Digital Technologies and AI

In technology start-ups, the company structure should be designed together with founders' rights, ownership of intellectual property, fundraising, employee incentives and possible future share transfers.

• Determination of company type, partnership and management structure
• Founders’ agreement and shareholders’ agreement
• Vesting, reverse vesting, leaver and share buy-back mechanisms
• Share transfer, pre-emption, tag-along, drag-along and exit provisions
• Legal structuring of employee share options and incentive plans
• Board of directors, signing authority and reserved matters
• Transfer to the company of code, designs and content created before incorporation
• Coordination with financial and technical advisers on technology development zone, R&D and incentive processes

In an investment process, the investor’s management, information, liquidation, anti-dilution and exit rights matter as much as the valuation. Non-binding commercial expectations and legally binding provisions should be clearly separated.

• Confidentiality agreement, term sheet and letter of intent
• Legal due diligence and data room management
• Share subscription, share transfer and shareholders’ agreements
• Adaptation of convertible instruments to Turkish law
• Representations, warranties, indemnities, closing conditions and liability limits
• Founder commitments, non-compete and the chain of title to intellectual property
• Pre-investment restructuring and capital transactions
• Mergers, acquisitions, strategic investments and exit transactions

The financial, tax and fiscal aspects of the investment are assessed together with the relevant authorised professionals.

In technology companies, value often depends less on registration documents than on code, data, customer contracts, open-source components, key employees and third-party services.

• Review of the company, shares, contracts and permits
• Chain of title to intellectual property
• Open-source and third-party licences
• Personal data, cyber incidents and security commitments
• Customer concentration, change of control and termination rights
• AI model, training data and content rights
• Fintech or crypto licence and regulatory obligations
• Pre-closing remedies and transition services

• Governing law, jurisdiction, arbitration and enforcement of decisions
• Multilingual licence, SaaS, distribution and technology transfer agreements
• Data transfers, export controls and sanctions risks
• Services and intellectual property arrangements between group companies abroad
• Offering products in Türkiye by foreign companies and local agreements
• Expansion abroad of companies based in Türkiye
• International technology and investment disputes

In cloud and SaaS relationships, the location of data, service availability, dependency, backup, sub-processors, price changes and exit conditions should be specifically regulated.

• SaaS, PaaS, IaaS, hosting and managed service agreements
• Service level, availability, maintenance window and service credits
• User, administrator and API usage limits
• Data ownership, data portability, backup and deletion
• Subcontractors and the sub-processor chain
• Cross-border data transfers and the location of data centres
• Scaling, pricing, renewal and unilateral change provisions
• Suspension, termination, exit support and reduction of supplier dependency

• Fixed-term, perpetual, exclusive or non-exclusive licences
• Licence models based on users, devices, cores, transactions or volume
• Authorship, transfer of economic rights and software created within an employment relationship
• Rights in source code, libraries, databases, interfaces, documentation and algorithms
• Adaptation, reproduction, distribution, reverse engineering and interoperability
• Technical protection measures, licence keys and audit rights
• Licence infringement, unauthorised use, interim measures and damages proceedings

• Inventory of open-source components and licence obligations
• Assessment of copyleft, attribution, source code disclosure and distribution terms
• Linking the software bill of materials and supply-chain documentation to the contract
• Usage rights for third-party code, SDKs, models, datasets and APIs
• Open-source policy and approval processes
• Legal review of open source in mergers, investments and product sales

The technical code scanning, component discovery and security analysis are carried out by technical experts; the legal and contractual effects of the results are assessed by lawyers.

