The EU AI Act and hotels in Türkiye: what the law says and when it can matter to you

The EU AI Act is Regulation (EU) 2024/1689, in force since 1 August 2024 and applying from 2 August 2026 with staged exceptions. It sets risk levels and transparency duties. Whether it reaches a hotel in Türkiye depends on Article 2 scope and is a question for counsel. Türkiye has an AI action plan, not a business AI law.

A European tour operator sends a supplier questionnaire: do you use artificial intelligence, and are you compliant with the EU AI Act? The first question has a short answer. The second has a date, a risk level and a lawyer behind it, not a yes. After reading this EU AI Act explained in plain words, you will know the calendar, the risk bands, the two duties a hotel meets first, and what to do while the scope question is with counsel.

What is the EU AI Act, and when does each part apply?#

It is a European Union regulation, Regulation (EU) 2024/1689, that sets rules for AI systems sold or used in the Union. It entered into force on 1 August 2024, but it applies in stages, and the calendar is written into its final provisions.

The Regulation was adopted on 13 June 2024 and published in the Official Journal on 12 July 2024; it entered into force on 1 August 2024, the twentieth day after publication. Entry into force is not the same as application. Article 113 holds the calendar, and Article 113 was amended by Regulation (EU) 2026/1744, the so-called Digital Omnibus on AI, adopted on 8 July 2026, published on 24 July 2026 and in force since 27 July 2026, according to the EUR-Lex consolidated text (27 July 2026) (opens in a new tab).

Chapter I includes the scope article, which matters more than any other for a reader outside the Union, and it has applied since 2 February 2025. Two dates sit in between and are easy to miss: 2 December 2026 brings the new prohibitions in Article 5(1)(ba) and (bb), and the deadline for marking systems already on the market before 2 August 2026.

What are the risk levels, in plain words?#

The Act does not regulate AI as one thing. It sorts systems into four bands, and the band decides how much paperwork, testing and human oversight the law asks for.

Prohibited practices, in Chapter II, are a closed list of uses the Union does not allow at all, such as social scoring or exploiting a person's vulnerability, and they have applied since 2 February 2025. From 2 December 2026 the list grows: Article 5(1)(ba) and (bb) cover AI systems that generate or manipulate realistic intimate or sexually explicit material of identifiable people without their consent, and child sexual abuse material.

High-risk systems are those named through Annex I, where AI sits inside a product covered by safety rules, or through Annex III, a list of specific areas such as recruitment or access to essential services. These carry risk management, data governance, technical documentation, logging and human oversight duties. Transparency duties, in Article 50, are lighter obligations for systems that interact directly with people and for content that is generated rather than captured. Everything else carries no specific obligation beyond the AI literacy duty in Article 4.

Which parts would a hotel meet first?#

Two: the duty to tell people they are dealing with a machine, and the duty to mark content that a machine generated. Both sit in Article 50 and both apply from 2 August 2026.

Article 50(1) requires providers to design systems that interact directly with people so that those people are informed they are interacting with an AI system, unless this is obvious to a reasonably well-informed, observant and circumspect person given the circumstances and context of use. Article 50(2) requires providers of systems that generate synthetic audio, image, video or text to mark the output in a machine-readable format so that it is detectable as artificially generated or manipulated; systems placed on the market before 2 August 2026 have until 2 December 2026 under Article 111(4). Article 50(4) puts a disclosure duty on deployers of systems that produce a deep fake, and on deployers that publish generated text to inform the public on matters of public interest, unless that text has been through human review and someone holds editorial responsibility for it, according to the EUR-Lex consolidated text of Articles 4 and 50 (2 August 2026) (opens in a new tab).

Article 4, the AI literacy duty, was rewritten by Regulation (EU) 2026/1744 with effect from 27 July 2026. Providers and deployers must take measures to support the AI literacy of their staff and of others dealing with these systems on their behalf, taking account of their knowledge, the context of use and the people affected. Article 4 does not require anyone to guarantee a specific level of literacy in any individual, and the Commission publishes practical examples of how to comply.

