Artificial Intelligence Use in Franchise Networks and Turkish Law

Introduction

Artificial intelligence is becoming an important operational tool for franchise networks.

A franchisor may use artificial intelligence systems to forecast customer demand, identify potential outlet locations, optimise inventory, monitor brand standards, personalise advertising, answer customer questions or recommend prices.

Franchisees may use generative artificial intelligence tools to create social-media content, prepare product descriptions, analyse financial information, recruit employees, manage schedules or respond to customer complaints.

Artificial intelligence can therefore reduce costs and improve consistency across a franchise system.

It can also create legal risks that are difficult to allocate between the franchisor, franchisee, technology supplier and individual user.

An artificial intelligence system may:

• Produce inaccurate customer information;
• Recommend discriminatory employment decisions;
• Use personal data without a valid legal basis;
• disclose confidential franchise know-how;
• Generate advertising that infringes copyright;
• Create false product claims;
• Facilitate unlawful resale price coordination;
• Expose the network to a cyberattack;
• Produce different decisions for similarly situated franchisees;
• Train itself on customer or employee data uploaded by the network.

These risks are particularly serious in a franchise relationship because the network usually combines central control with legally independent businesses.

The franchisor may select the artificial intelligence system and require every outlet to use it. The franchisee may collect and upload the customer or employee data. A foreign technology company may host the model and process the information outside Türkiye.

When harm occurs, each participant may argue that another party controlled the relevant decision.

As of July 2026, Türkiye has not enacted a comprehensive horizontal artificial intelligence law comparable to a single general AI code. A legislative proposal titled the Artificial Intelligence Law remains under parliamentary commission review, while the Turkish Grand National Assembly’s Artificial Intelligence Research Commission delivered a comprehensive report in March 2026. The current position is therefore that artificial intelligence applications must principally be assessed under existing sectoral and general legislation, including personal data, contract, competition, consumer, intellectual property, employment and cybersecurity rules. This is an inference from the official legislative status and parliamentary work available as of July 2026.

A franchise agreement should not wait for future AI-specific legislation before addressing these issues.

The parties should establish an artificial intelligence governance framework that identifies:

• Approved tools;
• Permitted purposes;
• Prohibited uses;
• Data responsibilities;
• Human review requirements;
• Security measures;
• Intellectual property ownership;
• Liability;
• Audit rights;
• Incident response;
• Termination and data return.

This article explains the legal issues arising from artificial intelligence use in Turkish franchise networks.

How Franchise Networks Use Artificial Intelligence

Artificial intelligence may be used at almost every stage of the franchise relationship.

Franchise Recruitment

Franchisors may use artificial intelligence to assess franchise applications, analyse financial capacity, score business experience or identify candidates considered likely to succeed.

Site Selection

Algorithms may analyse population, traffic, competitor density, consumer spending, delivery demand, rental levels and existing outlet performance to recommend new locations.

Demand and Inventory Forecasting

Artificial intelligence may forecast product demand and determine recommended purchasing or inventory levels.

Dynamic Pricing

Algorithms may recommend prices according to demand, competitor prices, weather, location, inventory or customer behaviour.

Customer Recommendations

E-commerce websites and mobile applications may recommend products based on customer history, location, browsing patterns or inferred preferences.

Chatbots and Customer Service

Artificial intelligence chatbots may answer questions, receive orders, process complaints, provide product information or make reservations.

Advertising and Content Creation

Generative systems may create text, photographs, videos, digital characters, voiceovers, product descriptions, menus and social-media campaigns.

Employee Management

Artificial intelligence may be used for recruitment screening, performance analysis, shift scheduling, attendance review, workplace monitoring and training.

Fraud and Royalty Monitoring

A franchisor may use artificial intelligence to compare POS records, payment data, inventory and online orders to identify potential underreporting.

Quality Control

Image recognition and data analytics may be used to assess store cleanliness, product presentation, waiting times, temperature records and compliance with franchise standards.

Each application requires a different legal assessment.

A tool that predicts weekly inventory does not create the same risk as a system that automatically rejects job candidates or determines individual consumer prices.

Artificial Intelligence Governance in the Franchise Agreement

The franchise agreement should determine whether the franchisor may require franchisees to use specified artificial intelligence systems.

The clause should identify:

• The approved system;
• Provider;
• Purpose;
• Data categories;
• Integration requirements;
• Cost;
• Training;
• Support;
• Update procedures;
• Audit rights;
• Replacement rights.

