Artificial Intelligence and Legal Technology in the Legal Profession: The Statutory Reserve, Professional Secrecy and the Duty to Verify

Avukatlık Mesleğinde Yapay Zeka ve Hukuk Teknolojileri: Kanuni Tekel, Meslek Sırrı ve Doğrulama Yükümlülüğü

Av. Serkan KARA¹

Published October 21, 2026

INTRODUCTION

The meeting of law with computing and statistical method is not a new subject. In 1949 Loevinger proposed an approach he called 'jurimetrics', which he defined as 'the scientific investigation of legal problems'.² For most of the seventy years that followed, the machine stood at the edge of legal practice: it stored statutes and decisions, and it searched them. What has changed in recent years is that large language models, systems that write fluent legal prose on request, have moved to the center of a lawyer's daily work. They draft the petition and the legal opinion, summarize the file, translate the foreign document and propose the case law. A lawyer can now receive in seconds a text that looks like the work of a colleague, and that may contain a decision no court ever gave.

In the Turkish doctrine this development has been examined mainly through the question whether Articles 35, 48 and 63 of the Attorneyship Law stand in the way of legal technology.³ That question concerns the market for legal services: who may offer them and by what means. This article asks a different question, which concerns the lawyer. By which duties does the law in force frame the AI tools that a lawyer uses today, and where does that law leave a gap? It submits that the answer lies less in the provisions on the statutory reserve than in the duties of care, truthfulness and secrecy, in the rules on the processing and transfer of personal data, and in the way these tools work. The texts examined contain no provision that forbids a lawyer to use such tools. Every sentence a tool produces, however, remains the lawyer's responsibility, under the professional rules, under private law and before the court. The one point at which the law in force gives no answer is the disclosure of professional secrets to the technical service providers on whom every use of these tools depends, and for that point the article proposes a statutory rule.

The method is doctrinal and interdisciplinary. The norms are analyzed together with the technical operation of the systems they govern, because a legal rule applied to a tool presupposes an accurate account of what the tool does. The legislation, the judicial decisions and the institutional texts were read in their primary sources. Turkish legislation and case law were read in the Ministry of Justice's legislation and case-law program (UYAP Mevzuat ve İçtihat), the European Union texts in EUR-Lex, the German legislative materials in the publications of the Bundestag and in the Federal Gazette as filed by the library of the Federal Court of Justice, and the doctrine and guidance from their publishers. The Turkish version of this article, published on 15 October 2026, took its sources as they stood on that day. For this English version every source was read again on 20 and 21 October 2026, the texts that change over time were downloaded again on those days, and the analysis was extended by the private-law, criminal-law and comparative sources that the Turkish version did not yet treat. The technical propositions are confined to the settled mechanisms by which language models work, and a figure is given only with its source, its sample and its date. The subject is the lawyer's use of AI in the lawyer's own professional work. Services that providers who are not lawyers offer directly to the public are treated only so far as is needed to draw the boundary of that work. Translations from Turkish, German and French are the author's.

Part I discusses the literature and identifies the point at which this article departs from it. Part II sets out the conceptual and technical framework. Part III reads the Turkish law in force: the statutory reserve, the duties of care and truthfulness under professional law, private law and procedure, professional secrecy, personal data protection, the ban on intermediaries and the new disciplinary law. Part IV compares the European Union, the Council of Europe, France, Germany, the United States and the United Kingdom. Part V sets out the proposals, and the conclusion answers the research question.

I. THE STATE OF THE LITERATURE

A. The Turkish Doctrine

The Turkish literature on AI and law has developed in three strands, and each has asked a different question. The first strand, written before generative models reached legal practice, asked what the machine is. Bak, examining the legal status of AI and liability for its use under civil law, took the European Parliament's recommendations on civil law rules on robotics as a point of reference. Those recommendations proposed an electronic personhood and a special form of strict liability. Bak observed that the recommendations were not binding and could not end the doctrinal debate, but showed the direction other states might take, and stressed that any concrete proposal had to take account of the ethical dimension of AI.⁴ Zeytin and Gençay examined the same question of the electronic person and added a second one: how law as a discipline can be supported by AI systems. They designed, for the statutory matrimonial property regime, a system that applies the rules by legal logic. In their view a system designed as decision support raises little difficulty where the final decision is left to the judge or the lawyer, whereas an electronic lawyer or judge raises the difficulty of giving a machine the human capacities of interpretation and conscience. They concluded that the electronic lawyer should be a structure 'able to reach a decision alone but unable to give it alone', necessarily subject to human assessment.⁵

The second strand, written as legal technology entered the market, asked whether the profession's own law stands in its way. Bilgin, examining the technological tools used in legal services and their effects on the profession, concluded that these tools do not offend the statutory reserve and are not capable of weakening the profession, and that lawyers would do better to treat them as working partners than as adversaries. On consumer tools Bilgin went further. Discussing the German litigation over an online contract generator, Bilgin described as unfounded the view that automated services sold online must be closely supervised by lawyers to protect consumers, and held that forbidding consumers to use such tools, or forcing them to consult a lawyer, would exceed the purpose of the lawyers' monopoly.⁶ On secrecy, Bilgin held that a lawyer who uses a cloud-based tool must examine the third-party provider before using it and settle the conditions on which the client's data will be processed: the location of the servers, the identity of the staff who can reach the data, the procedures for backup and breach, and the reasonable efforts that prevent unauthorized access.⁷ Bilgin also warned that tools built on biased decisions and opaque algorithms can reproduce discrimination.⁸ Araalan, writing at the end of 2025, read Articles 35, 48 and 63 of the Attorneyship Law as obstacles to AI-supported legal technology and made three proposals: a sentence in Article 48 that would exclude platforms which take no share of the fees between lawyers, a provision on the American model that would open the use of AI to lawyers while holding them responsible for confidentiality and data, and a statutory list stating which act draws which disciplinary sanction.⁹

The third strand, of 2026, asks how the use of AI can be governed. Karataş Durmuş and Cebeci Çorum found that neither Turkish nor EU law yet has a comprehensive and uniform regime of liability for erroneous decisions of AI, that recent decisions show a strong tendency to treat human oversight as indispensable, and that AI should be placed as a supporting tool within a framework whose ethical principles, transparency and liability are made clear. They added that the dependence of most tools on language models of foreign origin creates further risks for the precision of legal language, and called for Turkish language models and legal dictionaries.¹⁰ Tatar argued that the AI literacy obligation of the EU AI Act is a binding and horizontal legal duty that reaches actors in third countries in practice, and that Türkiye should promote it through soft law as the ground for binding rules to come.¹¹

B. Professional Guidance and Empirical Research

The professional bodies abroad have addressed the lawyer's duties more directly than the Turkish doctrine. The American Bar Association's Formal Opinion 512 of 29 July 2024 reads generative AI against the duties of competence, confidentiality, communication with the client, supervision, candor toward the tribunal and reasonable fees.¹² The Council of Bars and Law Societies of Europe (CCBE), in its guide of 2 October 2025, names confidentiality and competence as the most important of the principles engaged. It advises lawyers to 'refrain from entering any personal, confidential or other data related to the client into the user interface of the GenAI ... unless there are appropriate safeguards in place', describes competence as encompassing 'the obligation to become knowledgeable about a technical product to be used for professional activities', and adds independence, which bias and the sycophancy of models put at risk, and transparency toward the client where an informed client would object to the use.¹³ In Türkiye the Personal Data Protection Authority published a guide on generative AI in November 2025¹⁴ and a guide for lawyers announced on 22 September 2026, which treats the uploading of client files to generative AI tools as a possible transfer of personal data abroad.¹⁵

The empirical literature measures how far the output of these tools can be trusted in legal work. Dahl and others put direct, verifiable questions about randomly selected United States federal cases to general-purpose language models and found that the models 'hallucinate at least 58% of the time', with the highest rate at 88 per cent for one model. They also found that the models 'often uncritically accept users' incorrect legal assumptions', a behavior the authors call contra-factual bias, and that the models systematically overestimate their own confidence.¹⁶ Magesh and others then tested legal research tools of two major providers that retrieve documents before they answer and claimed on that basis to avoid hallucinations. The tools produced false information less often than a general-purpose model but still 'each hallucinate between 17% and 33% of the time'.¹⁷ An older study, often cited in the literature on prediction, compared a statistical model with legal experts in forecasting the decisions of the United States Supreme Court.¹⁸ Its findings are discussed in Part II, because the way the Turkish doctrine has reported it shows how a figure loses its meaning when it is separated from what was measured.

