Many companies have published an "AI use policy" in the last two years. Most of them are well-meant texts written by the legal team or an outside lawyer, and most of them cannot be enforced. "Employees may not share confidential information with external AI tools" is the right sentence. But who checks it, with which tool, and how? Without an answer, the policy is just paper.
At TalyaSmart we do not replace your lawyers. Your lawyers write the policy. We build its technical counterpart and work out what has to be bought to enforce it, and what it will cost.
Technical support for the legal team
Lawyers know the regulations. They cannot always know which system a piece of data flows through, which country a cloud service stores data in, or whether an AI tool uses what you type to train its models. We fill that gap:
- Technical mapping of KVKK (Turkey's data protection law) and GDPR: We define what "appropriate technical measures" actually means in your company.
- Technical clauses for the AI use policy: Which tools are approved, which data classes may go into which tool, how use is logged.
- Data classification and access model: We sort company data into classes such as public, internal, confidential and personal, and decide who can access what.
A good policy is one you can audit. A rule you cannot audit is only good intentions.
Technical specification for implementation
Once the policy is approved, the real question starts: what do we need to buy? At this point most companies either follow the vendors' sales decks or do nothing. We prepare a specification your procurement team can use directly:
- Goods: Servers, network and security hardware, licences and, if needed, on-premise AI infrastructure.
- Services: Installation, integration, maintenance, 24/7 monitoring and training.
- Technical requirements: Data loss prevention (DLP), identity and access management, logging and retention, encryption and backup.
The specification is vendor-neutral. The goal is that several suppliers can bid against the same document and their offers can be compared like for like.
Budget
The first question from the board is "how much?" The budget work covers:
- CAPEX and OPEX breakdown: One-off investment and yearly running cost, shown separately.
- Supplier comparison table: Each offer scored against every item in the specification.
- Phased rollout plan: Instead of one big investment, a step-by-step plan that starts with the highest-risk areas.
Why now?
AI tools spread fast, and regulation follows. Companies that export to the European Union already face questions under the EU AI Act, and companies serving corporate clients face supplier security questionnaires. Being able to answer those questions is now a competitive advantage.
To see where you stand first, start with the AI Readiness Assessment. To work alongside your legal team, talk to us.