AI Compliance Hub
One page for everything that binds AI products touching Türkiye and the EU: the EU AI Act timeline as amended by the omnibus package, Türkiye’s draft AI legislation, and KVKK’s AI-relevant enforcement — with practical guides for every stage.
Last reviewed: July 2026 · Maintained by the Vircon Legal AI & Algorithm practice
The regulatory timeline
| Date | What applies | Who it hits | Status |
|---|---|---|---|
| 1 Aug 2024 | EU AI Act enters into force | — | IN FORCE |
| 2 Feb 2025 | Prohibited practices (Art. 5) + AI literacy duties | Everyone, incl. non-EU providers/deployers serving the EU | IN FORCE |
| 2 Aug 2025 | GPAI model obligations (Art. 53/55); Code of Practice published | Model providers + significant fine-tuners | IN FORCE |
| 2 Aug 2026 | Article 50 transparency: AI-interaction disclosure, synthetic-content marking, deepfake labels; member-state penalties; GPAI enforcement begins | Chatbots, generators, agents serving EU users — wherever established | NEXT · 30 DAYS |
| 2 Dec 2027 | Annex III high-risk regime (postponed from Aug 2026 by omnibus) + FRIA for named deployers | Recruitment, credit scoring, education, insurance, essential services | POSTPONED → DEC 2027 |
| 2 Aug 2028 | Annex I product-embedded high-risk obligations (postponed from Aug 2027) | Medical devices, machinery, vehicles with AI safety components | POSTPONED → AUG 2028 |
| Türkiye · pending | Draft AI Law (2/2234) in commission; Nov 2025 penal-code draft on AI-generated content; KVKK enforcing now | Turkish-market AI products | TRACKING |
Does the AI Act apply to you? The 60-second screen
| If… | Then… | Your date |
|---|---|---|
| Any feature matches the eight Art. 5 patterns (manipulation, social scoring, workplace emotion recognition…) | Redesign now — prohibited tier, highest fines | Already live |
| EU users chat with, or receive generated content from, your product | Art. 50: disclosure + machine-readable marking + deepfake labels | 2 Aug 2026 |
| You fine-tuned a foundation model and ship it to the EU | GPAI provider duties for the modification (training-content summary) | In force; enforced Aug 2026 |
| Your use falls in Annex III (hiring, credit, education, insurance…) | Full high-risk regime; FRIA if you are a named deployer | 2 Dec 2027 |
| Your AI is a safety component of a regulated product | Annex I route via product conformity | 2 Aug 2028 |
| You serve Turkish users | KVKK applies today: Art. 11 automated decisions, biometrics (2026/921), training-data bases | Now |
Run the full method: the classification memo, step by step.
The guides
The 2 August obligations that were NOT postponed
Art. 50 transparency — the deadline most companies wrongly relaxed about.
How the AI Act binds a Turkish startup
Extraterritorial scope: no EU entity required.
The eight already-banned practices
Product-level screen for the tier live since Feb 2025.
Türkiye’s Draft AI Law (2/2234)
What it copies from the EU — and what it leaves out.
KVKK is already regulating your AI
Automated decisions, biometrics, training data — today.
FRIA without the fog
Who needs one, and how to build it on your DPIA.
GPAI rules for builders
When fine-tuning makes you a provider; six vendor-contract clauses.
AI in hiring
Four layers already binding — not a 2027 problem.
AI credit scoring
KVKK + BDDK + Annex III/FRIA + discrimination: the four-floor stack.
Health AI: device or wellness?
The two-track map after the omnibus.
AI in games
Generated assets, LLM NPCs, minors, IP.
Deepfakes & synthetic content
Ankara’s criminal draft meets Brussels’ labelling.
Chatbots & consumer law
When your bot’s promise binds you.
Who owns AI output?
Training data and copyright, FSEK vs EU.
ChatGPT at work
The internal AI policy employees actually follow.
AI incident response
Art. 73, KVKK’s 72 hours and the new PLD.
When the AI acts for you
Agents, authority tiers, mistake allocation.
AI washing
“AI-powered” as a legal claim.
AI due diligence
The ten questions investors now ask.
Founder Academy: AI Act Readiness Checklist
The gated 30-item readiness checklist — free with the newsletter.
Map your product to the stack
Classification memo, contract layer, FRIA and readiness roadmap — fixed-scope engagements from the Legal 500-ranked team behind this hub.