When AI Creates the Work: Who Owns AI-Generated Content Under Turkish Law?
A company employee asks an AI tool to prepare a product description.
A designer uses AI to create several visual concepts.
A developer asks an AI assistant to generate part of a software application.
A marketing team produces an advertising video with AI-generated images, music and voice.
The work is finished in a few minutes. But then someone asks a much harder question:
Who actually owns it?
That question is becoming increasingly important for companies operating in Turkey. Generative AI can save time and open new creative possibilities, but it can also create uncertainty around copyright, personal data, confidentiality, software, contracts and the use of third-party material.
For businesses, the important point is that using AI is not simply a technology decision. In many situations, it is also a legal and contractual decision.
Turkish companies should therefore look beyond the AI tool itself and consider how the resulting material was created, what information was supplied to the system, who reviewed the output, and how the final work will be used.
AI can produce the content, but that does not automatically answer the ownership question
It is tempting to think about AI-generated material in simple terms:
“We paid for the AI service, so the content belongs to us.”
That conclusion may be too quick.
Copyright questions depend on the applicable legislation, the nature of the work, the human contribution involved, contractual arrangements and the circumstances in which the material was produced.
Turkey's principal copyright framework is the Law No. 5846 on Intellectual and Artistic Works. The legislation and related materials can be followed through the Turkish Ministry of Culture and Tourism's Copyright Directorate and the Turkish Patent and Trademark Office.
The broader legislation can also be checked through the official Turkish Legislation Information System and the Official Gazette.
This matters because AI does not sit outside the existing legal system. A company using AI still has to consider the legal rules that apply to the underlying work.
The real question may be: how much did the human contribute?
Consider two different situations.
In the first, a user types:
“Write a short article about Istanbul.”
The system generates the entire article and the user publishes it without meaningful changes.
In the second, a professional develops the concept, researches the subject, provides detailed instructions, selects particular elements, rejects multiple outputs, substantially rewrites the text and combines the final result with independently created material.
The legal analysis may not be identical.
The more meaningful human creative contribution involved, the more important it becomes to examine what the person actually contributed to the final work.
This is why companies should not simply record that “AI created the content.” They should preserve information about the human role in creating and finalising it.
A prompt is not necessarily the same thing as authorship
One of the most common misunderstandings about generative AI is that writing a sophisticated prompt automatically makes the user the copyright owner of everything produced.
The legal position can be more complicated.
A prompt can range from a very simple instruction to an extremely detailed creative direction. Even where a user invests considerable time in prompting, that does not necessarily settle the question of copyright in the resulting material.
For businesses, a more useful approach is to ask:
What did the employee actually create?
What instructions were given to the system?
Which elements were selected by the human?
Was the output edited?
Was the output combined with original human-created material?
Who made the final creative decisions?
Can the company demonstrate that process later?
Those questions can become important when ownership is challenged.
Keep a record of how important AI-assisted work was created
This sounds unnecessarily formal when a team is simply trying to get work done.
But imagine the situation six months later.
A company has sold a campaign to a major customer. Another party alleges that one of the images or pieces of text infringes its rights. The company now needs to explain where the material came from.
If nobody remembers which AI system was used, what instructions were given, what material was uploaded or which employee substantially edited the result, the legal and commercial discussion becomes much harder.
For significant projects, companies can maintain a simple AI creation record containing:
the AI tool or service used;
the date of creation;
the employee or contractor who used it;
significant prompts or instructions;
source material supplied to the system;
important iterations;
human edits;
final approval;
applicable licence terms;
and the intended commercial use.
It does not need to become a bureaucratic exercise. A basic record can sometimes make a substantial difference when ownership or provenance is later questioned.
AI output can still create copyright infringement risks
Another common assumption is:
“If the AI generated it, nobody else can claim rights over it.”
That is not a safe assumption.
AI systems can produce material that resembles existing works. They may also be used with reference material supplied by the user.
