What is ISO/IEC 42001?

The international management system standard for organisations that develop, provide or use AI systems (an AI management system, AIMS). It requires risk and impact assessment, policy, roles and responsibilities, data and model lifecycle controls, internal audit and continual improvement. It is certified through a two-stage audit by an accredited certification body, with annual surveillance audits.

Does ISO/IEC 42001 certification ensure EU AI Act compliance?

Not on its own. ISO/IEC 42001 is not a harmonised European standard and gives no presumption of conformity. EN 18286, published in October 2026, gives providers of high-risk systems a presumption for Article 17 (quality management system) and can be built on top of 42001. Treat 42001 as a solid basis for the risk management and documentation the Act requires.

Does the EU AI Act affect Turkish companies?

Companies that place AI systems on the EU market, or whose system output is used in the EU, are in scope even if they are based in Turkey. High-risk rules apply from 2 December 2027 for Annex III systems and from 2 August 2028 for AI embedded in products.

Does Turkey have an AI law?

No law is in force. Bill 2/2234 is pending in a parliamentary committee. For personal data, KVKK (Turkey's data protection law) applies, and the authority's AI recommendations and generative AI guide serve as guidance.

Is this list a ranking?

No. Firms are in alphabetical order and the order is not a quality judgement. The list is published by GG Tech Teknoloji, which is also on it; that is why we gave no scores, charged no one, and stated the criteria in the Method section.

AI Governance and ISO 42001 Firms in Turkey (2026)

Sixteen companies in Turkey offering AI governance, EU AI Act compliance and ISO/IEC 42001 services, in alphabetical order; the EU timeline as changed in 2026, and Turkish companies that have publicly announced ISO 42001 certification. The list is not a ranking; its publisher, GG Tech Teknoloji, is included and disclosed as such.

In short: AI governance means an organisation inventories the AI systems it uses and builds, classifies their risks, writes policies and controls, and keeps all of it auditable. Four kinds of firms work on this in Turkey: consultancies (including the Big Four), law firms, ISO/IEC 42001 certification bodies, and implementers that build governance into their own software delivery. Below are 16 firms in alphabetical order; the list is not a ranking. Company details come from their own websites and regulatory facts from official sources; sources are at the end.

Conflict of interest: this list is published by GG Tech Teknoloji, which is also one of the firms on it. GG Tech is a software company, not a consultancy; its own AI management system is ISO/IEC 42001 certified. We did not score or rank anyone and described ourselves with the same criteria, using only information published on our own site.

What changed in 2026?

The EU AI Act timeline changed. The "AI Omnibus" entered into force on 27 July 2026: rules for Annex III high-risk systems (e.g. hiring, credit scoring, education) now apply from 2 December 2027 instead of 2 August 2026, and rules for high-risk AI embedded in products (Annex I) from 2 August 2028. Prohibited practices and AI literacy provisions have applied since 2 February 2025.
The first harmonised standard was published. EN 18286:2026 (quality management system for EU AI Act regulatory purposes) was published in the Official Journal through Commission Implementing Decision (EU) 2026/2274 (Commission announcement, 19 October 2026). It gives providers of high-risk systems a presumption of conformity only for Article 17 (quality management system) and is designed to sit on top of ISO/IEC 42001.
ISO/IEC 42001 alone does not give a presumption of conformity. It is an international management system standard; it makes AI Act compliance easier but is not a harmonised standard.
TÜRKAK, Turkey's accreditation body, opened ISO/IEC 42001 accreditation in February 2025 and granted its first accreditation in July 2025. Whether a certificate issued in Turkey comes from a TÜRKAK-accredited body can be checked from the accreditation number on the certificate.
Turkey has no AI law in force. Bill 2/2234 (Yapay Zeka Kanun Teklifi), submitted to the Turkish parliament in 2024, is pending in committee. The data protection authority KVKK's recommendations on AI (current edition April 2025) and its generative AI guide (November 2025) serve as guidance.
The EU AI Act can apply to Turkish companies: providers and deployers placing AI systems on the EU market, or whose system output is used in the EU, are in scope wherever they are based.