C. The Point of Departure

The literature has thus asked whether the machine can bear rights and liability, whether the profession's law allows the tool, how the use of AI should be governed in general, and how reliable the tools are. Three questions remain open in Turkish law. The first is which of the duties already in force settle on the lawyer who uses a generative tool, and how the professional duty of care relates to the private-law duty of care of the Code of Obligations, which the Court of Cassation applies to lawyers with particular strictness. The second is how the criminal law and the data protection law reach the lawyer who enters client information into a provider's system. The third is whether Turkish law permits a lawyer to disclose professional secrets to a technical service provider at all. This article takes up the three questions. On the statutory reserve it agrees with Bilgin and departs from Araalan: the reserve does not bar the tool, it fixes the person who answers for it. On consumer services it narrows Bilgin's argument, which was made for generators that assemble standard clauses, and holds that a system producing an assessment specific to the user's facts stands on the other side of the line the German courts drew. On secrecy it shows that the gap cannot be closed by a professional rule or a general permission on the American model, because it is a gap in statute law, and it proposes a statutory solution on the model that the German legislature adopted for the same problem in 2017.

II. CONCEPTUAL AND TECHNICAL FRAMEWORK

A. The Legal Definition: Autonomy and Adaptiveness Are Not Required Elements

The EU Artificial Intelligence Act (the AI Act) defines an AI system as 'a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments'.¹⁹ The words 'may exhibit' matter. According to the recitals, the adaptiveness that a system could exhibit after deployment 'refers to self-learning capabilities, allowing the system to change while in use', a capability the definition admits but does not require.²⁰ The OECD, too, revised its definition of 2019 on 8 November 2023 and added to it that 'Different AI systems vary in their levels of autonomy and adaptiveness after deployment'.²¹

This finding requires the legal analysis to part company with approaches that treat autonomy or self-learning as the distinguishing mark of AI, and it explains why the first strand of the Turkish literature, which asked about the personhood of an autonomous machine, does not reach the tools in use today. Most of the tools a lawyer uses are not systems that change themselves with each query, still less agents with a will of their own. They are instruments that produce text on request. What matters in law is therefore what the tool produces, in whose name and on whose responsibility the product is used, and what information is entered into the tool.

B. How a Large Language Model Works and What Follows for Legal Text

1. Text Generation and Non-Existent Case Law

A large language model produces the continuation of the text it is given by computing, at each step, a probability distribution over the next unit of text and choosing from it. No operation that checks whether a judgment exists or whether a provision is in force forms part of that process of generation. The model can produce a citation in the form common in legal texts simply because that form is statistically regular in the texts on which it was trained: a chamber, a docket number, a decision number and a date follow one another in a familiar pattern. A citation to a judgment that does not exist, yet is flawless in form, is therefore not an accidental malfunction of the system but an expected type of error. The Personal Data Protection Authority likewise states that even systems trained on high-quality and representative data can produce content that is detached from its context or untrue, that such output is called hallucination, and that the accuracy and quality of the training data can reduce the likelihood of it but cannot wholly prevent it.²² The study of Dahl and others adds two properties that make the error harder to see. The models accept a false premise in the question and build on it, and they are most confident where they should be least.²³ A lawyer who asks a model to confirm a ruling that does not exist may thus receive a fluent confirmation.

This risk reached a court in the United States in Mata v Avianca. The court found that the lawyers had put into their filing non-existent decisions produced by an AI tool and had continued to stand by them after their existence was called into question. It opened its sanctions order with a distinction that is still the clearest statement of the problem: 'there is nothing inherently improper about using a reliable artificial intelligence tool for assistance. But existing rules impose a gatekeeping role on attorneys to ensure the accuracy of their filings.'²⁴ A penalty of USD 5,000 was imposed on the lawyers and their firm jointly and severally.²⁵ The sanction was mild. The lesson the court drew from it was not: the tool may be used, and the lawyer remains the gate.

2. Retrieval-Grounded Generation and Its Limit

The common way to reduce this error is for the system to retrieve the relevant texts from a document base before it answers, and to base its answer on them. The method reduces the error because it brings into the context information the model lacks or holds only in an outdated form, but it does not remove it. The document retrieved may be wrong, the right document may not be retrieved, or the model may misread the right document or attribute to it what it does not say. The study of Magesh and others is the measurement of that limit. Its dataset of 202 queries was preregistered before the queries were run, and the tools were tested in the versions available between March and May 2024. The tools of both providers produced false information in between 17 and 33 per cent of queries, although their providers had presented the method as eliminating or avoiding hallucinations.²⁶ These figures belong to those tools, that period and that set of questions, and later versions may do better or worse. The lesson they carry is lasting: relying on documents does not lift the burden of verification, and a provider's claim about its method is a claim, not a measurement.

One technical point is specific to Turkish legal texts. In scanned documents, optical character recognition damages searches for concepts when it confuses letters such as ı and i or ş and s, and it damages article and docket numbers when it confuses digits and signs, or when the citation of a decision is cut away from its text as the document is divided into passages for retrieval. Exact identifiers such as article and docket numbers are found reliably by literal matching rather than by search based on similarity of meaning. A search that combines the two methods is therefore better suited to Turkish legal text than a search by meaning alone. For the same reason, how useful a tool is in Turkish law can be known only by measuring it on Turkish primary texts, and not from general claims of success measured on another language and another legal system. The concern Karataş Durmuş and Cebeci Çorum raised about models of foreign origin and the precision of Turkish legal terminology points in the same direction.²⁷

3. The Question of Learning in Use

Contrary to a common belief, the parameters of a language model in service do not change with each query. They remain the same unless the provider carries out a new training. A service that keeps the chat history and uses it as context in later answers, or a firm that gathers all its files in one search index, is not learning either. It is storing data. These layers can, however, become channels through which one client's information surfaces in another client's matter, and such an outcome is a legal problem under the duty of secrecy in Article 36 of the Attorneyship Law. What decides the fate of the information a lawyer enters into a tool is not whether the model learns but where the provider processes the information, how long it keeps it, who can reach it and whether, under the contract, the provider uses it in later training. That is a legal question rather than a technical one, and its answer is to be found in the contract, in the provider's data processing terms and in Law No 6698. The ABA requires the client's informed consent before client information is entered into a tool that may disclose it to later users,²⁸ and the CCBE warns that users may unknowingly contribute input data that retrains the model.²⁹

4. Instructions Inside Documents

A language model processes the instruction it is given and the document it is asked to examine within one and the same sequence of text. Words written to steer a model that will read a document can therefore be placed in a document that comes from the other side. The study that named this attack indirect prompt injection found that applications which integrate language models 'blur the line between data and instructions',³⁰ and the security literature adds that such instructions 'do not need to be human-visible/readable, as long as the content is parsed by the model'.³¹ The consequence is not only a wrong summary. In tools that can reach e-mail, document management or other files and can act on their own, a hidden instruction can lead to information in other files being sent out. Its legal meaning is plain. The document the model reads is data to be examined and not an instruction, and every file such a tool can reach is an area in which a secret can be disclosed. A letter from opposing counsel, a contract proposed by the other side and a page found on the web are therefore, for the lawyer's measures of security, material from outside the office.

