Ask an HR-tech founder about the AI Act and you will hear a date: recruitment AI is Annex III high-risk, obligations start December 2027, plenty of time. Ask the same founder which rules govern their CV-screening model in Türkiye today, and the answer is usually silence. That silence is the risk. For AI in hiring, the binding law is not coming; it is layered, and most of it is already here.
Layer 1. KVKK, today
Every scoring, ranking or filtering of candidates is personal data processing. That triggers the full KVKK stack now: lawful basis, aydınlatma (in Turkish, naming automated analysis explicitly), data minimisation against the reflex of feeding the model everything, and retention limits for rejected candidates’ files. Above all, Article 11: a candidate has the right to object to a result produced exclusively by automated analysis that works against them. If your funnel auto-rejects below a score threshold with no human in the loop, you are running exactly the system Article 11 targets; build the human-review path before a complaint builds it for you.
Layer 2; the biometrics red line
Video-interview analysis, voice profiling, facial expression scoring: after the Authority’s 2026/921 principle decision, the Turkish position on workplace biometrics is clear; special-category data, strict necessity, and consent does not rescue a disproportionate system. A hiring tool that infers traits from a candidate’s face or voice sits on the wrong side of every element of that test. The EU AI Act goes further on the same line: emotion recognition in the workplace falls under the Act’s prohibited practices; the tier that has applied since February 2025, postponed for no one.
Layer 3; discrimination law, the sleeping giant
İş Kanunu Article 5 and the Turkish Human Rights and Equality Institution Law prohibit discrimination in access to work. A model trained on your historical hiring data learns your historical biases, and unlike a biased manager, it documents the pattern at scale, in logs your counterparty can request. In an equal-treatment dispute, “the vendor’s algorithm did it” is not a defence; it is an admission that you deployed a decision system you could not explain.
Layer 4; the EU timeline, for EU-facing hiring
Recruiting for EU entities or screening EU-resident candidates adds the AI Act layers: transparency duties from 2 August 2026 (candidates must know they interact with AI where not obvious), and the full Annex III high-risk regime from 2 December 2027; risk management, data governance, human oversight, logging, and your vendor’s conformity assessment. If you build hiring tech, those December 2027 duties define your product roadmap; if you buy it, they define your procurement questions.
What applies when; one table
| Rule | Applies to | Since / from |
|---|---|---|
| KVKK principles + Art. 11 objection | Any AI touching Turkish candidates | Now |
| 2026/921 biometrics standard | Face/voice/behavioural analysis at work | Now |
| İş K. m.5 equal treatment | All hiring decisions, human or automated | Now |
| AI Act prohibition: workplace emotion recognition | EU-facing systems | Feb 2025 |
| AI Act Art. 50 transparency | EU-facing candidate interaction | Aug 2026 |
| AI Act Annex III high-risk regime | EU-facing recruitment AI | Dec 2027 |
An eight-step program for HR teams and HR-tech builders
- Inventory every automated step between application and offer, including third-party ATS features you never turned on deliberately.
- Insert human review before any adverse automated outcome.
- Rewrite candidate aydınlatma texts to name automated analysis and profiling.
- Kill or quarantine emotion-inference features; run the 2026/921 test on anything biometric.
- Bias-test models on Turkish-market data before deployment, and re-test on retraining; keep the reports.
- Set retention schedules for unsuccessful candidates’ data.
- Push AI Act readiness into vendor contracts now; documentation, logging access, conformity commitments for December 2027.
- Assign ownership: one accountable person for AI-in-hiring compliance, not a diffuse committee.
We advise both sides of this market (HR-tech products and the companies deploying them) at the intersection of Employment, KVKK + GDPR and AI & Algorithm Law.
Sources. Regulation (EU) 2024/1689 (AI Act) and Law No. 6698 on the Protection of Personal Data (KVKK). Statute links open the official consolidated Turkish texts on mevzuat.gov.tr.
This article is for general information only and does not constitute legal advice. It reflects the position as of July 2026.
Author
More from Vircon Insights
Where Explicit Consent Is Not Required, and the Limits of the Law: Five Decisions
August 19, 2026Breach Notification: Five Decisions on the 72-Hour Deadline, Procedure and Transparency
August 17, 2026Can You Answer a KVKK Data Subject Request by Phone? The Authority's 1 October 2026 Announcement
October 1, 2026The Medium-Term Programme Puts a Date on KVKK-GDPR Alignment: What Changes for Compliance Programmes Caught Between Two Laws
September 8, 2026Türkiye's DPA Draws the Line on Biometrics: Attendance Is Out, Security Access Is Conditional
August 27, 2026Two Credit Bureau Decisions and the Full Index of the 47 Decision Summaries
August 23, 2026Related Practice Areas
Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →Startup Law
Incorporation, founder agreements, ESOP, term sheets, regulatory matters.
View service →Mergers & Acquisitions
End-to-end M&A: due diligence, structuring, documentation, negotiation.
View service →