Numerous software and artificial intelligence companies established in Türkiye supply cloud-based products to enterprise clients and end users across the European Union. Much like the General Data Protection Regulation (GDPR), Regulation (EU) 2024/1689 (the EU Artificial Intelligence Act) adopts an extraterritorial scope of application that directly encompasses developers established outside the Union under defined conditions.

Extraterritorial reach of Regulation (EU) 2024/1689 under Article 2

Pursuant to Article 2(1)(a) of Regulation (EU) 2024/1689, the Act applies to providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established within the EU or in a third country such as Türkiye. Crucially, Article 2(1)(c) further extends the Regulation to providers and deployers located in a third country where the output produced by the AI system is used in the Union. Where, for instance, a recruitment evaluation report or credit-risk assessment generated by an AI tool operated in Türkiye is utilised by a customer within the EU, extraterritorial obligations may be triggered.

Distinction between provider and deployer status across the AI value chain

Regulatory duties under the EU AI Act vary substantially depending on an entity’s position in the value chain. Beyond developers training models from scratch, ventures that place a high-risk AI system on the market under their own name or trademark, modify the intended purpose of an existing system into a high-risk category, or make substantial modifications to a high-risk system may assume full provider obligations (Art. 25). Organisations merely using a third-party AI system under their own authority in professional activities generally qualify as deployers. Product roadmaps involving fine-tuning, system integration and white-labelling should therefore be assessed per use case.

Risk tiers, phased application timelines and transparency duties

The Regulation establishes four risk tiers: prohibited AI practices posing unacceptable risk (Art. 5); high-risk AI systems listed in Annex III, including recruitment, education, access to essential private or public services and critical infrastructure (Art. 6); transparency-regulated systems (Art. 50); and minimal-risk applications. Under Article 50, providers must design interactive systems so natural persons are informed of AI interaction (Art. 50(1)) and ensure synthetic audio, image, video or text outputs carry machine-readable marking (Art. 50(2)), whereas deployers bear disclosure duties regarding deepfakes and AI-generated text published on matters of public interest (Art. 50(4)). Entry into application is likewise phased (Arts. 111 and 113): prohibitions and AI-literacy provisions applied from February 2025, general-purpose AI model obligations from August 2025, and Article 50 transparency rules from August 2026, while Regulation (EU) 2026/1744 deferred core high-risk compliance deadlines to December 2027 for standalone Annex III systems and August 2028 for Annex I regulated products. The deferral concerns Chapter III, Sections 1–3, except Article 6(5): 2 December 2027 for Annex III and 2 August 2028 for Article 6(1) and Annex I. It does not defer the whole Act. Article 111(4) separately allows providers of synthetic-content systems placed on the market before 2 August 2026 until 2 December 2026 to comply with Article 50(2); that transition does not cover every transparency duty.

Authorised representative appointment in the Union and enterprise procurement clauses

Providers established outside the Union offering high-risk AI systems or general-purpose AI models on the EU market must, prior to making them available, appoint by written mandate an authorised representative established within the Union (Arts. 22 and 54). However, providers of general-purpose AI models released under a free and open-source licence whose parameters, weights and architecture are made publicly available are exempt from appointing an authorised representative unless the model presents systemic risk (Art. 54(6)). In parallel, EU enterprise customers increasingly incorporate AI governance schedules into procurement agreements, requesting technical documentation, data-governance records, human-oversight controls and incident-reporting undertakings that must remain aligned with Turkish trade-secret, FSEK copyright and KVKK rules. Article 54(6) requires a free and open-source licence allowing access, use, modification and distribution, plus public parameters including weights, architecture and usage information. Open weights alone are insufficient. Article 22 concerns high-risk system providers, whereas Article 54 concerns general-purpose model providers; merely using an upstream API does not make a venture a model provider.

Longer working paper

Software Rights, Cross-Border Data Transfers and EU AI Act Obligations for AI and SaaS Ventures in Türkiye (working paper, 2026, DOI 10.5281/zenodo.23896353)

Official sources and references

Source links point to official texts and references. This article is provided for general informational purposes only and does not constitute legal advice for any specific matter.