# AI governance and compliance

> AI governance is the set of rules and controls that decides which AI tools your company uses, with which data, approved by whom and with what records. Corrplus maps your AI use against GDPR, the EU AI Act and Türkiye's data protection law (KVKK), classifies the risks and builds the technical controls. Legal interpretation is settled with your legal counsel.

URL: https://corrplus.net/services/ai-governance/
Updated: 2026-10-22
Corrplus Team

## Who it is for

- Companies whose staff use AI tools on their own, with no record of what data goes where
- Teams about to launch a chatbot, assistant or automation that touches customer data
- Turkish exporters selling into the EU who now face GDPR and EU AI Act questions
- EU companies with a Turkish subsidiary that must align local AI use with group policy and KVKK

## When it is not a fit

- Anyone looking for a legal opinion or a compliance certificate. Your lawyers give legal advice; we handle the technical and process side.
- Companies that do not use AI and do not plan to soon. General data protection compliance is outside this service.

## What you get

- **AI use inventory**: A list of AI tools in use or planned, the data they process and where that data goes.
- **Risk classification**: A first assessment of each use for personal data, cross-border transfer and EU AI Act risk categories, prepared for your legal counsel's review.
- **AI acceptable use policy draft**: Short, practical rules on which tool may be used with which data, written so teams can follow them.
- **Technical controls**: Access rights, masking of personal data, logging of prompts and outputs, and retention periods.
- **System documentation**: For each AI system: its purpose, data sources, human oversight points and known limits.
- **Data subject request workflow**: A workflow that logs access and deletion requests under GDPR and KVKK and routes them to the right team.

## How we work

- **Discover**: After a free first call we interview teams and map which AI tools are used where and with which data.
- **Design**: We classify the risks, draft the policy and the technical controls, and review everything with your legal counsel.
- **Build**: We put access, masking and logging controls into your systems in short cycles and complete the documentation.
- **Run**: We add new tools to the inventory, review the logs regularly and update controls as regulation changes.

## Tools we use

Microsoft Purview, Microsoft Entra ID, Azure OpenAI, Self-hosted open-source models, Self-hosted n8n, Langfuse, Supabase and PostgreSQL

**Timing:** Inventory and risk classification take a few weeks; technical controls depend on scope

**Pricing:** Inventory and policy work is a fixed-scope project; technical controls and periodic reviews are quoted separately in writing.

## What does AI governance cover?

A policy document alone is not governance. First you need to know what is actually in use: which team uses which tool, on which account, with which data. In most companies the list is longer than expected. It includes chat tools on personal accounts, browser extensions and AI features switched on inside existing software.

After the inventory we ask the same questions of every use. Is personal data processed? Does data leave the country? Does the output decide something about a person? Is anything logged? The answers decide which controls are needed. If you already keep a GDPR record of processing activities or a KVKK data inventory, this work stays consistent with it.

## KVKK, GDPR and the EU AI Act: which ones apply to you?

| Regulation | Who it concerns | Typical question in an AI project |
|---|---|---|
| KVKK (Law No. 6698) | Any company processing personal data in Türkiye | What is the legal basis, and is data transferred abroad? |
| GDPR | Companies processing personal data of people in the EU | Is there automated decision-making, and were people informed? |
| EU AI Act | Providers placing AI systems on the EU market, or whose output is used in the EU | Which risk category is the system in, and what documentation is required? |

Your legal counsel decides which regulation binds you and how far. Our job is to prepare the technical facts they need to make that call, accurately and completely, and then apply the decision to your systems.

## What do we do, and what does your legal counsel do?

We map data flows, classify systems, build access and logging controls and write the documentation. Your legal counsel decides the legal basis, the privacy notices, the transfer mechanism and how the risk category is interpreted. That split means no decision falls through the cracks.

This service differs from [AI consulting](/services/ai-consulting/). Consulting decides what to build; governance puts rules around everything that is built or used. We pair it with [corporate AI training](/services/corporate-ai-training/) so teams actually learn the rules. For background, see our glossary entries on [KVKK](/glossary/kvkk/) and the [EU AI Act](/glossary/eu-ai-act/).

## How we start

In a free first call we talk through the AI tools you use and plan to use. We then propose in writing the scope of the inventory and how we will work alongside your legal counsel, in English or Turkish.

## Frequently asked questions

### Does this service guarantee compliance?

No. Compliance decisions belong to you and your legal counsel. We make your AI use visible, classify the risks and build the technical controls, and settle every point that needs legal interpretation together with your lawyers.

### Could our staff be pasting customer data into ChatGPT?

Without rules, very likely. The inventory makes it visible. We then write down which tool may be used with which data and reduce risky use with company accounts and technical controls.

### Does the EU AI Act apply to a company based in Türkiye?

It can, if you place an AI system on the EU market or its output is used in the EU. We pre-classify your systems against the Act's risk categories and document them for your legal counsel to assess.

### What is KVKK and how does it relate to GDPR?

KVKK is Türkiye's personal data protection law, Law No. 6698. It shares many principles with GDPR but differs in areas such as cross-border transfers and registration with the national data controller registry, VERBİS. Companies operating in both markets usually need to meet both.

### What does an AI acceptable use policy look like?

A few pages of plain rules: which tools are approved, which data never goes into any tool, who checks the output and whom to ask when in doubt. It is published after your legal counsel has reviewed it.

### What happens when the AI gets something wrong?

That is why human oversight points are designed in. Outputs that affect a customer or a decision have an approval step, a log entry and a way to reverse them. The policy also lists the decisions that are never left to AI.