Intellectual property, cross-border data transfers and contractual structure in AI and SaaS ventures under Turkish law

Legal classification of software code, databases and AI outputs, and assignment formalities

Under Turkish copyright law, computer programs and preparatory design material leading to a program at the next stage are protected as literary and scientific works insofar as they bear the individuality of their author (Law No. 5846 on Intellectual and Artistic Works [FSEK], Art. 1/B(a), (g); Art. 2, item 1). Conversely, ideas and principles underlying any element of a computer program, including those underlying its interfaces, are excluded from copyright protection (FSEK Art. 2, last paragraph); abstract algorithmic methods, model workflows and prompt methods are not protected as such. A specific prompt text must separately be assessed for original linguistic expression; copyright does not require that text to become source code. Outputs generated by an AI system without human creative contribution also follow a regime distinct from the user interfaces and application-layer or integration code written by the venture.

Datasets may attract two cumulative forms of protection, each with its own conditions: databases exhibiting originality in the selection and arrangement of content are protected as compilation works without extending copyright to the underlying raw data (FSEK Art. 6, item 11), and databases reflecting substantial qualitative or quantitative investment in obtaining, verifying or presenting content confer a fifteen-year sui generis right on the database maker from disclosure to the public; a substantial new investment may qualify for a new term (FSEK Additional Art. 8).

Economic rights over software created by employees in the performance of their duties are exercised by the employer unless otherwise understood from a special contract or the nature of the work; likewise, where software is created by members constituting the organs of a legal entity within the scope of their duties, the right to exercise economic rights vests in the legal entity (FSEK Art. 18(2)). However, code written by founders prior to incorporation or by shareholders carrying neither employee nor corporate-organ status does not vest automatically in the company. Moreover, agreements concluded with independent contractors before software is created operate as promissory undertakings as regards future assignments (FSEK Art. 50(1)); the undertaking must also observe written form and individual specification of rights. Subsequently, a separate written dispositive assignment specifying each transferred economic right individually is required once the work is completed (FSEK Arts. 48, 52).

Cross-border cloud and AI API data flows under the amended Article 9 KVKK regime

Transmitting user inputs, documents or customer records to cloud servers or large language model APIs hosted outside Türkiye constitutes a cross-border data transfer to the extent personal data is involved. Following the 2024 amendments to Law No. 6698 on the Protection of Personal Data (KVKK), continuous and systematic transfers to jurisdictions lacking an adequacy decision cannot rely on routine explicit consent. The occasional (non-repetitive) derogations in KVKK Article 9(6) apply only where neither an adequacy decision nor any appropriate safeguard under Article 9(4) is available, and require prior briefing on probable risks for explicit consent (Art. 9(6)(a)) or strict necessity for contract performance (Art. 9(6)(b)). For ongoing cloud and API transfers to countries lacking an adequacy decision (KVKK Art. 9(1)), three cumulative conditions are instead required under Article 9(4): a processing ground under Article 5 or 6, the ability of data subjects to exercise their rights and access effective legal remedies in the destination country, and an appropriate safeguard such as executing the Standard Contract published by the Personal Data Protection Board without modification (KVKK Art. 9(4)(c)). The executed Standard Contract must be notified to the Authority by the data controller or data processor within five business days of signature (KVKK Art. 9(5); the responsible controller or processor may face administrative fines under Arts. 18(1)(d) and 18(2)), and onward transfers to sub-processors by cloud or API vendors must satisfy the same statutory safeguards (KVKK Art. 9(8)).

Alignment between upstream model provider terms and enterprise customer commitments

Before granting strict confidentiality, data-residency or exclusivity warranties to enterprise clients, a venture must verify whether its upstream infrastructure or model provider retains API inputs, uses customer data for model training, offers zero-data-retention configurations, or restricts commercial use of outputs. Where open-source software components are incorporated, compatibility between permissive licences (such as MIT and Apache 2.0) and copyleft licences (such as GNU GPL and GNU AGPLv3, the latter triggering source-code disclosure for modified versions offered through remote network interaction) should be documented prior to investment due diligence.

Service-level commitments, general transaction terms and statutory limits on liability caps

Availability targets, scheduled maintenance interruptions, support response times, and contractual provisions addressing accuracy rates and the probability of erroneous AI outputs should reflect actual system architecture. In SaaS models offered under standard subscription contracts, unilateral disclaimers and liability caps are subject to judicial review under the general transaction terms regime of the Turkish Code of Obligations (Law No. 6098 [TCO], Arts. 20–25) and unfair commercial terms rules under the Turkish Commercial Code (Law No. 6102 [TCC], Art. 55(1)(f)). Both blanket exclusions of liability and aggregate liability caps—which operate as partial non-liability agreements—are void with respect to the debtor’s own intent or gross negligence (TCO Art. 115(1)). Liability for acts of auxiliary persons may be excluded in whole or in part by prior agreement outside services, professions or crafts requiring expertise and statutory or official permission (TCO Art. 116(2)–(3)); indirect-damage and liability-cap clauses should therefore separate the debtor’s own fault from acts of auxiliary persons.