Your employees are using ChatGPT: a corporate AI policy in 5 steps

Generative AI tools entered offices without waiting for a corporate decision. The real risk is not the tool itself, but not knowing which data is being sent where, and through which account. The Turkish Personal Data Protection Authority’s November 2025 guide on generative AI reminds data controllers of exactly this point.

Five steps to a corporate AI policy

• Inventory: which department uses which tool, for what? We ask before we ban; that is the only way to get an honest answer.
• Data classes: which data may never be entered into these tools? Client data, identity details, contracts, formulas and source code come first.
• An enterprise alternative: a ban does not work unless you offer a solution with data protection commitments and admin control.
• Responsibility: the person who signs a text produced by AI is responsible for it. We write that into the policy explicitly.
• Training and review: we explain the rules with real examples and update them every six months.

The policy should fit on one page

Nobody reads a twenty-page directive. The most effective policies are a single page: a green list (free to use), an amber list (only with the enterprise tool) and a red list (never). An employee should be able to decide, in three seconds and before pasting a text, which list it belongs to.

We prepare the legal text of the policy together with our partner law firm and put the technical restrictions in place ourselves. See our AI Integrations page for details.

This article is for information only and does not constitute legal advice. It describes the regulatory framework in Turkey.