5. Prediction Tools: What Is Measured

Tools that predict the outcome of judicial decisions are often illustrated by a United States study of 2004. In that study a statistical model built on the 628 cases that the same composition of the Supreme Court had decided before the 2002 Term forecast the outcomes of that Term's cases in advance and was right in 75 per cent of them, while the collective accuracy of the legal experts remained at 59.1 per cent.³² As the authors themselves stress, 'the statistical model disregards information about the specific law or facts of the cases'.³³ The result shows that predicting outcomes is not legal reasoning. A model that knows nothing of the law can forecast well where the decision-makers are stable and their tendencies known, and it can say nothing about why a case should be decided one way. A tool's claim of accuracy, too, carries meaning only when it is measured on a sample of known size that resembles the lawyer's own work. For a proportion measured on a test of one hundred questions with two possible answers, the 95 per cent confidence interval is at its widest about plus or minus 10 points.³⁴ A difference of a few points between two tools can therefore lie within the noise of measurement, and two tools should be compared with a paired test on the same questions. More important still is that the questions represent the lawyer's real distribution of work, because a test that does not represent it misleads whatever its size.

C. The Legally Relevant Distinction Within Legal Technology

Classifications that divide legal technology into successive generations have descriptive value, but the distinction that produces legal consequences lies elsewhere. It turns on whether a system applies the law to the user's own facts. The first group consists of document generators, which assemble standard clauses written in advance according to the user's answers. The German Federal Court of Justice did not treat such a contract generator as a legal service. It held that the provider does not act in a concrete matter of the user, that the user's individual circumstances beyond the usual case are not taken into account, much as in a book of forms, and that the user therefore expects no legal examination of the user's concrete case.³⁵ The litigation had run the other way at first instance: the Regional Court of Cologne had found that the product carried a decision mechanism capable of producing legal effects and that its advertising suggested a quality equal to a contract drafted by a lawyer, before the Higher Regional Court of Cologne and the Federal Court of Justice held that no examination of an individual case took place.³⁶ The criterion of the final decision is the examination of the concrete case. The second group consists of systems that produce, for the user's concrete question, a legal assessment specific to that case. These resemble a legal opinion more than a book of forms, and in Turkish law they come close to the field of Article 35 of the Attorneyship Law. The third group consists of systems that support a court's decision-making. The AI Act classifies as high-risk the systems 'intended to be used by a judicial authority or on their behalf to assist a judicial authority in researching and interpreting facts and the law and in applying the law to a concrete set of facts, or to be used in a similar way in alternative dispute resolution'.³⁷ Even there the Act exempts a system that does not pose a significant risk of harm to fundamental rights, 'including by not materially influencing the outcome of decision making'.³⁸ The legislature's criterion is again the influence of the system on the decision of a concrete case.

III. THE FRAMEWORK IN FORCE IN TURKISH LAW

A. The Statutory Reserve: Articles 35 and 63 of the Attorneyship Law

Under Article 35(1) of the Attorneyship Law, 'giving opinions on statutory and legal matters, bringing and defending the rights of natural and legal persons before courts, arbitrators or other bodies with judicial authority, following judicial proceedings and drawing up all documents relating to these matters belong solely to lawyers registered with a bar'.³⁹ The third paragraph of the same Article provides that 'anyone with capacity to sue may draw up the documents of their own case, bring their case in person and follow their matter'.⁴⁰ Article 63(1) provides that persons not registered on a bar's roll and lawyers prohibited from practice may not draw up case documents that do not concern themselves and may not exercise the other powers that belong to lawyers, and its second and third paragraphs attach an administrative fine and, for the collusive assignment of claims, imprisonment.⁴¹ The reserve serves the purposes stated at the head of the Law. Advocacy is a public service and a free profession, and its purpose is to secure the regulation of legal relations, the resolution of legal disputes in accordance with justice and equity, and the full application of the rules of law.⁴²

These provisions do not regulate which tool a lawyer may use. They regulate to whom a function belongs. When a lawyer uses an AI tool in preparing an opinion, the one who gives the opinion is still the lawyer, and the opinion is the lawyer's act in the sense of Article 35(1) whatever prepared its text. Araalan reads Articles 35 and 63 as an obstacle to AI-supported legal technology.⁴³ It is submitted that, as regards the lawyer's own work, the provisions point the other way. What they prohibit is that someone who is not a lawyer, directly or through a system that person operates, gives third parties an opinion in their concrete matters or draws up their case documents. Precisely because the reserve does not exclude the tool, it fixes the act of the tool on the lawyer who uses it. The case law of the Court of Cassation reads the reserve by the acts it lists. In a case concerning the owner of a consultancy company who referred clients to a lawyer working under the company's roof, the 19th Criminal Chamber held that the defendant had performed none of the acts listed in Article 35, and that the trial court should instead have examined whether the referrals amounted to intermediation for a fee or a benefit under Article 48.⁴⁴ In 2026 the 12th Criminal Chamber, on an application in the interest of the law, set aside the dismissal of an objection to a decision not to prosecute a company whose staff, without authority to practice, were alleged to have acted in matters reserved to lawyers, to have obtained powers of attorney from accident victims and to have advertised the activity, and it listed the evidence that an effective investigation had to gather.⁴⁵ The reserve is enforced against those who perform the reserved acts without being lawyers. It does not reach the lawyer's choice of instruments.

The provider who offers a tool to the public is a different matter. Article 35(3) protects only a person's own act in that person's own case. Someone who writes their own petition with a tool stays within that field. That does not, however, make lawful the activity of a provider who offers the tool to the public and produces, for each user, a legal assessment of that user's facts. Bilgin's argument against restricting consumer tools was made for generators that assemble standard clauses, and on that ground it agrees with the German decision. A generative system that reads the user's facts and answers the user's legal question performs the very examination of the concrete case whose absence decided the German litigation. In the author's view such a service, offered directly to consumers, falls as regards the provider within the field of Articles 35(1) and 63(1). The subject of this article, however, is the lawyer's own work, and there the statutory reserve works less as a wall that keeps technology out than as an anchor that fixes the person who bears responsibility for the output. The regulator that authorized the first AI-driven law firm in England and Wales set the same condition: the system takes no step without the client's approval, it does not propose case law, and named regulated solicitors remain accountable and are responsible for all its outputs.⁴⁶

B. The Duties of Care and Truthfulness: Verification

1. The Professional Duty

Under Article 34 of the Attorneyship Law, lawyers are bound 'to perform the duties they undertake with care, truthfulness and honor befitting the sanctity of that duty ... and to comply with the professional rules laid down by the Union of Turkish Bar Associations'.⁴⁷ The Professional Rules of the Union of Turkish Bar Associations (TBB) likewise require lawyers to carry out their professional work with complete fidelity to it, and not to accept a matter that their time and abilities cannot reach.⁴⁸ The second rule has a quiet application to AI. A lawyer who accepts a matter in a field the lawyer does not know, trusting a tool to supply the knowledge, accepts a matter that the lawyer's own abilities cannot reach, because the lawyer cannot judge what the tool supplies.

