Using AI After 2 August 2026: An AI Act and KVKK Compliance Guide for Companies

Updated: 3 September 2026 · Category: AI and Digital Advertising Compliance

Using AI After 2 August 2026: An AI Act and KVKK Compliance Guide for Companies

Since 2 August 2026, the transparency obligations in Article 50 of the EU AI Act have applied. Companies active in the EU market should address AI interaction, synthetic content marking, deepfake disclosure and personal data processing under the AI Act together with KVKK/GDPR.

Contents

Short answer
Why does it matter?
What should companies do?
How to measure it?
Sources
Frequently asked questions

Short Answer

Why Does It Matter?

The application of the transparency obligations in Article 50 of the AI Act since 2 August 2026 requires companies to move beyond asking “Do we use AI?” to keeping a more detailed inventory. The same organization may simply be an AI service customer in one scenario and a provider adding an AI feature to its own product in another. The obligations vary with the system’s role, output and context of use.

In Türkiye, the second layer concerns personal data. Transferring customer records, employee data, call centre transcripts or other personal data to an AI tool requires a KVKK assessment independently of the AI Act. The processing purpose, legal basis, data minimisation, retention, third-party provider and international transfer arrangements must also be examined. Therefore, saying “we use a tool that complies with the AI Act” does not, by itself, mean compliance with KVKK.

What Should Companies Do? A 7-Step Compliance Model for the AI Act and KVKK

Create an inventory of AI use cases. Keep separate usage records for chatbots, content creation, customer analytics, employee tools, image generation and automation.
Identify your role. For each use case, assess whether you are a provider, deployer or simply a user of a third-party service, considering both the legal and technical architecture.
Identify the Article 50 trigger. Distinguish direct human interaction, synthetic content generation, deepfakes and other relevant transparency scenarios.
Integrate the disclosure decision into the design. Decide at product level where the notice appears, what it says and where it fits in the user journey.
Map personal data flows. Document which data goes to which model or provider, where it is stored and for what purpose it is processed.
Define human oversight. Specify when AI outputs are verified and which outputs require human approval before action can be taken.
Retain the evidence pack. Link the use case, model, disclosure decision, data assessment, responsible team and change history in the same record.

Proposed Measurement Model for B10

Control	KPI	Target
AI inventory	Mapped AI use-case coverage	100% registration
Role analysis	Role classification coverage	Each use-case
Transparency	Disclosure decision coverage	100% of relevant uses
Synthetic content	Machine-readable marking capability	Verified in applicable systems
KVKK	Personal-data assessment coverage	All use-cases containing data
Evidence	Evidence pack completeness	Complete registration

The dashboard should show more than counts of compliant and non-compliant cases. It should reveal which uses still have an uncertain role, which systems send personal data and in which version a disclosure decision changed.

Expert Assessment

The riskiest AI governance model separates the technology inventory from the data inventory. If the IT team’s list of AI tools and the KVKK team’s list of personal data processed are not linked to the same use cases, gaps in data transfers, disclosure and human oversight remain invisible.

Therefore, Article 50 controls should be set up not only as a law checklist but as a governance layer that connects to product, data, security, marketing and purchasing processes.

Why Is an Inventory Organized by Use Case Necessary?

AI usage records should include both the product name and the purpose of use. The same model may only summarize text for one team but analyze customer conversations for another. The first use may contain no personal data, while the second may require a separate KVKK assessment. The basic inventory unit should therefore be an AI use case linked to a specific business process, rather than simply “we use ChatGPT” or “we use Copilot”.

A use-case record should identify the business process owner, model or service, data categories processed, direct user interaction, synthetic content generation, human approval point and nature of the published output. Review the record whenever the model provider changes or the same tool is connected to a new business process.

Procurement and Shadow AI Risks

Another gap in corporate AI governance is the use of AI services outside central procurement or IT processes. Services used through individual accounts by marketing, sales or customer service teams may be absent from the official technology inventory. Regular discovery through browser extensions, SaaS spending and departmental declarations can reveal shadow AI. The aim is to keep data and transparency risks under control, rather than prevent employees from using AI.

Digital Risk and Compliance Analysis

B10 Digital Agency can map a company’s AI uses in a single AI Governance Matrix covering user transparency, personal data flows, model provider, human oversight and adequacy of evidence.