For example, a company could ask an AI system to create an image that closely resembles the visual identity of an existing artist, brand or campaign.
The fact that the image came from an AI tool does not automatically eliminate the legal issues associated with using the resulting material.
Businesses should therefore ask where the source material came from and whether the proposed use could interfere with somebody else's copyright, trademark, design or other rights.
The Turkish Patent and Trademark Office provides official information concerning industrial property rights, while copyright matters can be followed through the Copyright Directorate of the Ministry of Culture and Tourism.
AI and company confidential information: the risk may start before the output
Sometimes the most serious problem is not the AI-generated material.
It is the information an employee puts into the AI system.
Imagine an employee copies a confidential contract into a public AI service and asks:
“Please identify the weaknesses in this agreement.”
The resulting answer might be useful.
But the company has already disclosed information to an external technology provider.
The same concern may arise with:
customer databases;
employee information;
unpublished financial figures;
trade secrets;
source code;
product designs;
litigation documents;
acquisition plans;
internal correspondence;
confidential contracts.
An AI policy should therefore address what employees are allowed to enter into AI systems, not merely whether employees are allowed to use AI.
Personal data creates another layer of responsibility
AI systems frequently process information relating to identifiable individuals. That can bring Turkish personal-data legislation into the picture.
The Personal Data Protection Authority (KVKK) has now published specific guidance concerning generative AI and personal data.
Its “Generative Artificial Intelligence and Personal Data Protection Guide” addresses the processing of personal data through generative AI systems and discusses privacy considerations throughout the AI lifecycle.
This is a useful reminder that an organisation should not treat an AI platform as an ordinary software subscription.
Before using an AI system with personal information, a business may need to consider:
what personal data is being processed;
why it is being processed;
the legal basis for processing;
who receives the information;
where the information is stored;
whether information is transferred outside Turkey;
retention periods;
security measures;
employee access;
and the contractual position of the AI provider.
The KVKK official website also provides access to current decisions, announcements and data-breach information.
AI agents make the question even more interesting
Generative AI is no longer limited to producing a paragraph or an image after receiving a prompt.
More advanced systems can perform multiple steps, interact with other tools and operate with a greater degree of autonomy.
The Turkish Personal Data Protection Authority has separately addressed Agentic AI, noting that these systems can involve increased autonomy and data-processing activity.
For businesses, this creates an important practical distinction.
There is a difference between:
“AI suggested an answer.”
and:
“AI accessed company information, made a decision, contacted a customer, created a document and stored the result in another system.”
The second scenario can involve a much broader range of legal and contractual questions.
What happens when an employee creates something with AI?
Companies should also think about ownership internally.
Suppose an employee uses AI to produce a marketing campaign during working hours.
Who owns the final work?
The answer should not be left entirely to assumptions about the AI platform.
The company should review:
the employee's employment agreement;
intellectual-property provisions;
confidentiality obligations;
company policies;
the terms of the AI service;
the human contribution to the final work;
and the rights associated with any third-party material.
Employment and intellectual-property arrangements should ideally anticipate AI-assisted work rather than attempting to deal with it after a dispute arises.
AI-generated software code deserves special attention
The same problem exists in software development.
A developer may use an AI coding assistant to produce:
functions;
scripts;
documentation;
tests;
configuration files;
or substantial sections of an application.
That may accelerate development, but it does not eliminate the need for code review.
A business should consider whether AI-generated code:
resembles existing third-party code;
incorporates material subject to particular licence obligations;
contains security vulnerabilities;
introduces undocumented dependencies;
creates uncertainty over ownership;
or conflicts with the company's contractual commitments to its customer.
This is especially important where software is being developed for resale, licensing, investment or acquisition.
Companies involved in software and technology transactions may therefore want AI-assisted development to form part of their intellectual-property and technical due diligence.
AI training and AI output are two different questions
There is another distinction that is often lost in public discussions about AI.
