Kodakod Team
AI is powerful, but risky when used without oversight. How do you build a responsible framework for data security, hallucination, and KVKK compliance?
In short: Responsible AI means using AI with attention to accuracy, data security and legal compliance, together with oversight mechanisms. In practice it rests on three things: limiting hallucination by grounding answers in sources and requiring human approval, processing personal data in line with KVKK, Turkey's personal data protection law (minimum data, clear contracts, a legal basis for transfers abroad), and keeping control over which tools you give data to. This framework does not slow work down; it lets you use AI more widely and with more confidence.
As AI grows more powerful, so does the need to use it responsibly. In 2026, the question that truly makes a difference for businesses is no longer “are we using AI?” but “are we using it safely?” Unsupervised AI can deliver speed while quietly accumulating reputational and compliance risk.
Hallucination: confident but wrong
AI models sometimes produce information that looks real but is completely false; this is called hallucination. The most dangerous part is that they do it in extremely convincing language. An assistant that tells a customer the wrong price, the wrong terms or a feature that does not exist does direct harm to the business.
This is not just our observation. In its risk management profile for generative AI (NIST AI 600-1, July 2024), the US National Institute of Standards and Technology (NIST) calls this “confabulation”, defines it as the production of confidently stated but erroneous or false content by which users may be misled, and lists it among the core risks. Turkey's Personal Data Protection Authority (KVKK) likewise stresses in the generative AI guide it published in November 2025 that even systems trained on high-quality data can produce untrue content, which is why outputs should be monitored regularly and supported by human oversight where necessary.
Hallucination cannot be eliminated, but there are ways to reduce it significantly:
- Grounding in sources (RAG) — base the assistant's answers on your own verified documents; where possible, have it show the document it relied on alongside the answer.
- Being able to say “I don't know” — when it is unsure, it should hand over to a human instead of making things up.
- Human approval for critical output — human oversight is essential for legal, financial or health-related answers.
- Narrowing the scope — clearly limit the topics the assistant will discuss; have it read changing information such as prices and stock from the live system, not from the model's memory.
- Testing with hard questions — before going live, prepare a test set of real customer questions and deliberately tricky ones, and run it again after every update.
Trustworthy AI is not a system that knows everything; it is one that knows what it knows and what it doesn't.
Data security and KVKK
When entering business data into AI tools, the question most businesses forget to ask is this: where does this data go, where is it stored, and does the model use it for training? Customer data flowing to a third-party service without permission can amount to a serious violation under KVKK.
Three points matter especially here:
- Transfers abroad. A large share of popular AI services run on infrastructure outside Turkey. The KVKK guide states clearly that when a data controller in Turkey uses AI through a provider based abroad and transfers personal data, that transfer must comply with Article 9 of Law No. 6698 and with the Regulation on the Procedures and Principles for Transferring Personal Data Abroad, published on 10 July 2024.
- Contracts and roles. If the provider processes data on your behalf, it acts as a data processor; the purpose of processing, how long the data is kept and how it is deleted should be set out in a contract.
- A consumer account is not the same as a business account. Providers' training and retention terms vary by product. For example, Anthropic states that in its commercial products (Claude for Work and the API) it does not use chats to train its models, while separate rules apply to consumer plans. Employees processing customer data through their personal accounts is therefore a separate risk.
The core principles of a responsible setup:
- Data minimization — give the model only as much data as the task requires.
- Separating personal data — mask identifying information when necessary.
- Contractual assurance — make sure the service you use does not use your data for training.
- Access and audit trail — keep a record of who accessed what.
This post is not a substitute for legal advice; decide matters such as the legal basis for transfers and your privacy notice together with your legal counsel. To check your website's overall KVKK status, you can also look at our data protection checklist for companies.