2. The Private-Law Standard: The Prudent Lawyer

The lawyer's relationship with the client is a contract of mandate, and the Turkish Code of Obligations sets its standard. Under Article 506 the agent must perform the mandate personally, may have the work done by another only where authorized or where necessity or custom allows, must carry out the work with loyalty and care in view of the client's legitimate interests, and is measured, in determining liability for breach of the duty of care, against 'the conduct required of a prudent agent who undertakes work and services in a similar field'.⁴⁹ The Court of Cassation applies this standard to lawyers with particular strictness. Its Assembly of Civil Chambers recalled in 2023 that the Code had replaced the old reference to the employee's liability with the standard of the prudent agent, following the criticism that an agent must show more care than an employee, held that the lawyer's duty of care is heavier and wider than that of an ordinary agent because Article 34 of the Attorneyship Law is a special provision laid down for a profession that is a public service, held that the lawyer must examine the time limits that can cause a loss of rights, and stated that there is no doubt that the lawyer is liable to the client for even the slightest fault, while the duty is one of conduct and not of result.⁵⁰

Three consequences follow for the use of AI. First, using a tool is not having the work done by another in the sense of Article 506(1). The tool is not a person, and the lawyer who uses it still performs the mandate personally. For the same reason the rules on substitution (Article 507) and on liability for auxiliaries (Article 116), which speak of persons to whom the work or its performance is entrusted, do not describe the lawyer's position.⁵¹ The lawyer does not answer for the tool as for a substitute chosen with care. The lawyer answers for the lawyer's own performance, of which the tool's output becomes a part the moment it is used. Second, the measure of that performance is the prudent lawyer. A prudent lawyer who knows that a language model produces non-existent decisions as an expected error, and that the best specialized tools measured still did so in up to a third of queries, verifies every decision before relying on it. Relying on an unverified output is therefore not a slight fault excused by the tool's reputation but a departure from the standard the Code sets. Third, the client cannot be asked to bear the risk in advance. Under Article 112 the debtor who fails to perform properly must prove that no fault can be attributed to the debtor, and under Article 115(3) an agreement made in advance that excludes liability even for slight fault is void where the service or profession can be practiced only with a permit granted by law or by the competent authorities.⁵² Advocacy is such a profession. A clause in an engagement letter by which the client accepts in advance the errors of the AI tools the lawyer uses would therefore be void to the extent that it excludes liability for slight fault. That result coincides with the ABA's view that a general, boiler-plate provision in an engagement letter is not enough for the client's informed consent, which Part III.C discusses.

3. The Duties Owed to the Court

The Code of Civil Procedure requires the parties to act in good faith and to state the facts on which their case rests truthfully.⁵³ The judge applies the law ex officio, so a decision that does not exist binds no one. That protects the judgment, not the client. A petition that rests on a decision that does not exist has lost the argument it was written to carry, and has spent the court's confidence in the lawyer who signed it. The question has reached Turkish court files. In a dispute decided on appeal on 14 July 2026, the defendant had alleged in its answer that the claimant's petition had been written with an AI engine and relied on a decision of the Constitutional Court that does not exist. The court of first instance and the regional court of appeal decided the case on jurisdiction, and neither ruled on the allegation.⁵⁴ The allegation was made as an argument against the claimant, which shows how quickly an unverified citation becomes a weapon in the other side's hands.

The duties of Article 34 and of the Code of Obligations therefore require the lawyer to verify the output of an AI tool against the primary source. Every decision cited in a petition is to be read, with the chamber that gave it, its docket and decision numbers and its date, from the official source that holds it. The current precedent-setting decisions of the Court of Cassation are available through e-Devlet in the Court of Cassation's Case-Law Center, which was opened to use on 13 December 2023. The Court's announcement states that the system adds related decisions to a search with AI support. That too is a tool, and the decision it retrieves must still be read.⁵⁵ For legislation, the Official Gazette and the Ministry of Justice's legislation program are the reference. Abroad the same conclusion has been reached in the same words. ABA Formal Opinion 512 holds that relying on a tool's output without an appropriate degree of independent verification could violate the duty of competent representation,⁵⁶ and the Divisional Court of England and Wales has held that freely available generative tools 'are not capable of conducting reliable legal research', so that those who use them have 'a professional duty therefore to check the accuracy of such research by reference to authoritative sources'.⁵⁷

4. The Disciplinary Sanction

Article 134 of the Attorneyship Law, as recast by Law No 7571, grounds every disciplinary sanction on conduct that does not conform to the honor and title of the profession, to the respect and trust that the sanctity of the right of defense requires, or to the duties of care and truthfulness, and Article 135(2)(m) makes 'causing a loss of rights by breaching the duty of care in the matters one handles' an act punished by reprimand.⁵⁸ Causing a client a loss of rights by relying on an unverified AI output is a typical case that may fall under that provision. Before 2025 the same conduct would have been judged under general clauses. Since Law No 7571 it has its own item in the list, and the private-law liability, the procedural consequences and the disciplinary sanction now rest on the same duty.

C. Professional Secrecy

Under Article 36(1) of the Attorneyship Law, lawyers are forbidden 'to disclose matters entrusted to them or learned by reason of their duties as lawyers or their duties in the organs of the Union of Turkish Bar Associations and of the bars'.⁵⁹ The TBB Professional Rules, after stating that the duty of secrecy has no time limit and that leaving the profession does not end it, require the lawyer to take 'measures that prevent assistants, trainees and the persons the lawyer employs from acting contrary to professional secrecy'.⁶⁰ Article 135(2)(b), introduced by Law No 7571, makes the disclosure of matters learned by reason of a lawyer's duties an act punished by reprimand.⁶¹

The criminal law adds two layers. Article 239(1) of the Turkish Criminal Code punishes, on complaint, a person who gives to unauthorized persons or discloses information or documents in the nature of a commercial secret, a banking secret or a customer secret, known to that person by reason of status, duty, profession or art.⁶² Article 136(1) punishes whoever unlawfully gives personal data to another, and Article 137(1)(b) increases the penalty by half where the offense is committed by taking advantage of the facility a profession provides. Both are offenses of intent: an offense requires intent, and negligent acts are punished only where the law expressly says so.⁶³ A lawyer who uploads a client's file to a tool without knowing where it goes therefore does not commit these offenses by negligence alone. The threshold matters for the lawyer who knows. A lawyer who has read the provider's terms, knows that inputs are used for the provider's own purposes and uploads the client's data anyway can no longer rely on the absence of intent, and the professional character of the act would aggravate any offense found.

Entering a client's information into the system of an outside service provider may thus amount to disclosing the secret to a third party, unless a legal framework that protects the information has been established between the provider and the lawyer. Bilgin's list of what the lawyer must examine before using a cloud-based tool states the minimum of that framework. The duty to take measures in Rule 37(b) is written for the persons the lawyer employs, but its purpose also guides the lawyer's dealings with the technical service providers through which the lawyer's work is done. In the United States the same result is reached through ABA Model Rule 5.3. The comment to the rule asks the lawyer to use services outside the firm, including 'an Internet-based service to store client information', in a manner compatible with the lawyer's professional obligations and with regard to 'the terms of any arrangements concerning the protection of client information'.⁶⁴ ABA Formal Opinion 512 further stresses that, where the client's consent is required, it cannot be obtained by 'merely adding general, boiler-plate provisions to engagement letters'.⁶⁵

Secrecy and personal data are not the same thing. A company's trade secret may not be personal data, but it is protected by Article 36 of the Attorneyship Law and, in the case of a customer secret, by Article 239 of the Criminal Code. A client's name, on the other hand, may be both personal data and a secret. The use of a tool must therefore be assessed separately under each regime, and compliance with one does not secure compliance with the other. A standard contract under Law No 6698 can make a transfer of personal data lawful, but the texts examined contain no provision of Turkish statute law that expressly allows a lawyer to share professional secrets with an independent technical service provider. Rule 37(b), too, names only assistants, trainees and the persons the lawyer employs. This is the gap noted in the introduction. It is a gap in statute law, because Article 36 is a statutory prohibition, and neither a professional rule nor a client's consent given in general terms can fill it. Until it is filled, the safest course is that content in the nature of a secret should not enter an outside system at all, and that, where it must, the client's specific and informed consent should be obtained for that use.