• Tender and offer documents, request for information and request for proposal processes
• Master services agreement, work orders and technical annexes
• Legal review of suppliers and security questionnaires
• Service levels, audit, subcontractor and change management
• Business continuity, disaster recovery and exit plan
• Price, measurement, acceptance, warranty and liability provisions
• Reducing single-supplier dependency on technology

• Employee and independent developer agreements
• Ownership of works, inventions, designs, code and documentation
• Confidentiality, trade secrets and access rights
• Non-compete and employee transfer provisions
• Personal devices, remote work and acceptable use policies
• Termination of employment, revocation of access and return or deletion of data
• Key personnel and knowledge transfer plan

• Corporate generative AI use policy
• Confidentiality of input information, professional secrecy and personal data risk
• Verification of outputs, human oversight and liability for incorrect content
• Data use rights in training, fine-tuning and retrieval systems
• Copyright, database right, licences and the origin of content
• Model provider terms, output ownership and indemnity obligations
• Contractual response to hallucination, discrimination, manipulation and security testing
• Synthetic media, AI-generated content and deepfake transparency

Shadow AI refers to tools that employees use outside the knowledge or control of the organisation. Approved tools, access, data input, human control and incident reporting rules are set out in the use policy.

• Automated decisions in recruitment, credit, insurance, health, education and public services
• Profiling, scoring and behavioural prediction
• Facial recognition, voiceprints, fingerprints and other biometric systems
• Legal or similarly significant effects of decisions, explanation and appeal options
• Discrimination and equal treatment risks
• Data protection impact assessment, human intervention and record-keeping

• Mapping of fund flows, customer assets, transaction parties and the revenue model
• Distinction between a technology service, a payment service, electronic money, agency and outsourcing
• Assessment of white-label, API, banking-as-a-service and platform models
• Separating the roles of bank, payment institution, electronic money institution and technology provider
• Identification of licensable activities, scope extensions, notifications and permit needs
• Legal assessment of the business model of providers not established in Türkiye, and the cross-border service and marketing risks

• Licensing and operating authorisation processes under Law No. 6493 and secondary regulations
• Preparation of shareholding, management, capital and corporate structure documents
• Legal assessment of the business plan, product flow, and agent and outsourcing model
• Framework agreements, user terms, fee and information texts
• Protection of customer funds and contractual structuring of the flow of funds
• TCMB supervision, information requests, corrective actions and administrative sanctions
• Changes in the scope of activity, share transfers, mergers and acquisitions
• Business continuity, exit plan, record retention and outsourcing agreements

Incorporation and the operating licence are distinct stages. The scope of the activity, the current equity requirements and the remote identification changes of 4 September 2026 are reviewed together with the customer onboarding flow of the product.

• Assessment of whether a digital wallet is a payment account, electronic money or a technical service
• Card storage, tokenization, merchant acquiring and payment gateway models
• Mobile payments, subscription collection, QR and instant payment solutions
• Regulation of chargebacks, unauthorised transactions, errors, refunds and fraud processes
• User authentication, transaction security and customer notifications
• Agreements among the merchant, the bank, the payment institution and the technology provider

• Legal scope of account information and payment order initiation services
• ÖHVPS, API access, customer consent and authorisation flows
• API use, data sharing, service level and liability agreements
• Strong customer authentication, consent records and retention of transaction trails
• Data responsibility between the bank, the fintech and the third-party service provider
• Analysis of the regulatory environment for open finance and new product models

ÖHVPS 2.0.0, announced on 17 March 2026, covers card information and future-dated and recurring payment order initiation functions. Opening new functions for use does not mean that the scope of authority expands automatically.

The legal assessment of Bitcoin, Ether and other crypto-assets varies according to the design of the asset, its purpose of use, the manner of issue and distribution, the rights promised and the service provider through which transactions are made. The terms “crypto money,” “coin” or “token” alone do not determine legal status.

• User agreements for trading, custody, transfer and wallet services
• Claims of unauthorised access to customer accounts, account takeover and fake transactions
• Responsibility for private keys, seed phrases, and cold and hot wallets
• Transfers to a wrong address, choice of chain, network forks and airdrop disputes
• Platform outages, non-execution of orders, and liquidity and price disputes
• Claims of fraud, phishing, fake investments and market abuse
• Preservation of evidence, requests for records, injunctions and other interim protections
• Coordination of the criminal, commercial, consumer, enforcement, inheritance and matrimonial property dimensions

The use of crypto-assets for “payment” purposes in Türkiye is a separate regulatory field. Under the TCMB Regulation on the Non-Use of Crypto-Assets in Payments, there are restrictions on the direct or indirect use of crypto-assets in payments and on offering services for that purpose. Trading or investment transactions should not be confused with the payment function.