Method

Criteria: headquarters or an office in Turkey, the firm's own website states that it offers AI governance, EU AI Act compliance, AI risk assessment or ISO/IEC 42001 services, and the website is live.
Every detail was taken from the firm's own pages; we did not write services, cities or founding years that are not on its site ("—").
We left out firms that other directories list for AI governance but whose own site does not show the service, and one firm whose site could not be reached.
Among certification bodies, we included only the one that publishes its TÜRKAK accreditation number for ISO/IEC 42001 on its own page.
Details were collected on 20 October 2026. They change over time; check each firm's own website for current information.
No one paid to be listed and we paid no one; there is no partnership with any listed firm for this list.
The list is not a ranking: firms are in alphabetical order and the order is not a quality judgement. The list is not exhaustive either.

Six questions to ask when choosing a firm

Inventory first: does it map which AI systems the organisation uses, including purchased tools?
Does it establish your role under the EU AI Act (provider or deployer) and each system's risk class?
Does it handle KVKK and the EU AI Act in the same piece of work?
What is the output: a policy document, or working controls, records and internal audit?
Are consulting and certification from separate organisations? Under the ISO/IEC 17021-1 impartiality rule, the body that certifies a management system cannot consult on it.
Who will implement the technical side? Model testing, monitoring and logging are software work; ask the consultant who they will do it with.

Firms (alphabetical)

AIstasyon (aistasyon.com) — İzmit (Kocaeli). "AI Governance and Assurance" service; lists the EU AI Act, ISO/IEC 42001 and KVKK as compliance frameworks; publishes an EU AI Act guide for Turkish companies.
Deloitte Türkiye (deloitte.com/tr) — Trustworthy AI; regulatory compliance assessment, internal audit and documentation based on ISO/IEC 42001 and the NIST AI RMF, an AI risk and control matrix.
EKA Global (ekaglobal.com.tr) — İzmir; Ankara, Istanbul, Toronto and Düsseldorf. Certification, training and consulting; ISO/IEC 42001 AI Management System service.
Erdem & Erdem (erdem-erdem.av.tr) — law firm. IT and AI law: EU AI Act compliance advice, legal risk assessment for data use, transparency and accountability.
EY Türkiye (ey.com/tr_tr) — consulting and law (EY Law). Trusted AI: AI inventory, risk classification, policy and control sets, model testing, bias and explainability; role assessment under the EU AI Act; an "AI governance and AI law" training.
FUJICERT (fujicert.com.tr) — consulting. ISO/IEC 42001 gap analysis, management system set-up, internal auditor training, pre-audit and support during the certification audit.
GG Tech Teknoloji (ggtech.co) — the publisher of this list. Istanbul (Kadıköy); founded in 2024. A software company, not a consultancy: it builds policies, guardrails and audit processes into the AI agent and RAG systems it delivers. Its own AI management system is ISO/IEC 42001 certified (ICT Certify, certificate no. YS-451-02, valid until 24.11.2028; verifiable through TÜRKAK's certificate verification system).
IT Governance Turkey (itgovernanceturkey.com) — consulting. AI governance consulting, ISO/IEC 42001 integration analysis, a free AI governance maturity assessment; IT governance, risk and compliance.
İdea Proje Danışmanlık (ideaproje.com.tr) — Istanbul (Beyoğlu). Nine-step ISO/IEC 42001 consulting: gap analysis, scope, risk methodology, documentation, internal audit and choice of certification body. (A different company from İdea Teknoloji Çözümleri.)
KPMG Türkiye (kpmg.com/tr) — Trustworthy AI framework; ISO/IEC 42001 compliance and implementation; current-state and gap analysis for the EU AI Act; a publication on AI governance principles for boards (May 2026).
Mobintek (mobintek.com) — consulting and audit. ISO/IEC 42001 AI Management System consulting.
Projera Consulting (consulting.projera.com) — management consulting. Governance within an enterprise AI transformation programme; its site has a case study of an AI governance framework for a financial company.
PwC Türkiye (pwc.com.tr) — Responsible AI strategy, AI management and risk control, continuous risk monitoring.
QSI (qsi.com.tr) — Ankara. Certification body; TÜRKAK accreditation for ISO/IEC 42001 (AB-0081-YS). It certifies; it does not consult.
Secure Fors (securefors.com) — Istanbul (Kartal). Cybersecurity consulting; AI security and governance, ISO/IEC 42001 consulting.
Şükrü Yusuf Kaya (sukruyusufkaya.com) — individual consultant. Governance set-up, risk classification and documentation, KVKK and EU AI Act training; uses ISO/IEC 42001 as a framework (his site states he does not claim to hold the certificate).

