Productivity scoring, automated shift assignment, keystroke and screen monitoring, route optimisation that silently disciplines couriers; algorithmic management has moved from gig platforms into ordinary workplaces. The legal boundaries are tighter than most HR-tech buyers assume, and they run through three regimes at once.
The EU AI Act layer
Annex III classifies AI used in employment and worker management as high-risk: recruitment and selection, decisions on promotion and termination, task allocation based on behaviour or personality, and monitoring or evaluating performance. High-risk status brings the full compliance stack; risk management, human oversight, logging, and deployer duties including worker information; on the postponed runway to December 2027. Two things are not postponed: emotion recognition in the workplace has been a prohibited practice since 2 February 2025, and if your monitoring tool interacts with workers or generates content, Article 50 transparency applies from August 2026.
The KVKK layer
Türkiye has no AI-specific employment rule yet, but KVKK already does most of the work:
- Lawful basis: employee “consent” is rarely valid given the power imbalance; monitoring must rest on legitimate interest with a documented balancing test, proportionate to a real risk;
- Transparency: aydınlatma (privacy notice) before monitoring starts; covert monitoring is defensible only in narrow, documented fraud investigations;
- Yargıtay and Constitutional Court case law on workplace e-mail and computer monitoring requires prior notice, purpose limitation and proportionality; evidence collected in breach has been ruled unusable and has cost employers unfair-dismissal cases;
- Automated decisions: KVKK Article 11 gives employees the right to object to results produced exclusively by automated analysis; a termination triggered by a score, with no human judgement, is exposed.
The labour-law layer
Under the İş Kanunu, dismissal for poor performance requires objective criteria, a documented evaluation process and the employee’s defence. An opaque algorithmic score does not satisfy any of these on its own. İşe iade litigation over algorithm-driven terminations is where Turkish courts will first meet algorithmic management; and the employer carries the burden of proving a valid reason.
A compliance design that works in both regimes
- Inventory every tool that scores, ranks or monitors people; map each to Annex III language;
- Kill emotion-analytics features now; the EU ban is in force and KVKK treats the underlying biometrics as special-category data;
- Put a human decision (with real authority; see human oversight) between any score and any adverse action, and document it;
- Issue a monitoring-specific aydınlatma and, for EU workforces, prepare the Article 26 worker-information notice;
- Write the vendor contract so the provider carries documentation and conformity duties; on which, see our upcoming AI vendor contract playbook.
For the hiring-specific rules (CV screening, video interviews, assessment games) see AI in hiring, and run your stack through the AI Act Readiness Checklist.
This article is for general information only and does not constitute legal advice. For advice on your specific situation, contact us.
Author
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro callMore from Vircon Insights
How SAFEs Work under Turkish Law: Discounts, Caps and the Limits of the TCC
September 2, 2026Rule 701: Granting Options to Your Team in Türkiye from a Delaware Company
September 7, 2026Down Rounds and Pay-to-Play: The Founder's Legal Position When Valuation Falls
September 7, 2026Bridge Financing in Türkiye: Convertible Notes and KISS in Practice
September 5, 2026Two Separate Decisions in a Generational Handover: Passing Management, Passing Ownership
August 30, 2026Web Scraping for AI in Turkish Law: What Is Legal, What Gets Litigated
August 17, 2026Related Practice Areas
Employment Law
Employment contracts, ESOP, termination, non-compete, work permits.
View service →Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →Mergers & Acquisitions
End-to-end M&A: due diligence, structuring, documentation, negotiation.
View service →