A general clause allowing the franchisor to introduce any technology, at any cost and for any purpose may create uncertainty and standard-term concerns.

The Turkish Code of Obligations recognises contractual freedom but also regulates standard terms prepared for repeated use. Clauses authorising the drafting party to make unilateral changes that aggravate the counterparty’s position may be treated as unwritten, while standard terms contrary to good faith cannot place the counterparty at an unjust disadvantage.

The agreement should distinguish between:

• Mandatory central systems;
• Approved optional tools;
• Prohibited public tools;
• Locally developed franchisee systems;
• Experimental pilot programmes.

A franchisee should not upload confidential information, personal data or trade secrets to an unapproved public artificial intelligence service merely because the service is freely available.

Artificial Intelligence Is Not an Independent Legal Person

An artificial intelligence system is not generally treated as a separate contractual or legally liable person under current Turkish private law.

The relevant legal responsibility will ordinarily remain with one or more natural or legal persons, such as:

• Franchisor;
• Franchisee;
• Technology supplier;
• Software integrator;
• Employer;
• Advertiser;
• Data controller;
• Product or service provider.

A party cannot avoid responsibility merely by stating that “the algorithm made the decision.”

Under Article 112 of the Turkish Code of Obligations, a debtor that fails to perform an obligation properly must compensate the resulting loss unless it proves that no fault is attributable to it.

Article 49 separately imposes liability on a person who causes damage through wrongful and culpable conduct.

Where the franchisor requires every outlet to use a central system, the franchisor may face claims relating to:

• Negligent system selection;
• Inadequate testing;
• Failure to disclose known defects;
• Incorrect central settings;
• Failure to provide human review;
• Delayed correction of harmful outputs.

The franchisee may remain responsible where it:

• Enters incorrect data;
• Uses the system outside the approved purpose;
• Ignores warnings;
• Publishes unreviewed content;
• Makes the final customer or employment decision;
• Uploads data without authority.

The technology provider may have separate contractual responsibility for software defects, security failures or failure to satisfy agreed service levels.

Personal Data Protection and Artificial Intelligence

Personal data protection is one of the most significant legal issues in franchise artificial intelligence projects.

Artificial intelligence systems may process personal data relating to:

• Customers;
• Employees;
• Job candidates;
• Franchise owners;
• Delivery personnel;
• Suppliers;
• Website users;
• Loyalty-programme members.

Law No. 6698 applies to personal data processed wholly or partly through automatic means and requires compliance with principles including lawfulness, accuracy, purpose limitation, proportionality and limited retention.

The Personal Data Protection Authority’s recommendations concerning artificial intelligence emphasise that AI applications should respect fundamental rights, avoid excessive data use, provide transparency and establish appropriate safeguards throughout the system’s lifecycle.

The fact that an artificial intelligence system performs the technical processing does not remove the obligations of the data controller.

Determining the Data Controller

The franchise documents should identify who determines the purposes and means of the processing.

Possible structures include:

Franchisor as Data Controller

The franchisor determines why customer data will be analysed, selects the model and decides how the results will be used.

Franchisee as Data Controller

The franchisee independently uses an artificial intelligence tool for its own recruitment, local marketing or customer management.

Separate Data Controllers

The franchisor and franchisee process the same or overlapping information for their own separate purposes.

Controller and Processor

One party determines the purpose, while another processes the information only according to documented instructions.

The title used in the franchise agreement is not conclusive if it does not reflect the actual conduct.

The parties should examine:

• Who selects the data;
• Who sets the purpose;
• Who configures the model;
• Who decides retention;
• Who receives the output;
• Who makes the final decision;
• Who answers data-subject requests.

Lawful Basis

Artificial intelligence projects should not rely automatically on explicit consent.

The correct processing condition depends on the data, purpose and relationship.

Possible legal grounds under the KVKK may include:

• Legal obligation;
• Performance or establishment of a contract;
• Establishment, exercise or protection of a right;
• Legitimate interests, provided fundamental rights are not harmed;
• Explicit consent where another legal basis does not apply.

The processing ground should be identified before the information is collected.

A franchisee should not obtain a general statement authorising “all artificial intelligence processing” and assume that every future use is lawful.

The information notice should describe the processing in understandable terms.

Data Minimisation

Artificial intelligence developers may request large datasets because more data may improve performance.