How an AI system was trained is not necessarily the same legal question as who owns a particular output.
Training may involve enormous quantities of data and raise questions concerning copyright, data protection, licensing and lawful processing.
The output question concerns what the system produces in response to a particular interaction and how that output can lawfully be used.
A business evaluating an AI product should therefore avoid reducing the entire issue to “Who owns AI?”
There may be several separate legal questions hiding behind that sentence.
Turkey's AI legal framework is continuing to develop
This is an area where businesses should be particularly careful with online articles published a few years ago.
The legal and regulatory discussion around AI in Turkey is developing.
For example, a bill submitted to the Turkish Grand National Assembly in April 2026 proposes amendments to Law No. 5846 on Intellectual and Artistic Works in response to copyright issues associated with the AI era. According to the official parliamentary record, the proposal remains under consideration by parliamentary committees rather than being enacted law.
That distinction matters.
A legislative proposal should not be described to clients as though it were already an enforceable rule.
Businesses should instead monitor the Turkish Grand National Assembly's legislation database, together with the Official Gazette and the Turkish Legislation Information System, for changes that actually enter into force.
The same principle applies to developing rules concerning cybersecurity, digital services, data protection and online content.
Cybersecurity cannot be separated from AI governance
AI systems also form part of a company's broader technology environment.
Turkey's cybersecurity framework has developed further with Law No. 7545 on Cybersecurity, adopted in 2025. Companies operating technology systems should therefore consider AI use alongside their wider information-security obligations and internal controls.
The Cybersecurity Presidency provides official information concerning Turkey's cybersecurity framework and institutional developments.
For a business, an AI policy that says only “employees may use AI responsibly” is unlikely to be enough.
A useful policy should address practical questions such as:
Which AI systems may employees use?
What information may be uploaded?
Who can approve AI tools?
How are confidential materials protected?
How are AI-generated outputs reviewed?
Who checks copyright and third-party rights?
What happens when personal data is involved?
How should AI-generated code be reviewed?
What records should employees retain?
Who is responsible for investigating an AI-related incident?
Contracts with AI providers deserve careful reading
A company's relationship with an AI provider is usually governed by contractual terms.
Those terms may address:
ownership of inputs;
ownership or permitted use of outputs;
provider use of customer data;
model training;
confidentiality;
security;
service availability;
data retention;
international transfers;
intellectual-property claims;
indemnities;
liability limitations;
termination;
and deletion of customer information.
The commercial importance of these provisions can vary considerably depending on whether the company is using AI for internal experimentation or building its core product around an AI service.
For major technology arrangements, an IT lawyer in Istanbul can review the technology contract together with the company's intellectual-property, privacy and commercial requirements.
What about AI-generated advertising?
Marketing is one of the areas where AI-generated content is already particularly visible.
A company may use AI to create:
advertising copy;
photographs;
illustrations;
music;
product videos;
voiceovers;
virtual presenters;
social-media content.
The legal review should not stop at copyright.
Depending on the campaign, companies may also need to consider:
trademark rights;
personality and image rights;
consumer-protection rules;
advertising requirements;
personal data;
confidential information;
contractual restrictions;
and sector-specific rules.
The Ministry of Trade's Consumer Protection Directorate provides official information concerning consumer protection, while the Ministry of Trade provides access to legislation and regulatory information relevant to commercial activity.
E-commerce businesses have additional considerations
Online businesses using AI for customer interaction, product descriptions, recommendation systems or marketing should also consider Turkey's e-commerce framework.
The Ministry of Trade publishes relevant legislation through its official e-commerce legislation page.
An AI-powered online business may therefore have to look at several legal areas at the same time rather than treating its AI system as a standalone technology.
For example, a single AI-driven customer journey might involve:
personal data → AI processing → automated recommendation → online sale → electronic communication → consumer rights.
That is precisely why technology law increasingly overlaps with commercial law, data protection and consumer law.
