Asutay Duhan Meydan Attorney at Law Meydan AI & Tech Law
Introduction
OpenAI’s Terms of Use applicable to individuals residing outside the EEA, Switzerland and the United Kingdom, including users in Turkey, allocate substantial responsibility to the user. The Terms state that Output may not always be accurate, should not be relied upon as a sole source of truth or as a substitute for professional advice, and must be evaluated for accuracy and appropriateness, including through human review where appropriate. They also provide the Services on an “as is” basis, state that use of Outputs is at the user’s “sole risk”, exclude specified categories of indirect loss and generally cap aggregate liability at the greater of USD 100 or the amount paid for the relevant service during the preceding twelve months. Significantly, however, the Terms themselves state that those liability limitations operate only to the maximum extent permitted by applicable law.
That qualification is central to the position in Turkey. The relevant question is not whether an AI provider may allocate risk by contract. Turkish private law permits considerable contractual autonomy. The more important question is which risks remain available for contractual allocation once Turkish law has independently imposed a duty on the provider.
Articles 26 and 27 of the Turkish Code of Obligations No. 6098 (“TCO”) establish the starting point. Parties may determine contractual content freely only within statutory limits, while contractual provisions contrary to mandatory statutory rules, public order, morality or personality rights are null and void. Article 25 adds a separate control mechanism for standard terms by prohibiting general terms which, contrary to good faith, operate against the counterparty or aggravate its position.
The central proposition is therefore narrower than a general objection to contractual disclaimers:
Contractual risk allocation operates only within the space left open by mandatory law. A contractual duty imposed on the user cannot displace an independent duty imposed directly by Turkish law on the provider.
This distinction already follows from Turkish contract, consumer, data protection and cybersecurity law. Bill No. 2/3358, if enacted substantially in its current form, would make the distinction considerably more visible in relation to AI-specific duties such as hallucination controls, content verification, human oversight and cybersecurity testing. The Bill was submitted to the Grand National Assembly of Turkey on 7 November 2025 and, as of 19 September 2026, remains before the relevant parliamentary committees.
Key takeaway: Turkish law does not prevent contractual risk allocation; it determines the point at which contractual allocation must stop.
1. “Sole Risk” Does Not Necessarily Mean Sole Legal Responsibility
OpenAI’s Terms contain several mechanisms that perform different legal functions. The warning that Output may be inaccurate describes a known characteristic of generative AI. The requirement to evaluate Output regulates user conduct. The “sole risk” language seeks to allocate the consequences of reliance. The warranty disclaimer narrows the contractual assurances made by OpenAI, while the liability clause seeks to limit financial exposure after liability has otherwise arisen. These provisions should not be treated as a single, comprehensive exclusion of responsibility.
The distinction is even clearer in OpenAI’s business contracting structure. Section 4.3 of the OpenAI Services Agreement makes the customer responsible for Input and “solely responsible” for the use of Outputs and for assessing their accuracy and appropriateness. Yet section 5.1 separately requires OpenAI to comply with specified Security Measures. The same agreement excludes gross negligence and wilful misconduct from its ordinary monetary cap and treats OpenAI’s breach of Security Measures separately from the general exclusion of indirect damages.
OpenAI’s own contractual architecture therefore distinguishes customer-controlled downstream risk from provider-controlled obligations.
Turkish law imposes an additional mandatory boundary. Article 115(1) TCO provides that an advance agreement under which the debtor will not be liable for gross fault is null and void. Accordingly, where relevant conduct reaches the threshold of gross fault under Turkish law, a contractual limitation that purports to restrict the resulting liability must be assessed against that mandatory prohibition. It should not simply be assumed that a fixed contractual cap applies irrespective of the legal character of the conduct.
This is particularly important in relation to OpenAI’s USD 100 cap. The Terms state a contractual ceiling, but that ceiling does not itself determine the maximum legally recoverable amount in every Turkish-law scenario. The Terms themselves recognise this by limiting the clause to the maximum extent permitted by applicable law.
The same reasoning applies to “sole risk”. The phrase may allocate ordinary reliance risk associated with using probabilistic Output after receiving express warnings. It does not necessarily mean that every legal consequence connected with an Output belongs exclusively to the user where Turkish legislation separately places a duty on the provider.
Key takeaway: “Sole risk” can allocate reliance risk, but it cannot automatically convert an independent provider-side statutory obligation into user-side responsibility.
2. User Verification Can Affect Liability Without Replacing a Provider Duty
OpenAI’s requirement that users evaluate Outputs is likely to be legally significant in Turkey. The Terms require users to assess Output for accuracy and appropriateness before using or sharing it and expressly contemplate human review where appropriate.
Turkish liability law can give that requirement real effect. Article 52 TCO allows compensation to be reduced, and in appropriate circumstances eliminated, where the injured party contributes to the occurrence or increase of the loss. A user who receives uncertain or facially questionable AI-generated information, performs no reasonable verification and nevertheless relies on it for a consequential decision may therefore face a materially different causation and damages analysis from a user who conducts appropriate review.
