretely state the identity of the data controller, the purposes of processing, the recipients, the collection method and the legal basis.
In AI output
AI tools usually produce generic phrases like “to improve our services”. They do not know or list the payment, email, analytics and AI providers actually used. A company is often named as data controller, although the project is frequently run by an individual.
Possible consequence
Failure to fulfil the duty to inform is subject to administrative fines (KVKK Art. 18). If the text does not reflect reality, the defence becomes weak in a complaint or investigation.
02Combining the privacy notice and explicit consent in one textKVKK Arts. 3, 5 · Board decisions
The rule
Explicit consent must be specific, informed and freely given. If a service is only provided when consent is given, the consent may not be considered “free”.
In AI output
Templates suggest a single checkbox such as “By signing up I give explicit consent to the processing of all my data”, merge information with consent and make marketing permission a condition of membership.
Possible consequence
Processing based on invalid consent becomes unlawful. For marketing messages, Law No. 6563 and the Message Management System (İYS) rules also apply.
03Transferring data abroad without realising itKVKK Art. 9 (as amended by Law No. 7499, 1 June 2024)
The rule
Sending personal data to a server, database or AI API located abroad is a cross-border transfer. In the absence of an adequacy decision, an appropriate safeguard is required, usually the Board's standard contract, which must be notified to the Authority within 5 business days of signing.
In AI output
In a typical AI-built project, the database, hosting, email and language model providers are all abroad. Generated texts either do not mention this transfer at all or merely say “your data is stored on secure servers”.
Possible consequence
Failing to notify the standard contract is in itself a ground for an administrative fine. Health, identity or financial information users type into a chat box is also part of the same transfer.
04Open doors in AI-generated codeKVKK Art. 12 · Board decision No. 2019/10 (72-hour notification)
The rule
The data controller must take appropriate technical and organisational measures against unlawful access. If data is obtained by others, the Board must be notified as soon as possible and within 72 hours at the latest, and the data subjects within a reasonable time.
In AI output
Quickly built projects often contain API keys embedded in the browser, database tables with access rules disabled, public storage buckets and admin panels without logging. In most projects it is not written down who does what in case of a breach.
Possible consequence
The breach itself, late notification and insufficient measures each create a risk of sanctions, followed by compensation claims and reputational damage.
05The promise that “everything is deleted when you delete your account”Regulation on Erasure, Destruction or Anonymisation · Turkish Commercial Code Art. 82 · Law No. 5651
The rule
Data must be deleted once the purpose of processing ends, but some records must be kept for a legally defined period. Commercial books and documents are kept for 10 years, a hosting provider's traffic data for 1 to 2 years, and invoice and payment records have their own periods.
In AI output
Generated texts either provide for indefinite retention or say “your data will be deleted immediately and permanently”. In practice, backups are not cleaned and there is no retention and destruction schedule.
Possible consequence
If the promised deletion does not happen, the notice is misleading; if mandatory records are deleted, tax and commercial law obligations are breached. Either way a retention and destruction policy is needed.
06“By using this site you are deemed to accept cookies”KVKK Guidelines on Cookie Practices
The rule
Non-essential cookies (analytics, advertising, personalisation) require active consent. Pre-ticked boxes and treating browsing as consent do not meet this requirement; a “Reject” option must be as accessible as “Accept”.
In AI output
Ready-made cookie banners usually offer only an “OK” button, analytics tools load before consent, and the policy lists cookies that are not even used on the site.
Possible consequence
Tracking tools loaded without consent may constitute unlawful processing; the gap between the text and actual practice is one of the first things checked in an inspection.
07Terms of use that do not hold under Turkish lawTurkish Code of Obligations Arts. 20-25, 115 · Consumer Protection Law No. 6502 Arts. 5, 73
The rule
Standard terms must be brought to the other party's attention and be understandable. In consumer contracts, terms creating an imbalance to the consumer's detriment are unfair terms and are invalid.
In AI output
Templates compiled from foreign sources include clauses such as “the courts of Delaware, USA have jurisdiction”, “the company is not liable under any circumstances” or “we may change these terms at any time without notice”.
Possible consequence
These clauses are largely unenforceable against users in Türkiye; consumer disputes may be heard by consumer arbitration committees and consumer courts at the consumer's place of residence. The project owner discovers the protection they relied on does not exist only when a dispute arises.
08Sales, subscriptions and the right of withdrawalDistance Contracts Regulation · Law No. 6563 · ETBİS
The rule
Selling products, services or digital content online requires a correctly structured pre-contractual information form, distance sales agreement, right of withdrawal and its exceptions. E-commerce businesses may also be required to register with the Electronic Commerce Information System (ETBİS).
In AI output
Generated texts skip the consent step required to use the digital content exception to the right of withdrawal, the subscription renewal notice and the cancellation method.
Possible consequence
If pre-contractual information is missing, the withdrawal period may be extended, refund requests increase and there is a risk of sanctions in Ministry of Trade inspections.
09Who really owns the code and content?Law on Intellectual and Artistic Works No. 5846 Arts. 18, 52 · Industrial Property Law No. 6769
The rule
Economic rights must be assigned in writing and each right must be specified. Whether AI-generated content qualifies as a work, and on whose behalf it would be protected, is debated; open-source code used may also carry licence obligations.
In AI output
No written agreement is made with the freelance developer, a name is chosen without a trademark search, and the licences of libraries suggested by AI are not checked.
Possible consequence
During legal due diligence in an investment, sale or partnership negotiation, it may turn out that the source code or the trademark does not belong to you. This is often the most expensive surprise.
10AI making decisions about usersKVKK Arts. 6, 11/1-g · EU AI Act (for EU users)
The rule
Data subjects have the right to object to an adverse outcome resulting from analysis exclusively by automated systems. Special categories of data such as health or biometric data are subject to much stricter conditions. For projects serving users in the EU, the transparency obligations of the EU AI Act may also apply.
In AI output
Projects that screen applications, score credit or risk, give health recommendations or use facial recognition define no objection route, and users are not clearly told they are interacting with AI.
Possible consequence
Unlawful processing of special category data may lead to criminal liability under Turkish Criminal Code Art. 135 et seq. in addition to administrative sanctions.