• Token models conferring securities, capital market instruments, usage or membership rights
• Tokenization of real estate, energy, works of art, commodities or revenue streams
• Initial sale or distribution, public offering, crowdfunding and investment contract risks
• Establishing the relationship between token ownership and the in rem or personal right over the underlying asset
• Custody, transfer, secondary market, buy-back and liquidation provisions
• Multi-regulatory analysis of stablecoins, asset-backed tokens and models with a payment function
• Legal review of white papers, technical documents, risk disclosures and marketing texts

• Regulating the relationship between smart contract code and the parties’ legal agreement
• Liability of the oracle, bridge, protocol, interface, wallet and governance layers
• Legal classification of DeFi, staking, lending, liquidity pool and yield models
• Legal personality, representation and liability issues in DAOs and community governance
• Protocol upgrades, errors, exploits, rug pulls and governance attacks
• Intellectual property, consumer and marketing provisions for NFTs and digital collectibles

• Customer identification, identification of the beneficial owner and risk classification
• Remote identification and identity verification processes
• Information transfer and record-keeping under the travel rule
• Suspicious transaction reporting, compliance programme and compliance officer structure
• High-risk customers, wallets, countries and transaction scenarios
• Data and contractual risks regarding the use of blockchain analysis tools
• Reflecting the current rules on transfer periods and limits in operations
• Assessment of business relationships against national and international sanctions lists

The status of obliged party is determined together with MASAK’s current guidance and the identification arrangements of the relevant institution. Announcements on UN Security Council (BMGK) listing decisions and the notification and transaction-postponement measures under Communiqué No. 34 are reflected in the compliance workflow.

• Review of claims about returns, security, reserves, licensing and protection
• Influencer, referral, campaign, reward and promotion models
• Risk disclosures and customer information standards
• Liability arising from misleading, incomplete or comparative statements
• Compliance review of social media, app store and website content

In cloud, analytics, customer relations, support and AI services, data may pass through many countries. The transfer map should cover not only the main service provider but also sub-processors and remote access options.

• Assessment of adequacy decisions, appropriate safeguards and occasional transfer conditions
• KVKK standard contracts and notification to the Authority
• Binding corporate rules and undertaking processes
• Transfer impact and country risk assessment
• Coordination of contracts with the EU General Data Protection Regulation and the rules of other countries
• Data localisation and sector-specific retention obligations

The new transfer system under Article 9 of the KVKK entered into force on 1 June 2024. Where a standard contract is used, the signing and notification procedure should be checked against current Board decisions and announcements.

The obligation to notify the Authority within five business days of signing the standard contract is monitored separately. A foreign provider’s general data processing agreement does not automatically replace the KVKK standard contract.

Law No. 7545 on Cybersecurity entered into force on 19 March 2025. The law and sector regulations may raise questions of duties, cooperation, supervision and sanctions for critical infrastructure, for organisations working with public institutions, and for natural and legal persons active in cyberspace.

• Cybersecurity obligations and institutional map
• Incident response plan, crisis team and decision protocol
• Management of data breaches, ransomware, business email compromise and system outages
• Preservation of logs, device data, communications and other digital evidence
• Notifications to customers, business partners, insurers and competent institutions
• Supplier security, security annexes and audit rights
• Cyber insurance policies and claims processes
• Coordination of administrative investigations, criminal investigations, damages and recourse proceedings

A law firm does not provide penetration testing, forensic imaging or technical incident clean-up services; it coordinates the legal strategy with the competent cybersecurity and digital forensics experts.

The changes to cybersecurity and internet regulations made by Law No. 7590 dated 31 July 2026, and the transitional provisions, are taken into account. No notification is directed to a single institution before the concrete allocation of duties and powers is examined.

