Somewhere in your company today, an employee pasted something into a chatbot. Perhaps a customer list for “cleanup”, a contract for “summarising”, a code file for “debugging”. Each paste is simultaneously a KVKK event, a potential trade-secret disclosure, and (if the text belongs to a client) a confidentiality breach. The fix is not prohibition; it is a working internal AI use policy. Here is the anatomy of one that actually gets followed.
Why “just ban it” fails
Bans push usage to personal phones and private accounts, where you lose every control and keep every liability. Surveys consistently show a majority of knowledge workers using AI tools regardless of policy. The realistic goal is channelled use: approved tools, clear red lines, and defaults that make the compliant path the easy path.
The five decisions that make the policy
- Tool tiering. Approve specific tools at specific tiers: enterprise accounts with training-opt-out and retention controls for work data; consumer tools for nothing beyond public information. Name names; a policy that says “use judgement” is not a policy.
- Data red lines. Four categories, plainly listed: special-category personal data (never), client-confidential material (only in the client-approved tier, if any), trade secrets and unreleased financials (enterprise tier with logging), public/general content (any approved tool). Map these to KVKK categories so your DPO can defend them.
- Output responsibility. The human who ships it owns it. AI-assisted work product goes through the same review as human work; with extra attention where output touches law, finance, safety or code that reaches production. This single sentence prevents the “the AI wrote it” defence from ever forming inside your culture.
- Disclosure rules. Internally: when AI assistance is material, say so in the deliverable. Externally: align with your client contracts; some now prohibit AI processing of their data without consent, and your policy must surface that clause to the people it binds.
- Incident path. Wrong paste happens. Define it as a reportable event with a no-blame first hour: the sooner someone says “I pasted the wrong thing”, the more options you have; deletion requests to the vendor, KVKK breach assessment within the 72-hour reflex, client notification decisions made by counsel rather than by silence.
The KVKK spine
Employee use of AI tools is data processing on your behalf: the vendor is a processor, so your DPA inventory, transfer analysis (most tools process abroad. Turkish data-transfer rules apply) and VERBIS entries need to reflect reality. An unapproved consumer tool used with customer data is an unregistered cross-border transfer you never see until it becomes a complaint.
Make it real in one sprint
- Publish the one-pager (the five decisions above fit on a page); train in 30 minutes with your own examples, not vendor slides.
- Buy the enterprise tier of the two tools people already use; the policy’s credibility is bought here.
- Add the AI clause to onboarding, client engagement letters and vendor DPAs in the same quarter.
We draft these policies bilingually, matched to KVKK filings and client-contract obligations; usually in a week. Related: our KVKK-and-AI overview.
This article is for general information only and does not constitute legal advice. It reflects the position as of July 2026.
Author
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call