In a hotel these duties land on familiar surfaces: the chat window on the website, the guest app, AI-written room descriptions, generated photographs, and staff who use AI tools to draft replies. The split matters. Some duties sit on the provider, the company that builds the system, and some on the deployer, the organisation that uses it. A hotel buying a tool and a hotel building one are in different positions. For the boundary between a machine reply and a person, see when an AI reply to a guest should be handed to staff.

Does the EU AI Act reach a hotel in Türkiye?#

It can, in principle, and the text says so in Article 2(1)(c): the Regulation applies to providers and deployers of AI systems established or located in a third country where the output produced by the system is used in the Union. Whether it reaches your hotel is a question of fact and legal advice, not a yes or no.

Article 3(4) defines a deployer as a person or body using an AI system under its authority, except where the system is used in a purely personal, non-professional activity. A hotel using a tool in its reservations or guest messaging is not in that exception. So the analysis turns on facts: where the output is actually used, who is the provider and who is the deployer, and what the contract between them says, according to the EUR-Lex text of Article 2 (12 July 2024) (opens in a new tab).

A guest in Germany reading a reply from your assistant and a guest reading the same reply in your lobby in Antalya are different cases on the face of Article 2(1)(c). Do not settle that yourself. The obligations are not identical for the two roles: the provider carries design and marking duties, while the deployer carries disclosure duties and, for high-risk uses, oversight duties. Enforcement against a company outside the Union, and the role of an authorised representative, are separate questions with their own answers.

Two questions are enough to start: is the output of this system used in the Union, and in which role are we acting, provider or deployer?

Does Türkiye have its own AI law?#

Not one that regulates how a business uses AI. What Türkiye has is a national action plan, and it is a policy document rather than a statute with duties for hotels.

The Türkiye Yapay Zekâ Eylem Planı covers 2026 to 2030. It was announced on 13 June 2026 at the Türkiye AI Summit in İstanbul and put into force by Presidential Circular 2026/9, published in the Resmî Gazete, number 33344, on 18 August 2026. It is built on four axes, Fark Et, İstifade Et, Üret and Yönet, and lists 16 priority actions; tourism is not named among them. For the detail, read our piece on Türkiye's AI Action Plan 2026-2030 and what it means for hotels.

A plan sets direction for public bodies. It does not create a duty on a hotel to document, test or disclose an AI system, and it does not create a regulator for your guest chat. No Turkish AI bill is described here; if one is introduced, the official parliamentary record is the source to read, not a summary. What does bind a hotel today on the data side is the personal data law, KVKK (kişisel verilerin korunması kanunu), together with the sector rules that apply to accommodation; confirm the detail with your adviser.

This is why the EU text matters even from Antalya: it is the reference point your European counterparties use in contracts and questionnaires, whether or not it binds you. Treat the action plan as context and the Regulation as a contract and compliance question. They are different kinds of document.

What can a hotel do now, whichever way the scope question goes?#

Adopt the practices the Act describes, because they are good practice on their own: tell people, keep records, and give a named person the decision on anything sensitive.

Tell people plainly. One line at the top of the chat window and in the guest app, saying a machine drafted the reply and staff can take over, is the Article 50(1) idea in its simplest form. Keep a register of AI tools: what each one does, who owns it, when it was approved and what it touches. A register turns a supplier questionnaire into a lookup.

Name the person who decides. Routine replies can go out; complaints, refunds, safety issues and anything about a guest's identity wait for a person. Write the line down so it does not depend on who is on shift, and for a starting point see which hotel AI actions need a person to approve them. Train staff by role, briefly and repeatedly: Article 4 asks for measures, not certificates, and the same is true of a sensible in-house program, such as the one in a short in-house AI training program by role.

Write a short policy on what staff may paste into AI tools, because guest data leaving the building is a data question before it is an AI question. Ask every supplier three things in writing: what the system does, whether its outputs are marked as generated, and who is responsible for what. Review quarterly: the dates in Article 113 are fixed, but your tools, your markets and your contracts are not.

What to do next#

Put the scope question to a legal adviser in writing, with two sentences: the output of our AI systems may be used by guests in the European Union, and we need to know in which role we act. Then, while that answer is pending, do the part that needs no lawyer: a disclosure line, a register of tools, a named decision-maker and a short staff policy. The dates in Article 113 will arrive whether or not the Regulation binds your property, and the practices cost little either way.