That proposition should not, however, be converted into provider immunity. User-side contributory conduct and provider-side breach are analytically distinct. Where Turkish law independently imposes a duty on the provider, the user’s failure to verify an Output may affect causation or quantum, but it does not establish that the provider complied with its own obligation.
The distinction is particularly clear when viewed in temporal terms. Provider-side controls ordinarily concern what must be done in the design, testing, security or operation of the system before or during generation. User verification concerns what happens after the Output has been produced and before the user relies upon it. Both forms of conduct may contribute to the same loss.
This also explains why the phrase “human review as appropriate” leaves a legally significant degree of flexibility. Appropriate review will not necessarily mean the same thing for an ordinary consumer, a lawyer conducting legal research, or a company integrating an API into a consequential automated process. The standard can vary according to the use case, the user’s expertise, the apparent reliability of the Output and the degree of control exercised by each actor.
That flexibility is useful operationally, but it also means that the contractual obligation cannot itself predetermine the allocation of legal responsibility in every case.
Key takeaway: A user’s failure to verify an Output may affect causation and damages, but it does not substitute for compliance with a separate duty imposed directly on the provider.
3. Existing Turkish Law Already Contains Provider-Side Duties That Contract Cannot Simply Reallocate
Consumer law provides the first example. Article 5 of Consumer Protection Law No. 6502 provides that non-negotiated terms creating an imbalance against the consumer contrary to good faith are unfair terms and are null and void. Pre-drafted standard provisions which the consumer could not influence are presumed not to have been individually negotiated.
For relationships falling within Law No. 6502, this creates an additional control over provisions such as “as is”, “sole risk” and broad monetary limitations. Articles 13 to 15 separately regulate defective services and statutory remedies. This does not mean that every inaccurate AI response automatically constitutes defective performance. The probabilistic nature of the service, the warnings provided, the feature involved and the consumer’s reasonable expectations all remain relevant. The narrower point is that an “as is” clause cannot, by itself, abolish a statutory inquiry into whether the service meets the standard required by consumer law.
Data protection law provides an even clearer illustration of a statutory role that cannot be determined solely by contractual drafting. Under Article 12 of Law No. 6698 on the Protection of Personal Data (“KVKK”), a data controller must take the necessary technical and administrative measures to prevent unlawful processing and unlawful access and to ensure the preservation of personal data. Article 11 also grants a data subject the right to claim compensation for damage arising from unlawful processing.
OpenAI may contractually require a user to possess the rights and permissions necessary to submit Input. That provision can allocate responsibility for the user’s own act of collection or disclosure. It cannot, however, conclusively determine OpenAI’s legal role in every subsequent processing activity. If and to the extent that an AI provider qualifies as a data controller for a particular processing operation under Turkish law, the obligations attached to that status arise from KVKK rather than from the contract.
The same principle appears in cybersecurity law. Article 7 of Law No. 7545 on Cybersecurity imposes direct duties on actors falling within the Law’s scope that provide services, collect or process data or conduct comparable activities through information systems. These include taking cybersecurity measures required by applicable legislation and notifying the Cybersecurity Presidency without delay of vulnerabilities or cyber incidents identified within the relevant service area.
Whether and to what extent an individual obligation under Law No. 7545 applies to a foreign AI provider requires a separate territorial and factual analysis. That question should not be assumed. The contractual principle is nevertheless clear: where legislation identifies the provider as the statutory addressee of a duty, a private agreement cannot change the identity of the regulated actor.
The contract may allocate private economic consequences between the parties. It does not amend the statute.
Key takeaway: Under consumer, data protection and cybersecurity law, statutory responsibility follows the legal role attributed by legislation, not merely the allocation chosen in a standard contract.
4. Bill No. 2/3358 Would Make the Hallucination Issue Explicit
Bill No. 2/3358 is not current law. Its relevance lies in the regulatory model it proposes.
Article 6 of the Bill would amend Article 7 of the Cybersecurity Law by imposing additional duties on “service providers in artificial intelligence systems”. The proposed provision would require such providers to ensure the transparency and auditability of training datasets, establish content-verification mechanisms intended to prevent false and manipulative information, implement algorithmic controls designed to reduce hallucination risk, develop human-approved oversight mechanisms in high-risk applications and conduct regular cybersecurity vulnerability testing. Failure to implement these measures could lead to administrative fines of up to TRY 5 million, while serious violations threatening public order could result in temporary suspension of activity.
This creates the clearest point of interaction with OpenAI’s current Terms.
OpenAI requires the user to evaluate Output for accuracy and appropriateness. The proposed legislation would require the provider to implement controls intended to reduce the underlying risk of false or manipulative output.
Those duties operate at different stages and are directed at different conduct.
A provider-side hallucination control is primarily an ex ante or system-level obligation. User verification is primarily an ex post reliance obligation.
If inaccurate Output causes loss, the user’s failure to review it could still be legally relevant. Nothing in the proposed framework would necessarily prevent a provider from arguing that user conduct contributed to the damage. But that argument would not answer the separate question whether the provider implemented the controls required by statute.