The KVKK principles do not permit unlimited collection merely because information could be useful later.

The network should ask:

• Is the data necessary?
• Can anonymised information be used?
• Can identifiers be removed?
• Is exact location required?
• Is the complete conversation required?
• Can the model be trained without customer records?
• Can the same result be obtained through aggregated statistics?

A demand-forecasting system may need product sales and time information but may not need customer names, phone numbers or identity numbers.

A royalty-audit model may need outlet-level revenue but not identifiable employee data.

Automated Decision-Making

AI systems may evaluate individuals and produce decisions affecting them.

Examples include:

• Rejecting a franchise candidate;
• Rejecting a job applicant;
• Assigning an employee a high-risk score;
• Refusing a customer promotion;
• Identifying a customer as potentially fraudulent;
• Recommending termination of a franchise agreement.

Article 11 of the KVKK gives the data subject the right to object to a result arising against them through analysis exclusively by automated systems.

The Authority’s artificial intelligence publications also emphasise that algorithmic decisions should remain reviewable and that safeguards should be established against harmful or discriminatory outcomes.

A franchise network should therefore avoid making material decisions entirely through an unexplained score.

Human review should be:

• Genuine;
• Conducted by an authorised person;
• Based on sufficient information;
• Capable of changing the result;
• Documented.

A person who merely approves every algorithmic recommendation automatically does not provide meaningful human review.

Transparency and Explainability

Individuals should receive sufficient information to understand the purpose of the processing and the significance of the system.

This does not necessarily require disclosure of source code or trade secrets.

Depending on the application, meaningful transparency may include:

• Data categories used;
• Purpose;
• Main decision factors;
• Whether profiling occurs;
• Whether the output is advisory or determinative;
• How to challenge an outcome;
• Who may be contacted;
• Retention period.

The network should avoid technically inaccurate claims such as:

• “The system is completely objective.”
• “Artificial intelligence cannot discriminate.”
• “The model never makes mistakes.”
• “No human can change the decision.”

Bias and Discrimination

Artificial intelligence may reproduce or amplify bias contained in historical data.

A recruitment system trained on earlier hiring decisions may disadvantage groups that were historically underrepresented.

A site-selection system may exclude particular neighbourhoods because its data reflect past investment patterns rather than actual commercial potential.

A customer-scoring model may treat language, postcode, disability-related behaviour or age as indirect indicators.

Franchisors should conduct bias testing before and after deployment.

The review should examine:

• Training data;
• Proxy variables;
• Error rates;
• False positives;
• Different outcomes for comparable individuals;
• Accessibility;
• Complaint patterns.

Sensitive or vulnerable groups require greater care.

Cross-Border Data Transfers

International franchisors commonly use cloud-based artificial intelligence providers located abroad.

Data may be transferred outside Türkiye when:

• Prompts are sent to a foreign server;
• Customer records are stored in a foreign cloud;
• A foreign franchisor accesses dashboards;
• Model support is provided from abroad;
• Sub-processors operate in other countries.

The cross-border transfer framework under Article 9 of the KVKK was amended in 2024. The revised system provides mechanisms including adequacy decisions, appropriate safeguards such as standard contracts or binding corporate rules, and limited exceptional transfer grounds. The previous and amended systems operated together only during the statutory transition period ending in September 2024.

The franchise agreement should require disclosure of:

• Data-hosting countries;
• Sub-processors;
• Transfer mechanism;
• Changes to server location;
• Government access risks;
• Return and deletion procedures.

The franchisor should not represent that information remains in Türkiye if the AI provider routes it through foreign infrastructure.

Model Training With Franchise Data

A critical question is whether the technology provider may use uploaded information to train its general model.

Prompts may contain:

• Customer complaints;
• Employee records;
• Contracts;
• Pricing;
• Franchise manuals;
• Recipes;
• Product-launch plans;
• Litigation information.

The provider agreement should state whether data are used for:

• Delivering the service;
• Security monitoring;
• Product improvement;
• General model training;
• Human review;
• Benchmarking.

A franchise network should prefer enterprise arrangements that allow training use to be restricted where confidential or personal information is involved.

Employees should be instructed not to paste complete contracts, customer databases or confidential manuals into public AI tools.

Data Protection Impact Assessment

Turkish law does not currently contain a universal article using the same formal terminology for every private-sector AI project as some foreign regimes.

