The Lawyer's Release: AI Agents, Automation Bias and the Duties That Cannot Be Delegated

Av. Serkan KARA¹

Published October 20, 2026

I. Introduction

Our earlier study, published on this site on October 15, 2026, examined the lawyer's use of generative AI chiefly as a question of text: a model writes, and the lawyer must verify what it wrote against the primary source before using it.² Its conclusion was that no provision of Turkish law bars the tool, that the decisive rules are the duties of care, truthfulness and secrecy already in force together with the transfer rules of the data protection law, and that every sentence the tool produces remains the lawyer's responsibility.

The tools have since taken another shape. An agent is a language model given the means to act: to call functions and work inside other systems, to decide for itself which of those means to use, and to repeat the cycle, each step taking the output of the last as its starting point.³ In a law office those means reach the inbox, the matter files, the court's electronic filing system, the public registries and the client's messages. The question is no longer only whether a text is right. It is who acts, on what, and on whose release.

We argue that the answer of Turkish law has not changed and is personal: every act that leaves the office is the lawyer's act. What changes is the point where the duties take hold. They attach to the lawyer's release of each act, and the law makes that release decisive. The research on human reliance on automated systems and the measured behavior of agents show that a release protects the client only when it is built as a review. Three consequences follow from this.

The statutes, regulations and decisions cited were read in their official sources on October 20, 2026, Turkish legislation and case law in the Ministry of Justice's UYAP legislation and case-law program. Scientific findings are given with their sample, their date and the systems they measured. A figure measured on the systems of 2023 or 2024 is a fact about those systems, and it is used here only for the property of the method it reveals. The subject is the lawyer's own professional work. Services that non-lawyers offer directly to the public lie outside it.

II. From Text to Act: What an Agent Adds

Three properties of an agent matter to the law.

It reads. An agent takes material from outside the office, a letter from opposing counsel, an electronic notification, a web page, into the same working context as its instructions. A language model processes the instructions it is given and the material it is asked to examine as one stream of text, so instructions can be planted in the material. A 2023 study of this attack, which its authors call indirect prompt injection, found that such applications "blur the line between data and instructions" and described the setting of a legal assistant exactly: assistants "that can read emails (containing instructions), access personal data, and send emails accordingly".⁴ The OWASP Gen AI Security Project, in its list of the main risks of applications built on large language models, adds that planted instructions "do not need to be human-visible/readable" and that "it is unclear if there are fool-proof methods of prevention".⁵ Our earlier study noted this weakness for the review of a single document. In an agent it reaches every system the agent can touch.

It acts. An agent can write into a file, send a message, fill in a form and submit it. OWASP calls the resulting risk "excessive agency": damaging actions performed "in response to unexpected, ambiguous or manipulated outputs from an LLM, regardless of what is causing the LLM to malfunction", with three root causes, excessive functionality, excessive permissions and excessive autonomy.⁶

It reports. After many steps an agent gives an account of what it did, and that account is itself model output. The generative AI profile of the United States National Institute of Standards and Technology (NIST) warns that such systems may produce "confabulated logic or citations that purport to justify or explain the system's answer" and "sometimes provide logical steps for how they arrived at an answer even when the answer itself is incorrect".⁷

For the law the difference is one of timing. When a model only writes, the risk materializes when someone uses the text. When an agent acts, a risk can become an act before anyone has read anything.

III. Turkish Law Places Every Act on the Lawyer

A. The Reserved Functions Are Acts of a Person

Article 35(1) of the Attorneyship Law No. 1136 provides that "giving opinions on statutory and legal matters, bringing and defending the rights of natural and legal persons before courts, arbitrators or other bodies with judicial authority, following judicial proceedings and drawing up all documents relating to these matters belong solely to lawyers registered with a bar".⁸ The provision lists acts and assigns them to a person on the roll. A tool can prepare any of them. It cannot hold the function. Every opinion, filing or document that leaves the office therefore leaves as the act of the lawyer who releases it, whatever prepared it, and the lawyer cannot answer for it by pointing to the tool.

B. Care, Truthfulness and the Loss of Rights

Article 34 obliges lawyers to perform the duties they undertake "with care, truthfulness and honor" and to comply with the professional rules of the Union of Turkish Bar Associations (TBB).⁹ Since Law No. 7571 of December 24, 2025, Article 134 grounds every disciplinary sanction on conduct that departs from the honor of the profession, the trust the right of defense requires, or "the duties of care and truthfulness", and Article 135 ties each sanction to a list of acts.¹⁰ Two items of the reprimand list describe the characteristic failures of an agent better than any invented citation does: failing to inform the client of the stages of a matter in a way that defeats the exercise of a right granted by law (Article 135(2)(l)), and causing a loss of rights by breaching the duty of care in the matters one handles (Article 135(2)(m)). An electronic notification read and not acted on, a time limit counted from the wrong day, a client not told of a decision: none of these is excused because a system read the notification, counted the days or drafted the message. Even the duty to keep the matter file carries a sanction (Article 135(1)(l)), and what an agent prepares, files or sends is part of that file.

