AI Compliance Hub
One page for everything that binds AI products touching Türkiye and the EU: the EU AI Act timeline as amended by the omnibus package, Türkiye’s draft AI legislation, and KVKK’s AI-relevant enforcement — with practical guides for every stage.
Last reviewed: July 2026 · Maintained by the Vircon Legal AI & Algorithm practice
The regulatory timeline
| Date | What applies | Who it hits | Status |
|---|---|---|---|
| 1 Aug 2024 | EU AI Act enters into force | — | IN FORCE |
| 2 Feb 2025 | Prohibited practices (Art. 5) + AI literacy duties | Everyone, incl. non-EU providers/deployers serving the EU | IN FORCE |
| 2 Aug 2025 | GPAI model obligations (Art. 53/55); Code of Practice published | Model providers + significant fine-tuners | IN FORCE |
| 2 Aug 2026 | Article 50 transparency: AI-interaction disclosure, synthetic-content marking, deepfake labels; member-state penalties; GPAI enforcement begins | Chatbots, generators, agents serving EU users — wherever established | NEXT · 30 DAYS |
| 2 Dec 2027 | Annex III high-risk regime (postponed from Aug 2026 by omnibus) + FRIA for named deployers | Recruitment, credit scoring, education, insurance, essential services | POSTPONED → DEC 2027 |
| 2 Aug 2028 | Annex I product-embedded high-risk obligations (postponed from Aug 2027) | Medical devices, machinery, vehicles with AI safety components | POSTPONED → AUG 2028 |
| Türkiye · pending | Draft AI Law (2/2234) in commission; July 2025 penal-code bill on AI content (deepfake labels, 6-hour takedown) + Nov 2025 AI-systems bill; KVKK enforcing now | Turkish-market AI products | TRACKING |
Does the AI Act apply to you? The 60-second screen
| If… | Then… | Your date |
|---|---|---|
| Any feature matches the eight Art. 5 patterns (manipulation, social scoring, workplace emotion recognition…) | Redesign now — prohibited tier, highest fines | Already live |
| EU users chat with, or receive generated content from, your product | Art. 50: disclosure + machine-readable marking + deepfake labels | 2 Aug 2026 |
| You fine-tuned a foundation model and ship it to the EU | GPAI provider duties for the modification (training-content summary) | In force; enforced Aug 2026 |
| Your use falls in Annex III (hiring, credit, education, insurance…) | Full high-risk regime; FRIA if you are a named deployer | 2 Dec 2027 |
| Your AI is a safety component of a regulated product | Annex I route via product conformity | 2 Aug 2028 |
| You serve Turkish users | KVKK applies today: Art. 11 automated decisions, biometrics (2026/921), training-data bases | Now |
Run the full method: the classification memo, step by step.
The guides
The 2 August obligations that were NOT postponed
Art. 50 transparency — the deadline most companies wrongly relaxed about.
How the AI Act binds a Turkish startup
Extraterritorial scope: no EU entity required.
The eight already-banned practices
Product-level screen for the tier live since Feb 2025.
Türkiye’s Draft AI Law (2/2234)
What it copies from the EU — and what it leaves out.
KVKK is already regulating your AI
Automated decisions, biometrics, training data — today.
FRIA without the fog
Who needs one, and how to build it on your DPIA.
GPAI rules for builders
When fine-tuning makes you a provider; six vendor-contract clauses.
AI in hiring
Four layers already binding — not a 2027 problem.
AI credit scoring
KVKK + BDDK + Annex III/FRIA + discrimination: the four-floor stack.
Publishes 23 July 2026
Deepfakes & synthetic content
Ankara’s criminal draft meets Brussels’ labelling.
Algorithmic pricing
Repricing tools, tacit collusion, the Authority’s 2026 agenda.
Publishes 19 August 2026
The AI questionnaire
Answering enterprise vendor assessments without overpromising.
Publishes 27 August 2026
Founder Academy: AI Act Readiness Checklist
The gated 30-item readiness checklist — free with the newsletter.
Key terms, defined
high-risk AI system · FRIA · conformity assessment · deployer · AI literacy · human oversight · social scoring · serious incident · prohibited practices · AI Office · profiling · fine-tuning · pseudonymization
Quick answers
Do the postponed high-risk rules mean we can wait?
No — the prohibited-practices list, the AI-literacy duty and the GPAI rules already apply, and the Article 50 transparency obligations arrive on 2 August 2026. The postponement to December 2027 covers only the Annex III high-risk regime.
Does the EU AI Act apply to a company based in Türkiye?
Yes, potentially: it covers providers placing AI systems on the EU market wherever they are established, and situations where a system’s output is used in the EU.
Is there a Turkish AI law in force?
Not yet. The Draft AI Law (2/2234) is in commission and further bills are pending — but KVKK already applies to AI products today, including automated decisions and biometric data.
Where should a startup begin?
Classify your system first: prohibited, high-risk, transparency-only or minimal risk. The classification memo drives everything else — contracts, FRIA, documentation and timing.
Map your product to the stack
Classification memo, contract layer, FRIA and readiness roadmap — fixed-scope engagements from the Legal 500-ranked team behind this hub.