This produces the most important proposition in the analysis:
A contractual duty imposed on the user to verify AI Output cannot substitute for a statutory duty imposed on the provider to reduce the risk of inaccurate Output.
The same structural principle appears elsewhere in the Bill. Article 3 would add a provision to Law No. 5651 requiring access blocking and content removal within six hours for specified AI-generated content that infringes personality rights, threatens public security or constitutes artificially created deepfake content. Crucially, the proposal states that content providers and developers of AI systems would be jointly responsible for that obligation.
Article 4 would amend Article 12 KVKK by requiring datasets used in AI applications to comply with principles of anonymity, non-discrimination and legitimacy and would treat the use of discriminatory datasets as a violation of data security. Article 7 would require specified deepfake visual, audio or textual content to carry a clear and indelible label stating that it was generated by artificial intelligence and would impose administrative sanctions on content providers and/or developers for non-compliance.
These provisions matter because they are framed as duties imposed on identified regulatory actors. They are not drafted as default contractual rules which the parties may freely redistribute.
The Bill nevertheless leaves an important interpretive issue unresolved. It uses concepts such as “developer” and “service provider” without establishing a detailed taxonomy for the multiple actors involved in a modern AI value chain. Where a service involves a model developer, platform operator, API provider, application developer and end user, determining the statutory addressee of a particular duty could therefore become a significant issue if the proposal is enacted.
Contractual terminology would not necessarily answer that question. A contract stating that a customer is “solely responsible” for Output use cannot itself determine whether legislation classifies another actor as a provider or developer for regulatory purposes.
Key takeaway: If Bill No. 2/3358 is enacted substantially as drafted, user verification and provider-side hallucination controls would constitute cumulative layers of responsibility, not substitutes for one another.
5. The Remaining Exposure Is Primarily a Localisation Risk
OpenAI’s Terms are already structured to accommodate differences in local law. The warranty disclaimer is qualified by applicable law, and the liability limitations expressly apply only to the maximum extent permitted by applicable law.
This drafting avoids an express claim that the global contract overrides mandatory local rules. It does, however, leave the precise Turkish boundary unresolved.
The Terms cannot themselves determine whether Article 115 TCO restricts the application of a limitation in a particular dispute, whether a standard term is affected by Article 25 TCO, whether a consumer provision is ineffective under Article 5 of Law No. 6502, or whether a provider is independently subject to KVKK or cybersecurity obligations. These are questions of Turkish law that remain external to the global agreement.
The California governing-law clause does not necessarily eliminate that inquiry. The ROW Terms select California law. Turkey’s Private International Law Act No. 5718, however, contains rules preserving the operation of certain Turkish mandatory provisions. Article 26 specifically provides, for consumer contracts falling within its scope, that a choice of law cannot deprive the consumer of the minimum protection afforded by the mandatory provisions of the law of the consumer’s habitual residence. Article 47(2) separately provides that the jurisdiction established in, among others, Article 45 for specified consumer disputes cannot be displaced by agreement.
The principal risk for a global AI provider is therefore not that contractual allocation is prohibited in Turkey. It is that broadly drafted concepts such as “sole risk”, “as is”, “human review as appropriate” and a fixed liability cap may have a narrower enforceable meaning in Turkey than their literal wording initially suggests.
That is a localisation problem.
It affects not only litigation strategy but also contract drafting, product design, regulatory mapping and the allocation of controls across the AI value chain.
Key takeaway: The principal Turkish-law risk is not the existence of global disclaimers, but assuming that their literal breadth necessarily equals their enforceable breadth.
Conclusion
OpenAI’s Terms legitimately allocate substantial downstream responsibility to users. Users may be responsible for unlawful Input, unreasonable reliance on Output, failure to conduct appropriate review and the manner in which generated material is ultimately deployed. Those provisions can materially affect causation, contributory conduct and the distribution of economic loss.
They do not, however, exhaust the liability analysis under Turkish law.
The correct sequence is to identify first whether Turkish legislation imposes a duty directly on the provider and whether that duty or its consequences are legally capable of contractual limitation. Only after that inquiry can the contract determine the residual allocation of risk.
That principle is already visible under the Turkish Code of Obligations, consumer law, KVKK and the Cybersecurity Law. Bill No. 2/3358 would make it particularly explicit by proposing provider-side duties concerning content verification, hallucination controls, human oversight, training-data governance and cybersecurity testing.
The distinction can therefore be reduced to two propositions:
Contractual risk allocation cannot displace a mandatory provider-side obligation imposed directly by Turkish law.
And, in the language most relevant to OpenAI’s current Terms:
“Sole risk” does not necessarily mean “sole legal responsibility”.
For global AI providers operating in Turkey, that distinction should be addressed before any dispute reaches court. It belongs in contract localisation, product architecture and regulatory compliance design.
Asutay Duhan Meydan Attorney at Law Meydan AI & Tech Law