D. Personal Data Protection

Law No 6698 defines the data controller as the person who determines the purposes and means of processing, and the data processor as the person who processes personal data on the controller's behalf on the authority the controller gives.⁶⁶ The Authority's guide for lawyers treats a lawyer who practices independently as the controller for the processing carried out in the lawyer's professional work, because it is the lawyer who decides the purpose and scope of that processing in line with the lawyer's professional competence, ethics and legal responsibilities.⁶⁷ A provider that processes the client data entered into its tool only to return the answer acts on the lawyer's behalf and is a processor. A provider that also uses the inputs for purposes of its own, such as training its models, determines those purposes itself and cannot be a mere processor for that use. The distinction decides which duties the lawyer must secure by contract.

The Law makes it mandatory that personal data be processed in a way that is connected, limited and proportionate to the purposes for which they are processed.⁶⁸ Under Article 9, as amended in 2024, personal data may be transferred abroad where one of the conditions of Articles 5 and 6 is met and there is an adequacy decision for the country of destination. Where there is no adequacy decision, one of the appropriate safeguards is needed, for example a standard contract announced by the Personal Data Protection Board, together with the data subject's ability to exercise rights and seek effective remedies in the country of destination. The standard contract must be notified to the Authority within five working days of its signature.⁶⁹ The exceptions available where there is neither an adequacy decision nor a safeguard apply only to incidental transfers, and the implementing regulation treats as incidental only transfers that are 'not regular, occurring once or a few times, not continuous and not within the ordinary course of activity'.⁷⁰ Use of a tool that has become ordinary in a lawyer's work does not fall within that definition.

The Authority's guide for lawyers, prepared according to the Authority's own announcement with the views and contributions of the TBB, accepts this conclusion expressly. Uploading a file or document containing personal data to an AI tool should not be regarded merely as obtaining technical support or carrying out legal research, and it should be borne in mind that, in view of the tool's technical infrastructure, its data retention policy, the country in which the provider is established, the location of the servers and the location of the sub-providers, the upload may constitute a transfer of personal data abroad. The guide asks the lawyer to examine the tool's terms of use, privacy policy, data processing terms, the statements on where data are stored and processed, the provisions on sub-processors and the transfer mechanisms. Even where the provider is established in Türkiye and processes the data there, the guide adds, a transfer within the meaning of Article 8 may be in issue.⁷¹ The Authority's guide on generative AI likewise recommends that outputs be monitored regularly and supported by human oversight where needed.⁷²

The duties of security complete the picture. Article 12(1) requires the controller to take all necessary technical and administrative measures to ensure an appropriate level of security, Article 12(2) makes the controller jointly responsible with the processor for those measures, and Article 12(5) requires the controller to notify the data subject and the Board as soon as possible when processed data are obtained by others unlawfully.⁷³ A breach at the provider is therefore also the lawyer's breach to report, and a document that steers the tool to send data out, as described in Part II, can lead to exactly the unlawful acquisition that Article 12(5) addresses. On this footing there is a legally significant difference between uploading a client's file to a consumer version of a tool and using a service that has a data processing agreement, does not use inputs for training and provides the safeguards of Article 9. Keeping information that contains personal data and secrets out of the tool altogether is often the most effective measure. Deleting only names and identity numbers, however, does not make the data anonymous. As long as the course of events, the dates, the places and the company names remain in the text, the person stays identifiable and the content remains a secret. A file also holds the data of persons other than the client, of the opposing party and of witnesses, as well as special categories of data such as health data or criminal convictions. For these, the client's consent provides no legal ground. Where client information leaves the office, the client must be told, under Article 10(1)(c), to whom and for what purpose the processed personal data may be transferred. Informing the client is not a ground of lawfulness, and for the transfer the conditions of Articles 8 and 9 must be met as well.

E. The Ban on Intermediaries and Platforms Between Lawyers

Under Article 48 of the Attorneyship Law, 'those who act as intermediaries in bringing work to a lawyer in return for a fee or any benefit promised or given by the lawyer or the client, and lawyers who use an intermediary, shall be punished with imprisonment from six months to one year'.⁷⁴ Araalan argues that platforms which bring lawyers together and charge a subscription fee without interfering in the fees for substitute appearances fall outside this provision, and that German decisions support that reading.⁷⁵ The decision of the 19th Criminal Chamber discussed above shows that the Court of Cassation examines a non-lawyer's referral of clients under Article 48 and asks whether the referral was made in return for a fee or a benefit.

The German decisions offer a useful distinction for this debate, but they cannot be carried over into Turkish law as they stand. Section 49b(3) of the German Federal Lawyers' Act (Bundesrechtsanwaltsordnung, BRAO), as the German courts state it, prohibits giving or receiving part of the fees or any other benefit for the referral of mandates. Examining a platform that helped lawyers find substitutes for hearings and charged a fee per transaction, the Higher Regional Court of Karlsruhe held that the provision binds directly only lawyers, that the platform merely provides the medium for arranging a substitute appearance, and that its fee was not a commission paid for a particular mandate.⁷⁶ The Federal Constitutional Court, in the case of a lawyer who auctioned legal advice on an internet auction site, held that the commission paid to the auction house was owed not for the referral of a mandate but for a medium comparable to traditional advertising media.⁷⁷ Article 48 of the Attorneyship Law, however, is not a rule of professional conduct but a criminal provision that punishes the intermediary directly. The German decisions therefore do not answer the question who bears criminal liability in Turkish law. Where they help is the criterion of whether a payment is made in return for a particular piece of work or for the use of a medium. It is submitted that the words 'in return for' in Article 48 should be read by that criterion. In addition, the TBB Advertising Ban Regulation forbids naming law offices in a way that gives the impression of a permanent cooperation, such as 'solution partners',⁷⁸ and Law No 7571 attaches a fine to a deferral of the announcement of the verdict for the offense in Article 48, and suspension from practice to a conviction for it.⁷⁹

F. The New Framework of Disciplinary Law

The Constitutional Court found that Articles 134 and 135 of the Attorneyship Law listed the disciplinary sanctions without regulating which sanction applies to which act, and that this did not allow individuals to foresee which sanction was attached to which act. It held the provisions contrary to Article 2 of the Constitution and ordered that the annulment take effect nine months after the decision's publication.⁸⁰ What the Court reviewed was not the practice of the bars but the statute itself. Drawing on this decision, Araalan proposed that the Law should state expressly which act attracts which sanction.⁸¹ The legislature filled the gap with Law No 7571 of 24 December 2025, which rewrote Articles 134 and 135 and tied each sanction to a list of acts.⁸² Three items of the new scheme stand out for the use of AI: disclosing matters learned by reason of the lawyer's duties (Article 135(2)(b)), causing a loss of rights by breaching the duty of care (Article 135(2)(m)), and unlawfully letting others use the rights and powers of a lawyer or the lawyer's identity (Article 135(2)(t)). The last may also come into play where a lawyer's identity is used to present a software service as legal advice. Reprimand is only one step of the scheme. The Law also ties fines, suspension from practice and disbarment to separate lists of acts, and Article 136 provides that the next more severe sanction applies where a new act is committed within five years of a final sanction.⁸³

