AI-built projects

Legal review for projects built with AI

Project-specific legal texts, KVKK (Turkish data protection law) compliance and a lawyer's pre-launch review for websites and mobile apps built with AI tools.

How does it happen in practice?

These scenarios are illustrative and not based on any specific person or case. They reflect situations common in quickly built projects.

Scenario 1

An appointment app with a chat assistant

Situation: An appointment app for a beauty clinic is built with AI over a weekend. The privacy policy is written by the same tool. The database and language model are in the US.
What happened?: Users type their skin conditions and medications into the chat box. This means special category health data is transferred abroad; the text says nothing about it and no standard contract has been signed.
Lesson: Free-text fields collect unplanned data. Had the data flow been mapped before launch, a warning would have been added to the chat box, the transfer would have been safeguarded and the text would have reflected reality.

Scenario 2

A subscription SaaS and the Delaware clause

Situation: A SaaS product offering an accounting assistant to small businesses has AI adapt its terms of use from a foreign template.
What happened?: A user applies to the consumer arbitration committee over a subscription renewed after cancellation. The “US courts have jurisdiction” and “no refunds” clauses do not help; the cancellation method was never defined.
Lesson: Terms of use should be written for the country whose users are served. The cancellation and renewal flow should be designed together with the text.

Scenario 3

An exposed database

Situation: An event ticketing platform goes live with AI-generated code. Database access rules were disabled during development and stayed that way.
What happened?: A security researcher reports that anyone can access all participants' names, phone numbers and emails. Because no one knows who should do what, the 72-hour notification deadline is missed.
Lesson: Technical security checks and a legal breach response plan should be prepared together. Draft notifications to the Authority and data subjects should be ready before an incident.

Scenario 4

Who owns the app's code?

Situation: An entrepreneur has a freelance developer build their app with AI tools; the arrangement is made over a messaging app.
What happened?: During investment talks, the investor's lawyer finds that economic rights over the source code were never assigned in writing. A new, and this time difficult, negotiation with the developer begins.
Lesson: A software development agreement should be signed before the first line of code; IP assignment, source code delivery and open-source licences used should be clearly regulated.