Nevertheless, the Personal Data Protection Authority recommends risk-based assessment, privacy by design and evaluation of the likely impact of algorithmic systems on individuals.

The Authority’s artificial intelligence materials specifically discuss data protection impact assessments as an important tool for systems involving profiling and algorithmic decisions.

A franchise network should conduct a written assessment where a system involves:

• Large-scale profiling;
• Sensitive data;
• Employee monitoring;
• Children;
• Location tracking;
• Facial recognition;
• Automated eligibility decisions;
• Combination of multiple datasets.

Artificial Intelligence and Dynamic Pricing

Franchise systems may use artificial intelligence to recommend prices based on:

• Demand;
• Time;
• Inventory;
• Weather;
• Customer location;
• Competitor prices;
• Delivery capacity.

Dynamic pricing is not automatically unlawful.

The principal competition-law issue is whether the tool restricts each franchisee’s independent pricing or facilitates coordination among competing businesses.

A franchisor should not use software to impose fixed or minimum resale prices indirectly.

Risk may arise where the system:

• Prevents franchisees from changing prices;
• Penalises deviations;
• Automatically matches competitors;
• Shares future price intentions;
• Uses all franchisees’ data to maintain a common minimum price;
• Alerts franchisees when another outlet applies a discount.

The Competition Authority continues to examine algorithmic pricing and data-driven competition issues as part of its digital markets work, including a June 2026 workshop addressing algorithmic pricing practices.

The Authority’s research also recognises that pricing algorithms may increase transparency and create conditions that facilitate coordination.

The franchise agreement should state that:

• Recommendations are non-binding where legally required;
• Franchisees retain genuine authority;
• Competitively sensitive information is not disclosed;
• Algorithm settings are reviewed by competition counsel;
• Deviations do not trigger retaliation.

Personalised Pricing

An AI system may calculate different prices or promotions for different customers.

The network should assess:

• Whether the customer is informed;
• Whether personal data are used lawfully;
• Whether the distinction is discriminatory;
• Whether a claimed discount is genuine;
• Whether vulnerable customers are exploited;
• Whether the practice creates a misleading commercial impression.

Personalised pricing should not be disguised as a universally available discount where customers receive materially different offers based on hidden profiling.

Chatbots and Customer Communications

AI chatbots can provide fast customer support, but the network remains responsible for customer-facing information.

A chatbot may provide incorrect information concerning:

• Price;
• Product content;
• Allergens;
• Refund rights;
• Delivery time;
• Campaign conditions;
• Warranty;
• Reservation status.

The franchise documents should identify:

• Which entity operates the chatbot;
• Which entity is the seller or service provider;
• Which data are collected;
• Whether conversations are recorded;
• Escalation to a human;
• Approval of answers;
• Responsibility for refunds and complaints.

A warning that a customer is speaking with an AI system may improve transparency, but it does not excuse misleading or legally incorrect information.

The chatbot should not invent product claims or legal rights.

AI-Generated Advertising

Commercial advertisements must be honest and must not mislead consumers.

Misleading or aggressive commercial practices are prohibited and fall within the Advertising Board’s supervisory authority.

The Ministry of Trade announced important AI-specific advertising amendments on 1 July 2026.

Where advertisements use an AI-created digital character that cannot be distinguished from a real person, the use of artificial intelligence must be disclosed clearly, understandably and distinguishably.

The amendments also prohibit advertising in which an AI-generated digital copy of a real person creates the impression that the person personally experienced or recommended the relevant product or service.

Franchise networks using AI-generated influencers, voices or digital people should therefore establish an approval process covering:

• AI disclosure;
• Consent of real persons;
• Product claims;
• Experience and testimonial claims;
• Image and voice rights;
• Sector-specific restrictions;
• Record retention.

Hallucinated Product Claims

Generative AI may create plausible but false claims.

For example, it may state that a food is:

• Allergen-free;
• Organic;
• Clinically proven;
• Suitable for children;
• Guaranteed to produce a health benefit.

The franchisor and franchisee should not publish these claims without verification.

The person advertising the product remains responsible for substantiating objective claims.

The fact that a generative model invented the wording is not a defence.

Intellectual Property Risks

Artificial intelligence creates intellectual property questions at both the input and output stages.

Training and Input Risks

Users may upload protected material such as:

• Photographs;
• Music;
• Software;
• Designs;
• Advertising copy;
• Competitor materials;
• Franchise manuals.

