AI governance
glossary.

AI governance is the set of policies, processes and controls an organization puts in place to develop and use AI systems ethically, transparently, accountably and in line with the law. Compliance with regulations such as KVKK, the EU AI Act and ISO 42001 is assessed within the scope of AI governance.

KVKK (the Personal Data Protection Law) is Turkey's core data protection legislation, in force since 2016 and governing how personal data is processed. It is largely aligned with the EU GDPR. It places obligations on data controllers and processors around disclosure, explicit consent, restrictions on cross-border transfers and data security.

The EU AI Act entered into force in 2024 and is the world's first comprehensive AI regulation. It sorts AI systems into 4 categories by risk level: unacceptable risk (prohibited), high risk (strict oversight), limited risk (transparency obligations) and minimal risk. Turkish companies serving the EU market may also fall under the regulation.

Under the EU AI Act, AI systems that can have a significant impact on people's health, safety or fundamental rights. Annex III lists areas such as credit scoring, hiring and workforce management, education, critical infrastructure and biometric identification. These systems must have risk management, data governance, technical documentation, record-keeping and human oversight.

ISO/IEC 42001 is the international management system standard for the responsible development and use of AI systems. Published in 2023, the standard contains 38 controls and covers requirements for risk management, transparency, human oversight and continual improvement.

Shadow AI refers to AI tools and systems that employees use in an organization without the knowledge or approval of the IT department. Entering company data into applications such as ChatGPT or Copilot is a typical example of shadow AI risk. It creates serious compliance risk under KVKK and the EU AI Act.

PII (Personally Identifiable Information) masking is the detection and hiding or anonymization of identifying data in a text, such as national ID numbers, phone numbers, email addresses and IBANs, before it is sent to an AI model or a third party. It is one of the core techniques for meeting the data minimization and data security principles in KVKK.

An AI audit log is the tamper-proof storage of every request sent to an AI system and every response received, together with time, user, model and risk information. It is used to prove to auditors and regulators how an AI decision was made; the EU AI Act makes record-keeping mandatory for high-risk systems.

BDDK is the public authority that regulates and supervises banks and financial institutions in Turkey. Banks' information systems, outsourcing and model risk management are audited under BDDK regulations; AI uses such as credit scoring require explainability and record-keeping in these audits.

The review of contracts with AI service providers (OpenAI, Microsoft, Google, etc.) against KVKK and GDPR in terms of data processing purpose, retention period, cross-border data transfers, sub-processors and data security provisions.