With your permission we use Google Analytics to understand how the site is used. There are no other non-essential cookies. Cookie policy

ENTR
Free call
Book a free call

AI governance and compliance

AI governance is the set of rules and controls that decides which AI tools your company uses, with which data, approved by whom and with what records. Corrplus maps your AI use against GDPR, the EU AI Act and Türkiye's data protection law (KVKK), classifies the risks and builds the technical controls. Legal interpretation is settled with your legal counsel.

Book a free call

Timing

Inventory and risk classification take a few weeks; technical controls depend on scope

Pricing

Inventory and policy work is a fixed-scope project; technical controls and periodic reviews are quoted separately in writing.

Tools we use

Microsoft Purview, Microsoft Entra ID, Azure OpenAI, Self-hosted open-source models, Self-hosted n8n, Langfuse

Who it is for

  • Companies whose staff use AI tools on their own, with no record of what data goes where
  • Teams about to launch a chatbot, assistant or automation that touches customer data
  • Turkish exporters selling into the EU who now face GDPR and EU AI Act questions
  • EU companies with a Turkish subsidiary that must align local AI use with group policy and KVKK

When it is not a fit

  • Anyone looking for a legal opinion or a compliance certificate. Your lawyers give legal advice; we handle the technical and process side.
  • Companies that do not use AI and do not plan to soon. General data protection compliance is outside this service.

What you get

  • AI use inventoryA list of AI tools in use or planned, the data they process and where that data goes.
  • Risk classificationA first assessment of each use for personal data, cross-border transfer and EU AI Act risk categories, prepared for your legal counsel's review.
  • AI acceptable use policy draftShort, practical rules on which tool may be used with which data, written so teams can follow them.
  • Technical controlsAccess rights, masking of personal data, logging of prompts and outputs, and retention periods.
  • System documentationFor each AI system: its purpose, data sources, human oversight points and known limits.
  • Data subject request workflowA workflow that logs access and deletion requests under GDPR and KVKK and routes them to the right team.

How we work

  1. Discover

    After a free first call we interview teams and map which AI tools are used where and with which data.

  2. Design

    We classify the risks, draft the policy and the technical controls, and review everything with your legal counsel.

  3. Build

    We put access, masking and logging controls into your systems in short cycles and complete the documentation.

  4. Run

    We add new tools to the inventory, review the logs regularly and update controls as regulation changes.

What does AI governance cover?

A policy document alone is not governance. First you need to know what is actually in use: which team uses which tool, on which account, with which data. In most companies the list is longer than expected. It includes chat tools on personal accounts, browser extensions and AI features switched on inside existing software.

After the inventory we ask the same questions of every use. Is personal data processed? Does data leave the country? Does the output decide something about a person? Is anything logged? The answers decide which controls are needed. If you already keep a GDPR record of processing activities or a KVKK data inventory, this work stays consistent with it.

KVKK, GDPR and the EU AI Act: which ones apply to you?

Regulation Who it concerns Typical question in an AI project
KVKK (Law No. 6698) Any company processing personal data in Türkiye What is the legal basis, and is data transferred abroad?
GDPR Companies processing personal data of people in the EU Is there automated decision-making, and were people informed?
EU AI Act Providers placing AI systems on the EU market, or whose output is used in the EU Which risk category is the system in, and what documentation is required?

Your legal counsel decides which regulation binds you and how far. Our job is to prepare the technical facts they need to make that call, accurately and completely, and then apply the decision to your systems.

We map data flows, classify systems, build access and logging controls and write the documentation. Your legal counsel decides the legal basis, the privacy notices, the transfer mechanism and how the risk category is interpreted. That split means no decision falls through the cracks.

This service differs from AI consulting. Consulting decides what to build; governance puts rules around everything that is built or used. We pair it with corporate AI training so teams actually learn the rules. For background, see our glossary entries on KVKK and the EU AI Act.

How we start

In a free first call we talk through the AI tools you use and plan to use. We then propose in writing the scope of the inventory and how we will work alongside your legal counsel, in English or Turkish.

How would this work in your business?

Tell us where you are in a free first call; we will say plainly where it makes sense to start.