The person uploading the material should have the required rights or another lawful basis.

Output Risks

AI-generated content may reproduce or closely resemble protected works, trademarks, designs, characters or photographs.

Outputs should be reviewed before commercial use.

The Turkish Copyright Act defines a work as an intellectual and artistic product bearing the individuality of its author and defines the author as the person who creates the work.

These human-centred concepts create uncertainty concerning whether content generated entirely without meaningful human creativity qualifies for copyright protection and who, if anyone, may be treated as its author under current law.

The TBMM Artificial Intelligence Research Commission also identified AI-generated works and entitlement to copyright-related payments as areas requiring future legislative attention.

Until clearer rules emerge, franchise agreements should regulate ownership contractually while recognising that a contract cannot create statutory copyright where legal protection does not exist.

Ownership of AI Outputs

The parties should state who may use AI-generated materials created for the franchise system.

Possible outputs include:

• Menus;
• Advertisements;
• Product images;
• Training content;
• Software code;
• Local campaign copy;
• Translation;
• Store designs;
• Customer-service scripts.

The agreement should address:

• Ownership;
• Licence rights;
• Territory;
• Modification;
• Approval;
• Third-party claims;
• Continued use after termination.

The franchisee should not assume that paying for an AI subscription gives it unrestricted ownership of every output.

The provider’s terms may reserve rights or impose limitations.

Trademark Protection

An AI system may generate content that misuses the franchise trademark.

Examples include:

• Altered logos;
• Unapproved slogans;
• Incorrect colours;
• Use with prohibited products;
• Confusingly similar signs;
• Unauthorised brand extensions.

The Turkish Industrial Property Code protects registered trademarks and allows the right holder to prevent unauthorised commercial uses falling within the statutory scope.

Every AI-generated campaign should pass through the same brand approval process as human-created content.

A franchisee should not create a new brand mascot or modified logo through an AI image generator without written approval.

Employee Recruitment and Management

Artificial intelligence may assist franchisees in screening applications and scoring employees.

The system should not replace lawful and fair employment decision-making.

The employer should know:

• Which data are used;
• Whether data are accurate;
• Whether the model uses protected or irrelevant characteristics;
• Whether human review exists;
• Whether candidates can challenge a result;
• How long records are retained.

A system trained on historical employee data may reproduce earlier discriminatory patterns.

Employee monitoring tools require additional proportionality analysis.

AI should not be used to conduct constant surveillance merely because the technology makes it possible.

Franchisee Performance Scoring

A franchisor may use AI to score franchisees based on:

• Sales;
• Audits;
• Customer reviews;
• Complaints;
• Delivery times;
• Royalty reporting;
• Online activity.

Such scoring may support quality management.

However, the franchisor should not terminate, refuse renewal or remove territory solely on the basis of an unexplained algorithmic score.

The franchisee should be able to:

• Access relevant data;
• Identify errors;
• Submit an explanation;
• Request human review;
• Challenge inaccurate comparisons.

The agreement should explain whether the score is advisory or constitutes an independent contractual standard.

Cybersecurity

AI systems may increase the number of users, integrations and data transfers within the network.

Risks include:

• Prompt injection;
• Data leakage;
• Account takeover;
• Malicious model outputs;
• API compromise;
• Training-data poisoning;
• Unauthorised system access;
• Ransomware;
• Manipulated pricing or inventory recommendations.

Law No. 7545 on Cybersecurity entered into force on 19 March 2025.

It applies broadly to public and private persons and organisations operating, existing or providing services in cyberspace and establishes a general framework for cybersecurity governance, risk reduction and protection against cyber threats.

The law’s principles include applying security measures throughout the lifecycle of products and services, accountability, continuity, cybersecurity culture and protection of privacy and fundamental rights.

Franchise networks should implement:

• Multi-factor authentication;
• Role-based access;
• Vendor risk review;
• Logging;
• Secure backups;
• Patch management;
• Encryption;
• Incident response;
• Business continuity;
• Staff training.

Personal Data Breaches

An artificial intelligence incident may also constitute a personal data breach.

The Personal Data Protection Board’s notification framework requires controllers to notify the Board without delay and, in practice, no later than 72 hours after learning of the breach. A justified explanation is required where notification cannot be completed within that period.

The franchisor and franchisee should agree on:

• Who detects the incident;
• Who investigates;
• Who notifies the other party;
• Who determines controller obligations;
• Who communicates with customers;
• Who preserves evidence;
• Who bears remediation costs.