Risk, example and safeguard: in one table
| Risk | Typical example | Safeguard |
|---|---|---|
| Hallucination | The assistant telling a customer about campaign terms that do not exist | RAG, scope limits, “I don't know” and hand-off to a human, a test set |
| Personal data leakage | An employee pasting a customer list into a personal chat account | Business accounts, a usage policy, masking, training |
| Transfers abroad without a legal basis | Transfers of customer data to a service abroad not being documented | A legal basis for the transfer under KVKK Article 9 and the regulation, a contract |
| Fake AI application | A “ChatGPT” installer downloaded from an ad turning out to be malware | Installing only from official sources, an approved tools list |
| Decisions that cannot be audited | Being unable to explain afterwards why an answer was given | Logging requests and responses, regular sample checks |
Fake AI tools: know which tool you are giving data to
There is a threat side too: in 2026, attackers are targeting businesses with malware that imitates AI tools. According to Kaspersky's June 2026 report, more than 33,300 attacks on small and medium-sized businesses disguised as popular AI services were detected between January and April 2026, almost five times as many as in the same period of 2025. The most imitated brands were ChatGPT, Claude and DeepSeek.
That is why knowing which tool you give data to is not just a compliance matter but a security one. A simple rule makes a big difference: install AI tools only from the provider's official website or app store, keep a list of approved tools within the company, and make it an explicit rule that business data is not entered into tools outside that list.
A practical checklist
- List which AI tools are used in the company, by whom and with what data.
- For each tool, verify from the provider's official documentation where data is processed, how long it is kept and whether it is used for training.
- For uses involving personal data, clarify the legal basis for transfers abroad and the contract with your legal counsel.
- Write a short, clear AI usage policy for employees: which tool, which data, which purpose.
- Make RAG, scope limits and a hand-off-to-human mechanism mandatory for assistants that talk to customers.
- Build a test set that runs before launch and after every update.
- Log requests and responses without retaining more personal data than necessary, and run regular sample checks.
- Brief employees on fake applications and data sharing; the KVKK guide also specifically recommends employee awareness.
Common mistakes
- Banning it and walking away. Banning use entirely can push employees towards uncontrolled personal accounts; offering an approved, secure alternative is more effective.
- Data that is assumed to be “anonymous”. A record with the name removed can still identify a person when combined with other information. The KVKK guide also stresses that whether data claimed to be anonymous is truly anonymous must be demonstrated technically.
- Testing once and forgetting. When the model, documents or prompts change, the assistant's behavior changes too; testing is continuous, not a one-off.
- Leaving responsibility to the provider. However capable the provider, responsibility for the answers given to your customers and the data processed lies with you.
We describe how we apply these principles in customer service in our post on AI-powered customer service, and the permission risks on the agent side in our post on agentic AI.
Responsible AI is not a burden; it is an advantage
Building a responsible AI framework does not slow work down; on the contrary, it speeds it up by building trust. When your customers know their data is safe and your oversight mechanisms are clear, you can use AI more boldly and more widely. At Kodakod, we design AI solutions with security, accuracy and KVKK compliance in mind from the start, bringing speed and trust together in the same system.
Frequently asked questions
Hallucination is when an AI model produces information that looks real but is completely false. The most dangerous part is that it presents this false information in highly convincing language. For example, an assistant that tells a customer the wrong price, the wrong terms, or a feature that does not exist causes direct harm to the business.
There are three main ways to reduce hallucination. Ground the assistant's answers in your own verified documents using RAG, make it say "I don't know" and hand off to a human instead of making things up when it is unsure, and require human approval for critical output such as legal, financial, or health-related responses. Trustworthy AI is not a system that knows everything, but one that knows what it knows and what it does not.
Yes, it poses a serious risk when done carelessly. Customer data flowing to a third-party service without permission can create a serious breach under KVKK, Turkey's personal data protection law. That is why, before giving data to an AI tool, you should be clear on where the data goes, where it is stored, and whether the model uses it for training.
Four core principles stand out. Data minimization means giving the model only as much data as the job requires, personal data such as identifying information is masked when needed, a contract ensures the service you use does not use your data for training, and a record is kept of who accessed what. In addition, knowing which tool you hand your data to is a security matter, given malware that imitates AI tools.
Responsible AI means using AI with attention to accuracy, data security, and legal compliance, backed by oversight mechanisms. Such a framework does not slow the business down; on the contrary, it speeds things up by building trust. When customers know their data is safe and oversight mechanisms are clear, a business can use AI more boldly and more broadly.
