The EU AI Act is the world's first comprehensive law on artificial intelligence. Many Turkish companies assume it only concerns businesses in the EU. In fact, like the GDPR, its reach extends beyond the EU's borders.
Amendments that took effect in July 2026 (the Digital Omnibus) also updated the timeline. This article summarises what Turkish companies need to know.
Does the AI Act apply to Turkish companies?
Under Article 2, companies outside the EU are in scope when:
- They place AI systems on the EU market (as providers), for example a Turkish software company selling AI-powered software to EU customers.
- The output of their AI system is used in the EU: even if the system runs entirely in Türkiye, the Act can apply if the decisions, predictions or content it produces are used in the EU.
- They have a branch or subsidiary in the EU that uses AI systems.
So for Turkish companies that export to the EU, have EU customers or have group companies operating in the EU, the AI Act is a direct concern.
Two key roles: provider and deployer
- Provider: the party that develops an AI system or places it on the market under its own name. Most obligations sit with the provider.
- Deployer: the party that uses an AI system in its own activities, for example a company using recruitment software it has bought.
Identifying your role for each AI system is the first step to understanding your obligations.
A risk-based approach
| Risk category | Examples | What's required |
|---|---|---|
| Prohibited practices | Manipulative techniques, social scoring, emotion recognition at work (with exceptions) | Banned |
| High risk | Creditworthiness assessment and credit scoring, recruitment and employee evaluation, assessment in education, life and health insurance pricing | Risk management, data quality, documentation, human oversight, record-keeping |
| Transparency obligations | Chat assistants, AI-generated content, deepfakes | Telling users they're interacting with AI, labelling content |
| Minimal risk | Spam filters, most productivity tools | No extra obligations (apart from AI literacy) |
An important note for financial services: creditworthiness assessment and credit scoring of natural persons are high-risk, while systems used to detect financial fraud are excluded from that category.
The updated timeline
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited practices and AI literacy (Article 4) |
| 2 August 2025 | Rules for general-purpose AI (GPAI) models; penalty provisions |
| 2 August 2026 | General application of the Act; transparency obligations |
| 2 December 2026 | Certain content-marking obligations (for systems already on the market) |
| 2 December 2027 | High-risk systems listed in Annex III (credit, recruitment, education, etc.) |
| 2 August 2028 | High-risk systems tied to product legislation (Annex I) |
The July 2026 amendment postponed the main high-risk obligations. That isn't a cancellation; it's extra time to prepare. The wording of the AI literacy obligation was also softened from "ensure" to "support the development of", but the obligation remains.
Penalties
- Prohibited practices: up to €35 million or 7% of worldwide annual turnover
- Other obligations: up to €15 million or 3% of worldwide turnover
- Supplying incorrect information to authorities: up to €7.5 million or 1% of worldwide turnover
The higher amount applies; for SMEs, the lower amount applies.
What should Turkish companies do now?
- Scope analysis: map your exposure to the EU market and whether your AI systems' outputs are used in the EU.
- AI inventory: list every AI system you use or build and your role for each (provider or deployer).
- Risk classification: flag systems that could fall into the prohibited or high-risk categories.
- Gap analysis: compare your risk management, documentation, data governance and human oversight processes for high-risk systems with the Act's requirements.
- Literacy and transparency: address employee training and customer-facing disclosures now; these obligations already apply.
Because Türkiye's AI Action Plan (2026–2030) takes a similar risk-based approach, steps taken for EU compliance will also make it easier to prepare for future Turkish regulation.
Through our AI Governance & Compliance service we carry out the inventory, risk classification and gap analysis with you. For models in high-risk areas such as credit scoring, see our Model Risk & Model Validation service.
Sources