IV. THE COMPARATIVE FRAMEWORK

A. The European Union

The AI Act was published in the Official Journal of the European Union on 12 July 2024 and entered into force on the twentieth day after its publication. Its general date of application is 2 August 2026. The chapter of general provisions, which contains the definitions and AI literacy, and the chapter on prohibited practices have applied since 2 February 2025.⁸⁴ Regulation (EU) 2026/1744 postponed the application of the obligations for high-risk systems to 2 December 2027 for the systems listed in Annex III and to 2 August 2028 for the systems classified as high-risk under Annex I, which lists the Union harmonisation legislation on products.⁸⁵

Four provisions matter for a Turkish lawyer. First, the AI Act reaches 'providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union'.⁸⁶ A Turkish lawyer whose AI-assisted opinion is used by a client in the Union is therefore not outside the Act's field by reason of the lawyer's place of establishment. Second, providers and deployers 'shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf'.⁸⁷ This is the obligation whose extraterritorial reach Tatar emphasizes. Third, the tools a lawyer uses in the lawyer's own work are not high-risk as such. The high-risk category is aimed at systems intended to be used by a judicial authority or on its behalf, and at systems used in a similar way in alternative dispute resolution, which matters for the tools a lawyer uses when acting as a mediator or an arbitrator. A deployer of a high-risk system must take 'appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use'.⁸⁸ Fourth, the Act attaches a legal consequence to human review itself. A deployer that publishes AI-generated text to inform the public on matters of public interest must disclose that the text was generated, but not where 'the AI-generated content has undergone a process of human review or editorial control' and a person holds editorial responsibility for it.⁸⁹ The Act thus treats the human review of a text as a fact that changes the legal position of the text, which is what the lawyer's signature has always done.

B. The Council of Europe

The ethical charter adopted by the European Commission for the Efficiency of Justice (CEPEJ) in December 2018 laid down five principles for the use of AI in judicial systems: (1) respect for fundamental rights, (2) non-discrimination, (3) quality and security, (4) transparency, impartiality and fairness, and (5) 'under user control'.⁹⁰ The last principle asks that a prescriptive approach be precluded and that users be 'informed actors and in control of their choices', and its explanation adds that professionals in the justice system should at any moment be able to review the decisions and data used to produce a result and should not be bound by it. As of 20 October 2026, Türkiye had not signed the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No 225).⁹¹

C. France: The Ban on Profiling Judges

French law has set a limit beside the opening of judicial decisions as open data. The identity data of judges and court clerks may not be reused with the purpose or effect of evaluating, analyzing, comparing or predicting their actual or supposed professional practices, and a breach of that prohibition carries criminal penalties. The rule was inserted in 2019 into both the code governing the administrative courts and the code governing the ordinary courts.⁹² The Turkish doctrine has noted that, where the extent to which a judge's decisions are reversed by a higher court is taken into account as a measure of success for promotion, the algorithmic analysis of higher court decisions would matter to judges as well.⁹³ Tools that measure and compare the decision-making practices of individual judges are, however, of the kind prohibited in France. Turkish law has no express prohibition of this kind, but processing the identities of the judges named in decisions for that purpose should be assessed separately under the principle of Law No 6698 that processing be connected, limited and proportionate to its purpose.

D. Germany

In Germany the debate on legal technology has been shaped by concrete decisions: on platform fees by the Higher Regional Court of Karlsruhe and the Federal Constitutional Court (Part III.E above), and on document generators by the Federal Court of Justice (Part II.C above). The lesson the book-of-forms criterion holds for Turkish law is this: because generative models assess the user's concrete facts, the analogy may not lead to the same result for them. Germany's most instructive contribution, however, concerns secrecy. In 2017 the German legislature faced the question this article finds unanswered in Turkish law. The Federal Government's bill stated the problem plainly. Professionals bound by secrecy depend on the help of others, the installation, operation, maintenance and adaptation of information technology systems require knowledge that their own assistants cannot be expected to have, and drawing on third parties outside their own sphere carries a criminal risk where those parties may learn protected secrets and there is neither a provision authorizing it nor the express consent of the person entitled.⁹⁴

The Law of 30 October 2017 answered in two parts. In the Criminal Code it provided that professionals bound by secrecy may disclose secrets to other persons who take part in their professional activity, so far as this is necessary for the use of that person's services, and it extended criminal liability to those persons and to the professional who failed to ensure that such a person, who then disclosed a secret, had been bound to secrecy.⁹⁵ In the Federal Lawyers' Act it inserted a provision on the use of service providers. A lawyer may give a service provider access to facts covered by the duty of secrecy so far as necessary for the use of the service. The lawyer must select the provider carefully and end the cooperation at once if compliance cannot be ensured. The contract must be in text form and must bind the provider to secrecy with notice of the criminal consequences, limit the provider's knowledge to what the contract requires, and settle whether the provider may engage others, who must in turn be bound in text form. Where the service is provided abroad, access may be given only if the protection of secrets there is comparable to that at home, unless the protection of the secrets does not require it. Where the service serves a single mandate directly, the client's consent is required. The rules on the protection of personal data remain unaffected.⁹⁶ The words 'unless the protection of the secrets does not require it' were added to the clause on services abroad on the recommendation of the Bundestag's legal affairs committee, whose report explained them as a case-by-case option for the lawyer to weigh whether the nature of the data transferred calls for a comparable level of protection.⁹⁷ The German model does not make secrecy yield to convenience. It turns the provider into a person bound by secrecy, puts the duty to choose and to bind on the lawyer, and separates the general use of infrastructure from the use of a provider for a single client's matter.

E. The United States

The comment to ABA Model Rule 1.1 treats keeping abreast of 'the benefits and risks associated with relevant technology' as part of competence.⁹⁸ ABA Formal Opinion 512, discussed in Part I, applies the existing rules to generative AI rather than creating new ones, and it is in that sense closer to the Turkish position than its form suggests. The Federal Trade Commission, for its part, unanimously approved on 16 January 2025 a final order against a service that had promoted itself as 'the world's first robot lawyer'. The order prohibits the company from claiming without sufficient evidence that its service performs like a real lawyer and requires it to pay USD 193,000.⁹⁹ That was a decision on advertising that deceives consumers, not on the unauthorized practice of law, and the lesson lies there: what a legal tool says about itself is, until it is proven, only a claim. According to the Commission's complaint, the company had not tested whether its tool operated at the level of a human lawyer when generating legal documents and giving advice.

F. The United Kingdom

By an announcement of 6 May 2025 the Solicitors Regulation Authority stated that it had authorized the first law firm providing legal services through AI, a firm that helps businesses recover unpaid debts through the small claims process. The English regulatory model and the structure of English law firms differ from Turkish law, and the example cannot be carried over as an institutional model. The likeness lies in one principle only: named regulated solicitors are accountable for the output (Part III.A above). The courts have drawn the consequence for the profession's leaders. In its judgment of 6 June 2025 the Divisional Court held that 'practical and effective measures must now be taken by those within the legal profession with individual leadership responsibilities', and by those responsible for regulating legal services, to ensure that every individual providing legal services understands and complies with their professional and ethical obligations when using AI.¹⁰⁰ In Turkish terms, those are the duties of the head of a law office under Rule 37(b) and the duties of the bars and the TBB.

V. PROPOSALS

It is submitted that Article 35 of the Attorneyship Law needs no amendment as regards a lawyer's use of tools in the lawyer's own work. The provision determines to whom the function belongs, not which tool may be used, and it shows plainly with whom responsibility stays. That responsibility does not end with checking that the citations exist. Legal characterization and strategy must remain the lawyer's own reasoning, or the signature turns into a mark of approval. The provision of case-specific assessments to the public by providers who are not lawyers is a separate problem, and one the legislature should address expressly, because it touches the purpose of the reserve stated in Articles 1 and 2 and the protection of persons who cannot judge the quality of what they receive.