C. Before the Court

The Code of Civil Procedure No. 6100 requires the parties to act in good faith and to state the facts on which their case rests truthfully (Article 29), and it provides that the judge applies Turkish law ex officio (Article 33).¹¹ The court must find the law itself, and a decision that does not exist binds no one. That protects the judgment, not the client: a petition that rests on a decision that does not exist has lost the argument it was written to carry, and has spent the court's confidence in the lawyer who signed it. The Code's own sanction on counsel, the disciplinary fine of Article 329(2), is tied to bad faith and to suits brought without any right. An honest error does not meet that threshold, much as the English Divisional Court held that "mere negligence as to the falsity of the material is insufficient" for contempt.¹² The duty to verify therefore comes from Article 34, not from the court's reaction. The question has reached Turkish court files. In a dispute decided on appeal on July 14, 2026, the defendant had alleged in its answer that the claimant's petition was written with an AI engine and relied on a decision of the Constitutional Court that does not exist. The first-instance court and the regional court of appeal both decided the case on jurisdiction, and neither ruled on the allegation.¹³

D. Secrecy and the Security of Data

Article 36(1) of the Attorneyship Law forbids lawyers to disclose what was entrusted to them or what they learned by reason of their duties, and Article 135(2)(b) now punishes that disclosure with a reprimand.¹⁴ Rule 37(b) of the TBB Professional Rules requires the lawyer to take measures that prevent assistants, trainees and employees from acting against professional secrecy.¹⁵ The rule names people. Its purpose reaches whatever the lawyer runs in the lawyer's own name.

The Personal Data Protection Law No. 6698 adds three duties that bite directly on an agent. Article 12(1) requires the data controller to take "all necessary technical and administrative measures" to ensure an appropriate level of security against unlawful processing and unlawful access. Article 12(2) makes the controller jointly responsible for those measures with any person who processes the data on its behalf. Article 12(5) requires the controller to notify the data subject and the Personal Data Protection Board as soon as possible when processed data are obtained by others unlawfully.¹⁶ For an agent, everything it can reach lies inside the perimeter of the lawyer's measures, the provider that runs the model is a processor for whose measures the lawyer answers jointly, and data drawn out through planted instructions is a breach the law requires the lawyer to report.

E. Transfer Abroad

Where no adequacy decision exists, Article 9(4) of Law No. 6698, as amended in 2024, permits a transfer abroad only on one of the legal grounds of Articles 5 and 6, with enforceable rights for the data subject, and under an appropriate safeguard, among them a standard contract announced by the Board, which must be notified to the Authority within five working days of its signature (Article 9(5)).¹⁷ The exceptions of Article 9(6) are available only for incidental transfers, and the implementing regulation defines as incidental only transfers that are "not regular, occurring once or a few times, not continuous and not within the ordinary course of activity".¹⁸ An agent that sends client material to a model hosted abroad at each of its steps is the ordinary course of activity itself. Our earlier study set out the Authority's view that uploading client files to generative AI tools may amount to a transfer abroad.¹⁹ The same guide, announced on September 22, 2026 and prepared with the views and contributions of the TBB, goes further when it turns to security: in the use of these tools it calls for masking or anonymizing personal data as far as possible, keeping special categories of data out, sharing only the minimum the purpose requires, examining the tool's policies on retention, model training, human review, sub-processors and security, and "setting rules within the institution or law office on the use of these tools".²⁰

The law thus expects the lawyer to write rules. The next question is what a written rule does when the one who must follow it is a model.

IV. What Working Under Written Rules Shows

Where agents work under rules written by the responsible lawyer, five things become visible. Each is borne out by published research.

1. A written rule is followed often, not always. In τ-bench, a benchmark released in June 2024, agents were given a domain policy as their instructions and measured on simulated customer-service tasks. The best agent tested succeeded on more than 60 percent of the retail tasks on average, yet the probability that it would succeed on the same task in all of eight trials fell below 25 percent. Of its failures that the authors examined by hand, a quarter were wrong decisions in which it failed to apply the domain's rules, and when the policy was removed from its instructions altogether, its success in the retail domain fell only from 61.2 to 56.8 percent, which the authors read as a sign that the agents "may not actually be leveraging the policy documents to the extent possible".²¹ A separate line of research found that language models use long inputs unevenly: performance "is often highest when relevant information occurs at the beginning or end of the input context, and significantly degrades when models must access relevant information in the middle of long contexts, even for explicitly long-context models".²² A rule set among hundreds of pages of a matter competes with them for the model's attention. The figures belong to the systems measured. The property they reveal belongs to the method: a rule given to a model as text is one input among many, and its observance is a matter of probability. The security field draws the conclusion in so many words: "Implement authorization in downstream systems rather than relying on an LLM to decide if an action is allowed or not."²³ An instruction tells the agent what it should do. It cannot be what assures the client that something will not be done.