A technology provider should be contractually required to notify the network immediately rather than waiting until the regulatory deadline is close to expiring.

AI Vendor Contracts

An AI vendor agreement should cover more than price and functionality.

Important provisions include:

Scope and Purpose

The permitted use cases and prohibited uses should be identified.

Data Use

The contract should state whether the vendor may use data for general model training, analytics or product improvement.

Security

The vendor should provide information on technical and administrative safeguards, incident management and access controls.

Sub-Processors

The customer should know which third parties may access data and where they operate.

Service Levels

Availability, response times, recovery and support should be measurable.

Model Changes

The vendor should give notice of material changes to the model, functionality or security structure.

Accuracy

The vendor should state the intended limitations of the system without making misleading guarantees.

Audit

The franchisor may require audit reports, certifications or independent assurance.

Intellectual Property

Input rights, output rights, infringement claims and licence restrictions should be addressed.

Indemnity and Liability

The agreement should allocate responsibility for data breaches, IP claims, service failures and regulatory investigations.

Exit

The customer should be able to export data, obtain necessary records and require deletion at the end of the service.

Approved AI Tools Policy

A franchise network should maintain a written list of approved tools.

The policy may classify systems as:

• Approved for public information;
• Approved for internal non-confidential use;
• Approved for personal data under stated conditions;
• Approved for enterprise use only;
• Prohibited.

Employees and franchisees should receive practical examples.

Permitted Example

Using an approved enterprise tool to prepare a general social-media caption that contains no personal data, confidential information or unverified claim.

Prohibited Example

Uploading the complete franchise agreement, customer database or employee disciplinary file to a public chatbot.

The policy should also regulate:

• Prompt content;
• Output review;
• Record keeping;
• Copyright checks;
• Customer disclosure;
• Brand approval;
• Human decision-making.

AI Incidents

An AI incident may involve:

• Data leakage;
• Discriminatory output;
• False customer statement;
• Unlawful advertisement;
• Manipulated price;
• Copyright complaint;
• Incorrect employee rejection;
• Cybersecurity breach.

The response procedure should include:

1. Suspending the harmful use;
2. Preserving prompts, outputs and logs;
3. Identifying affected people and outlets;
4. Notifying legal, security and data teams;
5. Assessing regulatory notifications;
6. Correcting customer or employee outcomes;
7. Contacting the vendor;
8. Documenting remediation;
9. Reviewing whether network-wide changes are required.

The network should not delete relevant logs immediately after discovering a problem.

Those records may be necessary to establish what the model received, produced and how a human used the result.

Evidence and Audit Trails

Artificial intelligence systems can change over time.

The same prompt may produce a different answer after a model update.

The network should preserve sufficient information to reconstruct material decisions.

Relevant records may include:

• Model and version;
• Prompt;
• Input data;
• Output;
• Date and time;
• User;
• Human reviewer;
• Final decision;
• Override;
• Complaint;
• Correction.

The Turkish Commercial Code requires merchants to maintain commercial books and documents in a manner that allows their transactions and financial position to be understood and traced. AI-generated recommendations affecting sales, payments or commercial decisions may therefore need to be preserved alongside ordinary commercial records.

Artificial Intelligence Clause Checklist

A franchise AI clause should address:

1. Approved systems;
2. Permitted use cases;
3. Prohibited use cases;
4. Implementation costs;
5. Integration duties;
6. Data-controller roles;
7. Data-processor instructions;
8. Lawful processing grounds;
9. Information notices;
10. Cross-border transfers;
11. Training-data use;
12. Confidential information;
13. Human review;
14. Automated decision objections;
15. Bias testing;
16. Accuracy monitoring;
17. Brand approval;
18. Consumer transparency;
19. AI-generated advertising disclosure;
20. Intellectual property ownership;
21. Third-party infringement;
22. Algorithmic pricing controls;
23. Competition compliance;
24. Employee monitoring;
25. Cybersecurity measures;
26. Incident notification;
27. Audit and logs;
28. Vendor changes;
29. Indemnities;
30. Data return and deletion.

Recommendations for Franchisors

A franchisor should:

• Establish a central AI governance committee;
• Maintain an inventory of AI systems;
• Classify systems by risk;
• Conduct legal and technical assessments;
• Provide franchisee training;
• Require human review for material decisions;
• Restrict public AI tools;
• Review advertising outputs;
• Test pricing systems for competition risk;
• Document vendor due diligence;
• Create an AI incident response plan.