What the profession needs first is a statement of how the existing duties apply to the new tools. As the TBB's contribution to the Authority's guide for lawyers also shows, it would be appropriate for the TBB to publish guidance, along the lines of ABA Formal Opinion 512 and the CCBE guide, on verification against the primary source, secrecy, the processing and transfer of client data, the duties of the head of an office over the people and the tools in it, and the information owed to the client. Such guidance would not create new duties. It would state the duties that Article 34, Article 36, Rule 37(b), the Code of Obligations and Law No 6698 already impose, and it would make the standard of the prudent lawyer visible before a court has to define it after a loss.

The conditions on which professional secrets may be shared with technical service providers, however, should be set by statute and not by an amendment to the professional rules, because the prohibition they qualify is statutory. Araalan's second proposal, a rule on the American model that would open the use of AI to lawyers while making them responsible for confidentiality, points to the right subject, but the instrument it borrows belongs to a different system: the ABA's rules work within a regulatory system in which the duty of confidentiality is itself a rule of professional conduct. It is submitted that a new paragraph in Article 36 of the Attorneyship Law, modeled on the German reform of 2017, would remove the present uncertainty for AI tools and cloud services alike. The new paragraph should allow a lawyer to give a service provider access to matters covered by the duty of secrecy so far as necessary for the use of the service. It should require the lawyer to select the provider with care and to end the relationship when compliance cannot be ensured. The contract should be in writing, bind the provider and anyone it engages to secrecy, limit the provider's access to what the service requires and exclude the use of the information for the provider's own purposes. A provider abroad should be used only where the protection of secrets there is comparable, without prejudice to Article 9 of Law No 6698. The use of a provider for a single client's matter should require that client's consent. A parallel amendment should make the provider and its staff subject to the duty of secrecy and to the sanction for its breach, as the German Criminal Code now does. The rules on personal data would remain unaffected, and the two regimes would at last be aligned in one text.

At the level of general legislation, Türkiye has no statute on AI. The Artificial Intelligence Bill, submitted to the Speaker of the Grand National Assembly of Türkiye on 24 June 2024, was still in committee on 20 October 2026.¹⁰¹ The report of the Assembly's research commission on AI of March 2026 concluded that a specialized Türkiye Artificial Intelligence Agency should be established in the medium and long term.¹⁰² When a general regulation is made, an express limit that prevents tools analyzing judicial decisions from turning into the profiling of judges, as in the French example, deserves consideration.

CONCLUSION

The research question was which duties of the law in force settle on a lawyer who uses a generative AI tool, and where that law leaves a gap. The answer is that no provision bans or frees the tool, and that the duties the lawyer already bears decide its use. The statutory reserve fixes responsibility for the output on the lawyer and is enforced against those who perform reserved acts without being lawyers. The duty of care of Article 34, read with Article 506 of the Code of Obligations as the Court of Cassation applies it to lawyers, measures the lawyer against the prudent lawyer, makes the lawyer liable for even slight fault, does not pass to the tool and cannot be excluded in advance. The duty to verify every citation against the primary source follows from that standard, and the disciplinary law now names its breach. Professional secrecy, the criminal law and Law No 6698 make the infrastructure in which client information is processed the lawyer's question, and compliance with one regime does not secure compliance with the other. The gap lies in statute law: no Turkish provision allows a lawyer to disclose secrets to a technical service provider, and until one does, the safest course is to keep content in the nature of a secret out of outside systems or to use them only with the client's specific consent. The technical analysis leads to the same result. A large language model produces text on a probabilistic basis, relying on documents reduces error without removing it, and what matters in law is not whether the model learns in use but how the provider processes the data. The right question is not whether AI may be used, but who verifies its output, by what method, and on which infrastructure, under which contract, the client's secret is processed.

ABBREVIATIONS

• ABA: American Bar Association
• AI: artificial intelligence
• AI Act: Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence
• BGBl: Bundesgesetzblatt (German Federal Law Gazette)
• BGH: Bundesgerichtshof (German Federal Court of Justice)
• BRAO: Bundesrechtsanwaltsordnung (German Federal Lawyers' Act)
• BT-Drs: Bundestagsdrucksache (printed paper of the German Bundestag)
• BVerfG: Bundesverfassungsgericht (German Federal Constitutional Court)
• CCBE: Council of Bars and Law Societies of Europe
• CEPEJ: European Commission for the Efficiency of Justice
• CETS: Council of Europe Treaty Series
• E: esas (the docket number of a Turkish court file)
• EU: European Union
• FTC: Federal Trade Commission (United States)
• K: karar (the decision number of a Turkish court)
• OECD: Organisation for Economic Co-operation and Development
• OG: Official Gazette (Resmi Gazete)
• OJ: Official Journal of the European Union
• OLG: Oberlandesgericht (German Higher Regional Court)
• SRA: Solicitors Regulation Authority (England and Wales)
• StGB: Strafgesetzbuch (German Criminal Code)
• TBB: Türkiye Barolar Birliği (Union of Turkish Bar Associations)

BIBLIOGRAPHY

Books and Articles

Araalan C, 'Avukatlık Mesleğinde Legaltech Projeleri Özelinde Yapay Zeka Teknolojisinin Kullanımı' [The Use of Artificial Intelligence Technology in Legaltech Projects within the Scope of Legal Profession] (2025) 4(2) MEF Üniversitesi Hukuk Fakültesi Dergisi 263.

Bak B, 'Medeni Hukuk Açısından Yapay Zekanın Hukuki Statüsü ve Yapay Zeka Kullanımından Doğan Hukuki Sorumluluk' [The Legal Status of Artificial Intelligence With Regard to Civil Law and The Liability Thereof] (2018) 9(35) Türkiye Adalet Akademisi Dergisi 211.

Bilgin H, 'Hukuk Alanındaki Hizmetlerde Kullanılan Teknolojik Olanaklar (Legaltech) ve Avukatlık Mesleğine Olası Etkileri' [Technological Opportunities Used in Legal Services (LegalTech) and Their Possible Effects on Legal Professions] (2024) 73(2) Ankara Üniversitesi Hukuk Fakültesi Dergisi 1019.

Dahl M and others, 'Large Legal Fictions: Profiling Legal Hallucinations in Large Language Models' (2024) 16(1) Journal of Legal Analysis 64.

Greshake K and others, 'Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection' (2023) arXiv:2302.12173v2.

Karataş Durmuş N and Cebeci Çorum F, 'Güncel Gelişmeler Işığında Hukuk Alanında Yapay Zeka Kullanımının Değerlendirilmesi' [An Assessment of the Use of Artificial Intelligence in Law in the Light of Recent Developments] (2026) 76 Adalet Dergisi 41.

Loevinger L, 'Jurimetrics: The Next Step Forward' (1949) 33 Minnesota Law Review 455.

Magesh V and others, 'Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools' (2025) 22(2) Journal of Empirical Legal Studies 216.

Ruger TW and others, 'The Supreme Court Forecasting Project: Legal and Political Science Approaches to Predicting Supreme Court Decisionmaking' (2004) 104 Columbia Law Review 1150.

Tatar S, 'Avrupa Birliği Yapay Zeka Tüzüğü Kapsamında Yapay Zeka Okuryazarlığı: Türk Hukukuna Öneriler' [AI Literacy under the EU Artificial Intelligence Act: Proposals for Turkish Law] (2026) 76 Adalet Dergisi 285.

Zeytin Z and Gençay E, 'Hukuk ve Yapay Zeka: E-Kişi, Mali Sorumluluk ve Bir Hukuk Uygulaması' [Law and Artificial Intelligence: E-Person, Liability, and a Legal Application Example] (2019) 1 Türk-Alman Üniversitesi Hukuk Fakültesi Dergisi 39.

