Is using AI in hiring legal?

Turkish legislation carries no provision banning the use of AI in hiring. What binds you is not the tool but how it is used. Two rules apply directly today: the right under KVKK to object to solely automated analysis, and the equal treatment principle of Labour Law no. 4857. The third one, the artificial intelligence regulation of the European Union, is out of scope today for a product established in Türkiye that sells only to Türkiye.

The real risk is not where it is expected. Under the equal treatment principle the burden of proof shifts to the employer: if the employee shows a strong likelihood of a violation, it is the employer who proves that there was none. Saying "I did not discriminate" is not enough, you have to be able to show why that particular candidate was eliminated. If an elimination decision was never written down anywhere, there is nothing left to defend.

The split of responsibility is clear. For candidate data the data controller is the company that opened the posting, and the software provider works as a data processor. You write the criterion, you open the gate, you make the decision. The sections below show what these conditions correspond to in the panel. They do not replace legal advice, which your own lawyer gives you.

• There is no banning provision to look for. What exists is conditions: a channel for objections, human review and no discrimination.
• The rule binds the user, not the tool. Whoever writes a discriminatory criterion and whoever opens a closed gate by hand is the employer.
• Automatic elimination is not banned, elimination that cannot be audited is. The difference lies in whether the reason can be shown after the fact.

Three separate texts speak at once and all three say something different. The table puts what each of them says next to what it means at the hiring desk. The legal texts are given in shortened form; what binds you is the text itself.

For candidate data the data controller is the company that opened the posting; the software provider is the party processing the data on that company's instructions. What follows in practice: the privacy notice presented to the candidate is issued under your company name, you answer candidate requests, you decide the retention period. Information, correction, deletion and objection requests are sent by email and concluded within thirty days at the latest.

Nothing is handed over on the equal treatment side either. The product does not block a discriminatory criterion, because the criterion text is free text. The check that runs while you write it asks a single question: can this criterion be verified from a CV. It does not ask whether the criterion is discriminatory, and it does not claim to.

The conditions above share one demand and it fits in a single sentence: let a human decide, let the candidate know what is happening, keep the reason on record. The three headings below are what that looks like in the product. All of it applies in companies where AI analysis is switched on; the setting is on by default, and while it is off no pre evaluation, gate or score is produced at all.

Evaluation does not learn from past hiring outcomes. Who was invited or hired never enters scoring; calibration is used only to set the scale of the score distribution. The reasoning is written down: a system that learns from outcome labels reproduces the preferences of the past.

The model does not produce a score in the first place. Item by item it answers whether something is evidenced in this CV, leaves a verbatim quote from the CV next to every answer, and the arithmetic is done in code. An item with no evidence found does not count as half a point, it leaves the denominator.

Two things are deliberately not claimed. First, the pairwise comparison layer inside the pool is not live, and it will not go live before passing the audit that measures how far the ranking shifts when identity signals are changed. Second, the calibration report that shows the band distribution across the company, how many times the gate closed and how many times a human stepped in returns numbers only: no candidate name, no email, no score per row.

This is usually the most useful section of a compliance page. What follows is what the product does not do, and in places what it looks like it does but does not; every item comes back to the responsibility of a person.

A process set up without knowing these relies on a protection that is not there. Learning about them during an audit is the most expensive route.

• There is no discriminatory criterion check. The criterion text is free text; the check that runs while you write it only looks at whether the criterion can be verified from a CV, and it writes its reasoning in Turkish.
• The closed gate warning does not block anything. If a posting is about to be closed while nobody ever looked at the closed gate group, a warning appears, but it does not stop the closing.
• There is no separate screen that shows the audit trail. Records are kept and can be produced after the fact; do not expect a ready made audit trail page.
• There is a limit the gate cannot see: if a candidate has left a job but the CV still says "present", no deterministic calculation can catch it. That risk is left to reference checking.
• The application form collects neither sex nor marital status; those fields exist only on the employee record. Date of birth is an optional field on the candidate record.
• Masking is role based. For a user without permission to see personal data the gate and override reasons drop; that a decision was made, who made it and when it was made stay visible.