2. The agent's account is a claim, not a record. The authors of τ-bench did not ask their agents whether they had succeeded. They compared "the database state at the end of a conversation with the annotated goal state".²⁴ For the law the point is old. Whether an act was done is shown by the record of the act, not by an account of it. The agent's report that it filed, sent or checked is one more output of the model, open to the confabulated reasoning that NIST describes as a known failure.

3. Whatever the agent reads can speak to it. The indirect injection research and the OWASP list show that a document from outside can carry instructions that steer the agent and need not be visible to a person.²⁵ A letter from the other side, a counterparty's contract or a page found on the web is therefore material to be examined and never a source of instructions. This is where the duty of Article 36 and the security measures of Article 12 meet a machine that reads.

4. The agent's reach is the breach's reach. OWASP's mitigations for excessive agency are to minimize the agent's functions and permissions and to require a human to approve high-impact actions. Its own example is a mail assistant that needs only to read but is given a tool that can also send, and a planted message that makes it forward the user's sensitive mail to an attacker. The remedies it names are a read-only tool, a read-only permission and "requiring the user to manually review and hit 'send' on every mail drafted by the LLM extension".²⁶ For a lawyer, the reach of an agent is therefore part of the security measures that Article 12 of Law No. 6698 requires.

5. The better the agent, the weaker the review. Automation bias is the tendency to over-rely on automated advice. A systematic review in the Journal of the American Medical Informatics Association screened 13,821 papers and included 74. In four pooled studies in health care, erroneous advice from a decision support system made an incorrect decision more likely than in control groups without the system (risk ratio 1.26, 95 percent confidence interval 1.11 to 1.44). Complacency rose when a system was highly but not perfectly reliable, and workload, task complexity and time pressure increased reliance. Among the factors that reduced it were users' own sense of accountability, training, and systems that present information rather than recommendations.²⁷ NIST names the same risk for generative AI: "due to the complexity and increasing reliability of GAI technology, over time, humans may over-rely on GAI systems".²⁸ The finding cuts against intuition. The review is weakest exactly when the agent has become good enough to be trusted.

V. The Release as the Point of Law

A. Human Review as a Legal Fact

European law has begun to attach legal consequences to human review itself. Under Article 50(4) of the EU Artificial Intelligence Act, applicable since August 2, 2026, a deployer that publishes AI-generated text to inform the public on matters of public interest must disclose that the text was generated, but not "where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content".²⁹ For high-risk systems, Article 14(4)(b) requires that the persons who oversee the system be enabled "to remain aware of the possible tendency of automatically relying or over-relying on the output", naming the phenomenon in the text of the statute: "automation bias".³⁰ The law of the legal profession has always worked this way. The signature and the release are the facts that make a text the lawyer's. The research of the previous section is the reason that fact must be something more than a click.

B. Measures, Not Guidance

In a judgment of June 6, 2025, the Divisional Court of the High Court of England and Wales, dealing with two referrals listed together under its jurisdiction to enforce the duties lawyers owe to the court, held that freely available generative AI tools "are not capable of conducting reliable legal research", that those who use them have "a professional duty therefore to check the accuracy of such research by reference to authoritative sources", and that "practical and effective measures must now be taken by those within the legal profession with individual leadership responsibilities", adding that in future hearings the court would inquire whether those responsibilities had been fulfilled.³¹ In one of the two matters, 18 of the 45 citations put before the court did not exist, and the court warned that, save in exceptional circumstances, public admonishment alone is unlikely to be a sufficient response.³²

Turkish law reaches the same place by its own route. The Authority asks law offices for internal rules on these tools, Rule 37(b) asks the lawyer for measures over those who work under the lawyer's direction, and Article 12(1) of Law No. 6698 asks for technical as well as administrative measures. Read with the findings of Section IV, these texts point to one conclusion: a rule written for the agent is guidance, and a measure is something that holds whatever the agent does. The duty is met by the second.

C. What the Research Asks of a Review

The automation bias research names what weakens a review and what strengthens it. Workload, task complexity and time pressure increase reliance on the system. The reviewer's own sense of accountability, and systems that present information rather than recommendations, reduce it. Article 34 already places that accountability on the lawyer by name. The law does not prescribe how a practice gives its review that form. It asks that the review be real, and the research shows that a review is real only when it is built to resist the pull of a reliable machine.

VI. Conclusion

Agents do not change who is responsible. They change how much depends on the moment of release. Turkish law already places each act on the lawyer, from the reserved functions of Article 35 to the sanctions of Article 135, from the security and transfer duties of Law No. 6698 to the duties owed to the court under the Code of Civil Procedure. The research shows that the moment of release is where human judgment fails most quietly, and that it fails most when the systems are good. A practice that runs on agents does not meet its duties by writing them into the agent's instructions. It meets them by controls that hold whatever the model does, by checking every statement and every effect against the primary record, and by keeping the release a real review. Writing the rules is the lawyer's work. Their enforcement cannot be left to the model.