Your support chatbot just told a customer the subscription is refundable within 60 days. Your terms say 14. Who is bound? For companies selling to consumers in Türkiye and the EU, the answer is uncomfortable: probably you. AI customer-facing agents create consumer-law exposure that most teams have not priced, because the chatbot sits in marketing’s budget and the liability lives in legal’s.
The binding-statement problem
Under Turkish consumer law (TKHK) and its e-commerce framework, pre-contractual information and representations made in the seller’s channels bind the seller. A chatbot on your domain, speaking in your brand voice, is your channel. Courts and consumer arbitration boards will not parse whether the promise came from a human agent or a language model; the question is whether a reasonable consumer relied on it. Hallucinated discounts, invented return windows and confident misstatements of product capabilities are, functionally, your statements.
Layered duties, one interface
- TKHK + e-commerce law (now): accurate pre-contractual information, no misleading commercial practice, order-confirmation duties; all indifferent to whether AI generated the text.
- KVKK (now): the conversation is personal data processing; aydınlatma at the chat entry point, retention limits on transcripts, and care with what the bot solicits (“share your ID number to continue” is a design decision with legal weight).
- AI Act Article 50 (from 2 August 2026, EU-facing): the consumer must know they are talking to a machine, where not obvious. The “obvious” carve-out is narrower than product teams assume; a bot named “Elif” with a human avatar is engineered ambiguity.
- ETBİS layer: if you operate e-commerce in Türkiye, your registered service descriptions should not diverge from what your bot promises (see our ETBİS guide).
Design the safety rails, not just the prompt
- Authority limits: decide what the bot may commit to (nothing financial beyond published terms is a sane default) and enforce it in the orchestration layer, not merely in the system prompt.
- Grounding over generation for anything with legal content (refunds, warranties, pricing) retrieve from the canonical policy, do not let the model improvise.
- Human hand-off triggers for complaints, vulnerable users, and any conversation drifting into dispute territory.
- Transcript retention matched to your dispute window: the transcript is your best evidence and your KVKK liability at once; set a schedule instead of keeping everything forever.
- Correction protocol: when the bot misstates, an addressable process (honour, correct, notify) turns a pattern into an incident instead of a class of claims.
The quiet upside
A well-railed bot is also a compliance asset: it delivers mandatory information consistently, timestamps disclosures, and never gets tired on aydınlatma. The gap between an exposure and an asset is entirely in the engineering around the model.
For the contract layer between you and your bot vendor, the six clauses in our GPAI piece apply squarely here.
Sources. Law No. 6502 on Consumer Protection and Law No. 6698 on the Protection of Personal Data (KVKK). Statute links open the official consolidated Turkish texts on mevzuat.gov.tr.
This article is for general information only and does not constitute legal advice. It reflects the position as of July 2026.
Author
More from Vircon Insights
Three Ways to Move Up the IPO Queue: Türkiye's New Priority Criteria
September 1, 2026Your Users Are Younger Than Your Terms Say: Children, Age Assurance and AI Products
August 31, 2026Will Insurance Pay When the Model Is Wrong? E&O, Cyber and Product Liability for AI Companies
August 28, 2026Synthetic Data Is Not a Legal Loophole: When "Fake" Data Is Still Personal Data
August 20, 2026When the Algorithm Fixes the Price: Repricing Tools, Tacit Collusion and the Turkish Competition Authority’s 2026 Agenda
August 19, 2026A 12-Month Cap on Off-Exchange Share Sales: Rebuilding the Post-IPO Exit Plan
September 1, 2026Related Practice Areas
Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →US Company Formations & Flip-Ups
Delaware C-Corp, flip-up structures, SAFE/convertible notes, 83(b).
View service →