Book a free call
ServiceAI consultingWe work out where AI fits in your business, with which data and model, and in what order to build it.
Use caseAI document analysisWe extract fields from contracts and specifications, compare clauses and answer with sources.
IndustryFinance and insuranceDocument analysis, onboarding, credit risk scoring and auditable AI for finance and insurance.
ServiceCorporate AI trainingRole-based workshops that teach your teams to use AI in their own work and within company rules.
Use caseCredit risk scoringOur approach to explainable credit risk scoring for lending and trade credit, and the prerequisites it needs.
ServiceMicrosoft Copilot consultingWe roll out Microsoft 365 Copilot once permissions and data are ready, and build Copilot Studio agents for specific teams.

Further reading

Connecting AI agents to systems with MCPIntegration patterns, authorization, prompt injection controls and human approval for connecting AI agents with MCP.Does the EU AI Act apply outside the EU?When the EU AI Act reaches companies outside the EU: scope, roles, risk levels and the current application timeline.ISO/IEC 42001 vs NIST AI RMFCertifiable standard versus voluntary framework, how both relate to the EU AI Act, and a starting order for small teams.

Our own products

We use the tools and checklists from client projects on our own products too.

All products →
iPhone and iPadFreelancerFlowAn iPhone and iPad app that takes solo freelancers from brief to paid: plan, quote, invoice and payment follow-up.
Web, mobile-firstVilla YönetA mobile-first app for villa and guesthouse operators to run bookings, calendar, occupancy, income and expenses.
WordPress pluginPromptorAn AI assistant that answers questions 24/7 from your WordPress content and captures leads in the chat.

Key terms

  • AI governanceAI governance is the set of policies, roles and processes that determine how an organisation selects, uses, oversees and manages the risks of its AI systems.
  • KVKK (Turkish Personal Data Protection Law)KVKK is Türkiye's Personal Data Protection Law, Law No. 6698, which sets the rules for processing personal data and the rights of individuals in Türkiye.
  • EU AI ActThe EU AI Act is Regulation (EU) 2024/1689, which classifies AI systems in the European Union by risk level and sets obligations for providers and deployers accordingly.
  • AI hallucinationAn AI hallucination is output in which a language model presents information, a source or a figure that does not exist, fluently and confidently, as if it were true.
  • LLM (Large Language Model)An LLM (large language model) is an AI model trained on very large amounts of text that answers questions, summarises, translates and writes by predicting what text should come next.

Frequently asked questions

Does this service guarantee compliance?

No. Compliance decisions belong to you and your legal counsel. We make your AI use visible, classify the risks and build the technical controls, and settle every point that needs legal interpretation together with your lawyers.

Could our staff be pasting customer data into ChatGPT?

Without rules, very likely. The inventory makes it visible. We then write down which tool may be used with which data and reduce risky use with company accounts and technical controls.

Does the EU AI Act apply to a company based in Türkiye?

It can, if you place an AI system on the EU market or its output is used in the EU. We pre-classify your systems against the Act's risk categories and document them for your legal counsel to assess.

What is KVKK and how does it relate to GDPR?

KVKK is Türkiye's personal data protection law, Law No. 6698. It shares many principles with GDPR but differs in areas such as cross-border transfers and registration with the national data controller registry, VERBİS. Companies operating in both markets usually need to meet both.

What does an AI acceptable use policy look like?

A few pages of plain rules: which tools are approved, which data never goes into any tool, who checks the output and whom to ask when in doubt. It is published after your legal counsel has reviewed it.

What happens when the AI gets something wrong?

That is why human oversight points are designed in. Outputs that affect a customer or a decision have an approval step, a log entry and a way to reverse them. The policy also lists the decisions that are never left to AI.

AI governance and compliance: let’s take the first step together

Tell us where you are in one call; we will share a scope and roadmap in writing.

Book a free call

How we start

  1. A free first callWe pin down the problem and the goal together.
  2. A 2-week discovery sprintWe look at the data, the process and the tools, and decide where to start.
  3. A written proposalScope, architecture and timeline, in writing.
Book a free call