Legislation

Avukatlık Kanunu (Attorneyship Law) No 1136 of 19 March 1969, OG 7 April 1969, No 13168.

Hukuk Muhakemeleri Kanunu (Code of Civil Procedure) No 6100, OG 4 February 2011, No 27836.

Kişisel Verilerin Korunması Kanunu (Personal Data Protection Law) No 6698 of 24 March 2016, OG 7 April 2016, No 29677.

Türk Borçlar Kanunu (Turkish Code of Obligations) No 6098, OG 4 February 2011, No 27836.

Türk Ceza Kanunu (Turkish Criminal Code) No 5237, OG 12 October 2004, No 25611.

Türk Ceza Kanunu ile Bazı Kanunlarda ve 631 Sayılı Kanun Hükmünde Kararnamede Değişiklik Yapılmasına Dair Kanun (Law No 7571 amending the Turkish Criminal Code, certain other laws and Decree-Law No 631) of 24 December 2025, OG 25 December 2025, No 33118.

Kişisel Verilerin Yurt Dışına Aktarılmasına İlişkin Usul ve Esaslar Hakkında Yönetmelik (Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad), OG 10 July 2024, No 32598.

Türkiye Barolar Birliği Meslek Kuralları (Professional Rules of the Union of Turkish Bar Associations), adopted by the 4th General Assembly of the TBB on 8-9 January 1971.

Türkiye Barolar Birliği Reklam Yasağı Yönetmeliği (Advertising Ban Regulation of the Union of Turkish Bar Associations), OG 21 November 2003, No 25296, as amended by the regulations published in OG 9 August 2024, No 32627, and OG 2 May 2026, No 33241.

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L 2024/1689, consolidated text of 27 July 2026.

Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) [2026] OJ L 2026/1744.

Gesetz zur Neuregelung des Schutzes von Geheimnissen bei der Mitwirkung Dritter an der Berufsausübung schweigepflichtiger Personen (Law on the Protection of Secrets Where Third Parties Take Part in the Professional Activity of Persons Bound by Secrecy) of 30 October 2017, BGBl I 3618.

Bundesrechtsanwaltsordnung (Federal Lawyers' Act), ss 43e and 49b.

Loi n° 2019-222 du 23 mars 2019 de programmation 2018-2022 et de réforme pour la justice, art 33.

Parliamentary Materials

Deutscher Bundestag, Gesetzentwurf der Bundesregierung, Entwurf eines Gesetzes zur Neuregelung des Schutzes von Geheimnissen bei der Mitwirkung Dritter an der Berufsausübung schweigepflichtiger Personen, BT-Drs 18/11936 (12 April 2017).

Deutscher Bundestag, Beschlussempfehlung und Bericht des Ausschusses für Recht und Verbraucherschutz, BT-Drs 18/12940 (27 June 2017).

Türkiye Büyük Millet Meclisi, Yapay Zeka Kanun Teklifi [Artificial Intelligence Bill], Esas No 2/2234.

Türkiye Büyük Millet Meclisi, Yapay Zekanın Kazanımlarına Yönelik Atılacak Adımların Belirlenmesi, Bu Alanda Hukuki Altyapının Oluşturulması ve Yapay Zeka Kullanımının Barındırdığı Risklerin Önlenmesine İlişkin Tedbirlerin Belirlenmesi Amacıyla Kurulan Meclis Araştırması Komisyonu Raporu [Report of the Parliamentary Research Commission on Artificial Intelligence], Sıra Sayısı 260 (March 2026).

Cases

Anayasa Mahkemesi (Constitutional Court of Türkiye), E 2025/50, K 2025/47, 6 March 2025, OG 22 May 2025, No 32907.

Yargıtay Hukuk Genel Kurulu (Court of Cassation, Assembly of Civil Chambers), E 2022/109, K 2023/439, 10 May 2023.

Yargıtay 12. Ceza Dairesi (Court of Cassation, 12th Criminal Chamber), E 2025/71, K 2026/3682, 13 April 2026.

Yargıtay 19. Ceza Dairesi (Court of Cassation, 19th Criminal Chamber), E 2015/33380, K 2016/16758, 28 April 2016.

İstanbul Bölge Adliye Mahkemesi 43. Hukuk Dairesi (Istanbul Regional Court of Appeal, 43rd Civil Chamber), E 2026/1111, K 2026/1521, 14 July 2026.

BGH, 9 September 2021, I ZR 113/20.

BVerfG, 19 February 2008, 1 BvR 1886/06.

OLG Karlsruhe, 5 April 2013, 4 U 18/13.

Mata v Avianca, Inc, No 22-cv-1461 (PKC) (SDNY 22 June 2023).

R (Ayinde) v London Borough of Haringey [2025] EWHC 1383 (Admin).

Official Texts and Internet Sources

American Bar Association, Model Rules of Professional Conduct, r 1.1 cmt [8] and r 5.3 cmt [3] americanbar.org accessed 15 October 2026.

American Bar Association Standing Committee on Ethics and Professional Responsibility, Formal Opinion 512: Generative Artificial Intelligence Tools (29 July 2024) americanbar.org accessed 15 October 2026.

Bundesgerichtshof, press release No 171/2021 (9 September 2021) bundesgerichtshof.de accessed 15 October 2026.

Council of Bars and Law Societies of Europe, CCBE Guide on the Use of Generative AI by Lawyers (2 October 2025) ccbe.eu accessed 21 October 2026.

Council of Europe Treaty Office, 'Chart of signatures and ratifications of Treaty 225' coe.int accessed 20 October 2026.

European Commission for the Efficiency of Justice, European Ethical Charter on the Use of Artificial Intelligence in Judicial Systems and their Environment (adopted at the 31st plenary meeting of the CEPEJ, Strasbourg, 3-4 December 2018) rm.coe.int accessed 15 October 2026.

Federal Trade Commission, 'FTC Finalizes Order with DoNotPay That Prohibits Deceptive "AI Lawyer" Claims, Imposes Monetary Relief, and Requires Notice to Past Subscribers' (11 February 2025) ftc.gov accessed 15 October 2026.

Kişisel Verileri Koruma Kurumu (Personal Data Protection Authority), Avukatların Mesleki Faaliyetlerinde Kişisel Verilerin Korunmasına İlişkin Uygulama Rehberi [Guide on the Protection of Personal Data in the Professional Activities of Lawyers] (KVKK Yayınları No 115, July 2026), announced on 22 September 2026 kvkk.gov.tr accessed 20 October 2026.

Kişisel Verileri Koruma Kurumu (Personal Data Protection Authority), Üretken Yapay Zeka ve Kişisel Verilerin Korunması Rehberi (15 Soruda) [Guide on Generative Artificial Intelligence and the Protection of Personal Data, in 15 Questions] (Yayın No 113, November 2025) kvkk.gov.tr accessed 15 October 2026.

OECD, Recommendation of the Council on Artificial Intelligence (OECD/LEGAL/0449, adopted 22 May 2019, amended 8 November 2023 and 3 May 2024) legalinstruments.oecd.org accessed 15 October 2026.

OWASP Gen AI Security Project, OWASP Top 10 for LLM Applications 2025, 'LLM01:2025 Prompt Injection' genai.owasp.org accessed 20 October 2026.

Solicitors Regulation Authority, 'SRA approves first AI-driven law firm' (6 May 2025) sra.org.uk accessed 15 October 2026.

Yargıtay (Court of Cassation), 'Yargıtay İçtihat Merkezi Kullanıma Açılmıştır' [The Court of Cassation Case-Law Center Has Been Opened to Use] (13 December 2023) yargitay.gov.tr accessed 15 October 2026.