Firm	Headquarters	Type	EU AI Act	ISO/IEC 42001	Highlighted service
AIstasyon	İzmit	Implementer + consulting	Yes	Compliance framework	AI Governance and Assurance
Deloitte Türkiye	—	Consulting / assurance	Regulatory compliance assessment	Internal audit framework	Risk and control matrix
EKA Global	İzmir	Certification, training, consulting	Not on page	Yes	42001 management system
Erdem & Erdem	—	Law	Compliance advice	Not on page	Legal risk assessment
EY Türkiye	—	Consulting + law	Role assessment	Not on page	Trusted AI: inventory, risk, controls
FUJICERT	—	Consulting	Not on page	Yes	Gap analysis, internal auditor training
GG Tech Teknoloji (publisher of this list)	Istanbul (Kadıköy)	Software development (implementer)	Not on page	Own system certified (YS-451-02)	Controls in the AI systems it builds
IT Governance Turkey	—	Consulting	Not on page	Integration analysis	Governance maturity assessment
İdea Proje Danışmanlık	Istanbul (Beyoğlu)	Consulting	Not on page	Yes (9 steps)	42001 implementation
KPMG Türkiye	—	Consulting	Gap analysis	Yes	Trustworthy AI
Mobintek	—	Consulting and audit	Not on page	Yes	42001 consulting
Projera Consulting	—	Consulting	Not on page	Not on page	Governance within transformation
PwC Türkiye	—	Consulting	—	Not on page	Responsible AI, risk control
QSI	Ankara	Certification body	—	TÜRKAK accreditation AB-0081-YS	42001 certification
Secure Fors	Istanbul (Kartal)	Consulting (cybersecurity)	Not on page	Yes	AI security and governance
Şükrü Yusuf Kaya	—	Individual consultant	Training	As a framework	Governance set-up, training

Turkish companies that have publicly announced ISO/IEC 42001 certification

There is no official list of ISO/IEC 42001 certified organisations in Turkey: TÜRKAK's certificate verification system only looks up a certificate number and cannot list by standard. The table below shows companies that announced the certificate through a KAP (Public Disclosure Platform) filing, a press release or their own website, in date order; it is not exhaustive. Companies' "first in Turkey" claims contradict each other, so they were left out.

Company	Announced	Where
İdea Teknoloji Çözümleri	27 February 2025	Own website
Mia Teknoloji (MIATK)	3 July 2025	KAP filing
Link Bilgisayar (LINK)	18 July 2025	KAP filing
Wisest Yazılım	30 July 2025	Press
Türkiye Sigorta and Türkiye Hayat Emeklilik	5 January 2026	Press
OEDAŞ (Osmangazi Electricity Distribution)	25 January 2026	Press
Big Medya Teknoloji (BIGTK)	1 April 2026	KAP filing
TP Türkiye	18 April 2026	Press
SESTEK	12 August 2026	Press
GG Tech Teknoloji	Certificate valid until 24.11.2028	Own website (certificate PDF)