AI due diligence is becoming relevant in business transactions
There is also a transactional side to the issue.
Imagine that a technology company is being acquired.
During due diligence, the buyer may want to know:
Which AI tools does the target company use?
Does it have licenses for its data and software?
Has confidential information been entered into external AI systems?
Does the company maintain records of AI-assisted development?
Are important software components AI-generated?
Are customer-facing AI systems processing personal data?
Are there restrictions under vendor contracts?
Has the company received any complaints relating to AI-generated material?
Are employees permitted to use consumer AI platforms?
Is there a written AI governance policy?
AI therefore increasingly belongs on the due-diligence checklist of technology-driven businesses.
A practical AI checklist for Turkish companies
Before putting an AI-generated work into serious commercial use, it is worth asking a few straightforward questions.
1. Where did the material come from?
Identify the AI system, the input material and any third-party sources.
2. What did the human contribute?
Keep a record of meaningful editing, selection, direction and creative decisions.
3. Does the output resemble somebody else's work?
Check copyright, trademark, design and other relevant rights.
4. Was confidential information used?
If yes, examine whether disclosure to the AI provider was permitted.
5. Was personal data involved?
Consider the requirements of the Personal Data Protection Law and KVKK framework.
6. Where is the data going?
Review hosting, processing locations and international data transfers.
7. What does the AI provider's contract say?
Do not rely solely on a general statement that the company “owns its outputs.”
8. Is the material important to the business?
The more commercially important the work, the more useful it may be to preserve documentation about its creation.
9. Is software involved?
Review licensing, third-party code, security and intellectual-property issues.
10. Is the law changing?
Check the TBMM legislation database, Official Gazette and Turkish Legislation Information System rather than relying on an old article or social-media post.
A sensible AI policy does not have to stop innovation
Some businesses react to legal uncertainty by banning AI altogether.
Others allow everyone to use every AI tool without meaningful controls.
Neither approach necessarily addresses the real problem.
A practical company policy can allow useful AI adoption while setting clear boundaries.
For example, employees might be free to use approved AI tools for brainstorming and drafting, while confidential customer information, trade secrets, source code and sensitive personal data require additional approval or may be prohibited entirely.
The policy can also distinguish between low-risk and high-risk uses.
Using AI to brainstorm an internal meeting agenda is not the same as using AI to analyze customer health information or make an automated decision affecting an individual.
The company's controls should reflect that difference.
Where an IT lawyer can add value
AI-related legal work is rarely confined to one area of law.
A company may need advice on several connected issues at once:
technology contracts;
copyright;
software and intellectual property;
personal data;
cybersecurity;
employment arrangements;
commercial agreements;
consumer protection;
e-commerce;
international data transfers;
litigation and dispute resolution.
That is why AI projects often benefit from legal review at the beginning rather than after a problem appears.
For businesses operating in Istanbul or elsewhere in Turkey, Kurucuk & Associates' information technology law practice can be considered where an AI project involves technology contracts, data protection, software, cybersecurity, intellectual property or related commercial matters.
The question is not simply “Who owns the AI output?”
AI is changing the way businesses create things.
But the legal questions remain recognisably human.
Who supplied the information?
Who created the concept?
Who made the important creative decisions?
Who reviewed the result?
Whose data was used?
Whose intellectual property appears in the material?
What does the contract permit?
And what will happen if somebody challenges the company's right to use the final work?
For Turkish businesses, answering those questions early can be much easier than trying to reconstruct the entire history of an AI-generated work after a dispute begins.
The technology may be new. The need for careful documentation, sensible contracts, privacy protection and respect for intellectual-property rights is not.
Official Turkish resources
For businesses wanting to follow developments rather than rely on secondary commentary, the following official resources are useful:
This article is intended for general information and does not constitute legal advice. AI regulation and its practical application may develop over time, so businesses should assess their particular technology, contracts, data-processing activities and intended use before relying on a legal position.