• Pre-contractual information and distance contracts
• Terms for digital content, online services and subscriptions
• Automatic renewal, free trials, cancellation and refund flows
• Obligations of electronic commerce intermediary service providers and service providers
• ETBİS, İYS and compliance of commercial electronic messages
• Campaigns, discounts, comparative prices and digital advertising
• Right of withdrawal, exceptions, defective digital services and consumer applications
• Dark patterns and the risks of manipulative user experience

• Roles and obligations under Law No. 5651
• Unlawful content, violations of personality rights and privacy
• Applications for content removal, access blocking and preservation of evidence
• User content and community rules
• Disputes over domain names, fake accounts and impersonation
• Online defamation, insult, commercial reputation and unfair competition
• Platform requests and correspondence with foreign service providers

For requests for content removal, access blocking and personality rights, the applicable provision, the competent authority and the protection sought are determined separately; it is not assumed that a former application procedure applies to all violations.

• Joint legal analysis of the IoT device, mobile application and cloud service
• Product safety, defects, updates and useful life
• Device data, telemetry, location and biometric data
• Remote access, security patches and end of support
• Responsibility of the supplier, manufacturer, importer and software provider
• Recalls, disclosure of security vulnerabilities and customer notification

• Digital health, remote healthcare, medical device software and health data
• Insurtech, digital policies, quotes and automated risk assessment
• Regtech, identity verification, compliance monitoring and fraud detection
• Education technologies and children’s data
• Proptech, tourism technologies and travel platforms
• Energy technologies, smart meters and mobility services
• Sector-specific permit, data, outsourcing and registration obligations

• Ad network, agency, publisher and advertiser agreements
• Cookies, device identifiers and behavioural advertising
• Consent management platforms and preference records
• Influencer, sponsored content and affiliate marketing agreements
• Advertising claims, comparative advertising and consumer transparency
• Advertising aimed at children and the risks of sensitive profiling

• Platform rules, self-preferencing and discriminatory access claims
• Competition law analysis of data, algorithms and network effects
• Price parity, exclusivity and tying practices
• Algorithmic pricing and the sharing of competitively sensitive information
• App stores, search ranking and access restrictions
• Competition notification in mergers, acquisitions and technology collaborations
• Reviews and investigations by the Turkish Competition Authority (Rekabet Kurumu)

• Domain name allocation, domain disputes and bad-faith registrations
• Trademark protection for application, platform, product and service names
• Counterfeit apps, fake websites and impersonation
• Rights in digital content, interfaces, games, visuals, music and databases
• Infringement notices, preservation of evidence, interim measures and damages
• Licences, assignment, joint use of trademarks and joint development

For products that use maps or location, the data source, the purpose of use and the special permit regime are assessed together; not every item of location data is treated as subject to the same regime.

• Scope of permits or licences for collecting, producing, sharing and selling geographic data
• Navigation, location analytics and map use agreements
• Distinction between data contact, commercial use, sharing abroad and personal data

For products that provide communication infrastructure or communication services, the scope of Law No. 5809, the need for authorisation and the exemptions are assessed according to the product’s actual function.

• Separation of the roles of technology supplier and electronic communications operator
• Assessment of notifications, rights of use and applications to the regulatory authority
• Reflection in the contract of infrastructure, access, service continuity, security and record-keeping provisions

• Late, incomplete or defective delivery of software
• Disputes on system integration and acceptance testing
• Service outages, data loss and security breaches
• Licence excess, unauthorised use and infringement of intellectual property
• Claims for termination of projects, fees, contractual penalties and damages
• Account closure on platforms, blocking of payments and content measures
• Disputes concerning fintech, payments, crypto-assets and digital wallets
• Interim measures, preservation of evidence, mediation, litigation and arbitration

In digital disputes, the preservation of logs, time stamps, access records, versions and communications should be planned without delay. The method of collecting evidence must be lawful.

• Inventory of digital legislation and responsibility matrix
• Policy set for technology, AI, data, cybersecurity and fintech
• Contract templates and approval thresholds
• Legal checklist for products and release gates for market entry
• Procedures for incident notification, complaints, audits and regulatory communication
• Training for executives, developers, sales, human resources and customer service
• Periodic compliance review and corrective action plan