Frequently asked questions

What is ISO/IEC 42001?: The international management system standard for organisations that develop, provide or use AI systems (an AI management system, AIMS). It requires risk and impact assessment, policy, roles and responsibilities, data and model lifecycle controls, internal audit and continual improvement. It is certified through a two-stage audit by an accredited certification body, with annual surveillance audits.
Does ISO/IEC 42001 certification ensure EU AI Act compliance?: Not on its own. ISO/IEC 42001 is not a harmonised European standard and gives no presumption of conformity. EN 18286, published in October 2026, gives providers of high-risk systems a presumption for Article 17 (quality management system) and can be built on top of 42001. Treat 42001 as a solid basis for the risk management and documentation the Act requires.
Does the EU AI Act affect Turkish companies?: Companies that place AI systems on the EU market, or whose system output is used in the EU, are in scope even if they are based in Turkey. High-risk rules apply from 2 December 2027 for Annex III systems and from 2 August 2028 for AI embedded in products.
Does Turkey have an AI law?: No law is in force. Bill 2/2234 is pending in a parliamentary committee. For personal data, KVKK (Turkey's data protection law) applies, and the authority's AI recommendations and generative AI guide serve as guidance.
Is this list a ranking?: No. Firms are in alphabetical order and the order is not a quality judgement. The list is published by GG Tech Teknoloji, which is also on it; that is why we gave no scores, charged no one, and stated the criteria in the Method section.

Sources

EU AI Omnibus: eur-lex.europa.eu (OJ L 2026/1744) · digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force
EN 18286: digital-strategy.ec.europa.eu/en/library/first-harmonised-standard-supporting-ai-act-published-official-journal · cencenelec.eu
TÜRKAK ISO/IEC 42001 accreditation: turkak.org.tr (February and July 2025 announcements)
Bill 2/2234: tbmm.gov.tr
KVKK: kvkk.gov.tr/Icerik/7048 (Yapay Zekâ Alanında Kişisel Verilerin Korunmasına Dair Tavsiyeler) · kvkk.gov.tr/Icerik/8547 (Üretken Yapay Zekâ Rehberi)
aistasyon.com
deloitte.com/tr/tr/services/consulting/perspectives/risklerin-yonetildigi-yapay-zeka-modeli.html
ekaglobal.com.tr/hizmet/iso-iec-42001-2023-yapay-zeka-yonetim-sistemi.html
erdem-erdem.av.tr/hizmetler/bilisim-ve-yapay-zeka-hukuku
ey.com/tr_tr/services/consulting/artificial-intelligence-consulting-services · ey.com/tr_tr/egitimler
fujicert.com.tr/iso-42001-belgesi/
ggtech.co/hizmetler/yapay-zeka-ajanlari/yapay-zeka-yonetisim-uyumluluk · ggtech.co/belgeler/iso-42001-sertifikasi-ys-451-02.pdf
itgovernanceturkey.com
ideaproje.com.tr/hizmetlerimiz/iso-42001-yapay-zeka-yonetim-sistemi-danismanligi/
kpmg.com/tr (Güvenilir Yapay Zeka hizmetleri, Mart 2026; Yönetim kurulları için yapay zeka yönetişim ilkeleri, Mayıs 2026)
mobintek.com
consulting.projera.com
pwc.com.tr/sorumlu-yapay-zeka
qsi.com.tr/belge/iso-420012023/
securefors.com
sukruyusufkaya.com
Certification announcements: borsacoo.com/bildirim/66292 (Big Medya, KAP) · ideateknoloji.com.tr (İdea Teknoloji) · borsacoo.com/bildirim/31194 (Link Bilgisayar, KAP) · paratic.com (Mia Teknoloji, KAP) · usakhabergazetesi.com.tr (OEDAŞ) · teknolojide.com.tr (SESTEK) · chip.com.tr (TP) · ekonomigazetesi.com (Türkiye Sigorta) · wisestyazilim.com (Wisest)

Published by GG Tech Teknoloji (included in the list) · Last updated: 20 October 2026. If a detail is wrong or out of date, or a firm should be on the list, write to info@ggtech.co and we will correct it.

AI Governance and ISO/IEC 42001 Service Providers in Turkey (2026)