The Union of Turkish Bar Associations (TBB) has published Avukatlar İçin Yapay Zekâ Kullanımı Tavsiye Rehberi, a recommendation guide on AI use by lawyers. It came out of the TBB workshop on AI and the legal profession held in Ankara on 14-15 February 2026, and it was prepared by the TBB's Information and Technology Law Commission. It is short and written for practitioners, and worth reading in full.
The guide opens with its starting position: a lawyer may use AI, but may not hand over secrecy, data protection, the client's interests, final legal reasoning or professional responsibility to it — "hiçbir aşamada yapay zekâya veya üçüncü kişilere devredemez" ("cannot delegate to AI or to third parties at any stage"). It does not ban AI, and it does not approve or ban any brand, product or provider.
four kinds of use
The core of the guide is a risk-based classification. Each use is weighed by the type of data, the effect on the client, how close the work is to a legal outcome, whether the tool is an open or closed system, and whether data may leave the country. That produces four groups:
- Free auxiliary use. General research on legislation, planning a topic without client details, simplifying language, summarising public texts. No client data goes in, and the output is not treated as a final legal opinion.
- Limited and controlled use. A first skeleton of a petition or contract, summarising an anonymised document, a first pass through case law, drafting a client e-mail. Safeguards include data masking, approved tools, human oversight, records, and a second reviewer.
- Use subject to special safeguards, and approval where needed. Documents with sensitive data, litigation and enforcement files, health or criminal record information, trade secrets. Here the guide requires closed systems, written authorisation, a KVKK check, an assessment of transfers abroad, access restrictions and logging.
- Prohibited use. Among others: entering non-anonymised client data, case files or evidence into public tools without adequate contractual guarantees, and letting AI output stand in for the lawyer's own judgement.
anonymous is a judgement about the whole document
The point I found most useful is in the section on professional secrecy and data protection. The guide says that information a lawyer learns can become identifying through the distinctive features of the facts, even when the client's name is never mentioned. So anonymisation is "yalnızca isim ve kimlik numarası silmekten ibaret değildir" ("not just deleting names and ID numbers"): the date of the event, the place, the amount, the company name, the type of case, the network of relationships and any unique facts have to be considered too, and considered together.
This is a harder standard than most people apply. A labour claim with the name and ID number removed can still point to one person if it gives the district, the employer, the year, the role and the amount. Whether a document is anonymous is not something a find-and-replace can settle. Someone has to read what is left.
verification, discipline and publicity
Output has to be checked against the file and against reliable sources, with a second lawyer's review for higher-risk work; the guide names hallucination, confirmation bias and automation bias as the risks. Using AI should not in itself be a ground for sanctions: what matters is a concrete breach, harm, fault, a data-security violation or a failure of professional care.
On publicity, it lists claims that cannot be made on the strength of using AI: "guaranteed result", "advice without a human", "fastest resolution", "predicts the court's decision", "certain win analysis", and anything presenting AI as an independent legal adviser. It also covers fees, liability insurance and written AI policies inside firms.
what I am building
The guide describes the problem I have been working on: a local, rules-based redaction workstation for Turkish legal documents, where a lawyer decides every redaction and the tool never calls the result anonymous. In a little more detail:
- It runs on the lawyer's own computer. There is no hosted service and no upload, and the tool itself sends documents nowhere. It is a step before any AI tool, not an AI tool.
- It looks beyond names and ID numbers. It flags dates, amounts, addresses, courts together with their city, case and file numbers, company names and party roles, the kinds of detail the guide warns about.
- Nothing is removed until a person decides, and marking a document ready for use with an outside AI tool always needs a human approval.
- It never calls its output anonymous. It keeps redaction, pseudonymisation, de-identification and anonymisation apart, because context can still identify a client after the obvious identifiers are gone.
- It will not clear a document it could not read properly.
- It keeps a record of who reviewed and exported what, without writing the document's content into that record.
What it does not do is just as important. It does not make a document safe to send anywhere. Whether a redacted document can go into a particular tool is still the lawyer's decision, made with the guide's four categories and that tool's terms in mind. The tool can make that review more systematic. It cannot replace it.
More on it when it is ready to show.