The franchisor should not use artificial intelligence merely because competitors use it.

The system should solve a defined business problem and remain proportionate to that purpose.

Recommendations for Franchisees

A franchisee should:

• Use only approved tools;
• Avoid uploading personal or confidential data without authority;
• Review every customer-facing output;
• Preserve evidence of important AI decisions;
• Notify the franchisor of errors and incidents;
• Avoid creating independent pricing coordination tools;
• Train local employees;
• Review vendor terms before purchasing local software;
• Maintain human authority over recruitment and disciplinary decisions;
• Challenge inaccurate central scoring.

A franchisee should not assume that the franchisor bears every risk simply because the brand approved the technology.

Artificial Intelligence Compliance Checklist

Before deploying AI in a Turkish franchise network, the parties should confirm that:

1. The business purpose is defined.
2. The responsible entity is identified.
3. The data controller is identified.
4. The lawful basis is documented.
5. Data collection is proportionate.
6. Sensitive data are protected.
7. Cross-border transfer rules are satisfied.
8. Vendor training rights are restricted.
9. Data retention is defined.
10. Human review is genuine.
11. Individuals can challenge harmful automated outcomes.
12. Bias testing has been completed.
13. The model’s limitations are understood.
14. Customer-facing AI is disclosed appropriately.
15. Chatbot answers are monitored.
16. Product claims are verified.
17. AI-created digital characters comply with the 2026 advertising rules.
18. Real-person digital replicas are not used unlawfully.
19. Copyright risks have been reviewed.
20. Trademark use is approved.
21. Pricing remains competition compliant.
22. Franchisees retain lawful commercial independence.
23. Employee use is proportionate.
24. Cybersecurity controls are implemented.
25. Incident reporting is documented.
26. Personal data breach deadlines can be met.
27. Prompts and outputs are logged where necessary.
28. Vendor contracts contain audit and exit rights.
29. Franchise agreements allocate costs and liability.
30. The system is reviewed periodically.

Conclusion

Artificial intelligence can improve the efficiency, consistency and profitability of a franchise network.

It can help predict demand, optimise stock, support customers, create content and identify operational problems.

The same technology can also create substantial legal exposure.

As of July 2026, Türkiye does not have one comprehensive AI statute governing every private-sector application. Artificial intelligence must therefore be assessed through existing legal rules.

Personal data protection is central.

Franchisors and franchisees must identify their actual controller and processor roles, establish lawful grounds, minimise data and provide meaningful transparency.

Individuals have the right to object to harmful results arising from analysis exclusively through automated systems. Material employment, franchise and customer decisions should therefore remain subject to genuine human review.

Algorithmic pricing requires competition-law controls.

A central system should not become an indirect method of fixing minimum resale prices or coordinating independent franchisees.

Chatbots and generative advertising create consumer-law risks.

Customer-facing outputs should be reviewed for accuracy. Artificial intelligence does not excuse false product claims.

The July 2026 advertising amendments also require transparent disclosure where digital characters are generated through AI and cannot be distinguished from real persons, while certain advertisements using digital replicas of real individuals are prohibited.

Intellectual property rights require careful contractual treatment.

Current Turkish copyright law is based on a work bearing the individuality of its author and on a person who creates that work. The copyright status of purely machine-generated content therefore remains uncertain.

Franchise agreements should allocate contractual use rights without assuming that every AI output receives statutory copyright protection.

Cybersecurity is equally important.

AI systems connect cloud providers, customer databases, franchise software and local outlets. A vulnerability at one point can affect the complete network.

The 2025 Cybersecurity Law and the KVKK security framework require businesses to approach AI as part of their wider risk and incident-management systems.

The strongest AI governance model is not a blanket prohibition or unrestricted adoption.

It is a documented process that identifies the intended purpose, limits data use, requires human oversight, protects intellectual property, preserves competition and allocates responsibility before harm occurs.

Frequently Asked Questions

Is artificial intelligence specifically regulated in Turkey?

Türkiye does not currently have one comprehensive horizontal AI law in force. Existing data protection, competition, consumer, contract, employment, intellectual property and cybersecurity laws apply.

Is there an AI bill before Parliament?

Yes. An Artificial Intelligence Law proposal remains under parliamentary commission review as of July 2026.

