Insights and updates
From emerging regulation to deal mechanics, we write about the questions founders and investors actually ask: practical analysis you can put to work.
Article 73 serious-incident reporting, KVKK’s 72-hour breach reflex and the software-covering Product Liability Directive overlap on the same bad day. A five-part pre-incident package, built before the pager goes off.
Build-time assets vs runtime generation, NPC chatbot disclosure, UGC deepfake exposure, minors under Article 5, and IP in an AI-heavy pipeline: the four legal fronts for studios shipping into the EU.
Symptom checkers, triage and image analysis pull AI into MDR/TİTCK territory; the omnibus moved the product track to 2028 and Annex III to December 2027. Intended purpose, KVKK health-data rules, and five things to build now.
Credit scoring appears on every regulatory list at once: KVKK Art. 11 today, BDDK model governance, Annex III high-risk + FRIA from December 2027, and equal-treatment exposure throughout. A four-floor stack and a build order.
The EU permits training under opt-out-respecting TDM rules; FSEK has no such exception. Machine output without human hususiyet is ownerless in both. What that means for your training pipeline, customer terms and IP assignment clauses.
Hallucinated refund windows are, functionally, your statements. TKHK, KVKK, ETBİS and the AI Act’s August 2026 disclosure duty meet in one chat window: five safety rails that turn the exposure into a compliance asset.