Can a franchisor require franchisees to use an AI system?

It may do so contractually, subject to mandatory law, proportionality, cost allocation, data protection and standard-term limitations.

Who is liable when an AI tool makes a mistake?

Responsibility depends on who selected, configured, supplied, used and relied on the system. The AI itself is not treated as an independent liable legal person.

Can customer data be uploaded into an AI chatbot?

Only where the processing has a valid legal basis, complies with transparency and security requirements and satisfies any cross-border transfer rules.

Can public AI tools be used for franchise work?

They may be used only within the network’s approved policy. Personal data, confidential know-how and protected materials should not be uploaded without authority.

Can the AI provider train its model on franchise data?

Only according to the provider contract and applicable law. Enterprise contracts should regulate or prohibit general model training where necessary.

Does consent solve every data protection issue?

No. Consent must be valid and specific, and the other KVKK principles continue to apply.

Can AI make the final franchise candidate decision?

An entirely automated harmful decision creates significant legal risk. Meaningful human review and an objection mechanism should be available.

Can AI reject job applicants?

AI may support recruitment, but employers should ensure lawful data use, bias testing, transparency and genuine human review.

Can the franchisor use AI to score franchisees?

Yes, but the data and methodology should be reliable, and material sanctions should not depend solely on an unexplained score.

Can AI set retail prices?

AI may recommend prices, but the system must not unlawfully eliminate independent franchisee pricing or facilitate coordination.

Are personalised customer prices legal?

They require analysis under data protection, consumer, discrimination and competition rules. Hidden or misleading personalisation creates risk.

Must a chatbot identify itself as artificial intelligence?

Transparent identification is advisable, particularly where a customer may otherwise believe that they are communicating with a human.

Is the business responsible for chatbot errors?

Potentially yes. The business should review the legal and commercial consequences of customer-facing answers.

Can AI create product health claims?

It can generate wording, but objective claims must be verified before publication. Unverified AI output should not be used.

What changed for AI-generated advertising in 2026?

The Ministry of Trade announced that indistinguishable AI-created digital characters must be disclosed clearly and that certain advertisements using digital replicas of real persons are prohibited.

Who owns AI-generated content?

The provider contract and franchise agreement may allocate contractual rights, but purely AI-generated content may not necessarily satisfy the current statutory requirements for copyright protection.

Can AI-generated content infringe copyright?

Yes. Outputs may reproduce or resemble protected works, and input materials may also be uploaded without authority.

Can a franchisee alter the brand logo with AI?

Not without the trademark owner’s approval.

Does the KVKK apply to AI systems?

Yes, where personal data are processed.

What right exists concerning automated decisions?

A person may object to a result arising against them through analysis exclusively by automated systems under Article 11 of the KVKK.

Can data be transferred to a foreign AI provider?

Potentially, but the transfer must comply with the current Article 9 cross-border transfer mechanisms.

Is a data impact assessment required?

A written risk and impact assessment is strongly advisable for high-risk profiling, employee monitoring, sensitive data and automated decisions.

What happens after an AI data breach?

The incident should be contained, investigated and documented. The data controller must assess the KVKK notification requirements, including the 72-hour framework.

Does the Cybersecurity Law apply to franchise businesses?

Law No. 7545 has broad application to persons and organisations operating or providing services in cyberspace. Specific obligations depend on the business and applicable secondary framework.

Should AI outputs be stored?

Material outputs affecting contracts, customers, employees, prices or franchise compliance should be retained sufficiently to reconstruct the decision.

Can the franchisor audit a franchisee’s AI use?

Yes, where the franchise agreement grants a proportionate audit right and confidentiality and personal data rules are respected.

What should an AI vendor contract contain?

It should address data use, security, sub-processors, service levels, model changes, audit, intellectual property, liability, incidents and exit.

What is the greatest practical risk?

The greatest risk is allowing employees or franchisees to use unapproved AI systems with confidential or personal data without review, documentation or responsibility allocation.

What is the best compliance approach?

The network should maintain approved tools, defined purposes, data minimisation, human review, security, competition controls, output verification and a documented incident procedure.

This article provides general legal information as of July 2026 and does not constitute legal, competition, data protection, intellectual property, employment, cybersecurity or technical advice. Every artificial intelligence application should be assessed according to its purpose, data, model, provider, users, decision-making effect and contractual structure.