It is the middle of the night and a notification on your phone wakes you up. Your AI assistant has bought a plane ticket in your name, saying “I found the best price”; but for the wrong date. On top of that, it has sent birthday flowers to the partner you broke up with three months ago, with a card reading “With all my love… You are my everything.” Both of you have long since moved on. Who is responsible for this?
This is not a scene from a romantic comedy; it is the near future. Last week at Istanbul Fintech Week, Hatice Karahan, Deputy Governor of the Central Bank of the Republic of Türkiye, said: “The next development in payments is the use of artificial intelligence.” In other words, we will set the limits and AI will make the payments.
As lawyers, we receive powers of attorney all the time. A client thinks carefully before granting authority and sometimes limits it in time and in scope. Yet we give AI applications far broader authority with a single “allow” button, without reading the terms.
The legal framework is this: AI has no legal capacity (Turkish Civil Code, Art. 8), so it cannot be our representative either (Turkish Code of Obligations, Arts. 40-48). The most sound interpretation is to treat a transaction made by an AI agent as our own declaration of intent.
What if our intent reaches the other party contrary to what we meant? Can the rule on “error in transmission” in Article 33 of the Code of Obligations apply? Under the Code, if intent is transmitted incorrectly “by an intermediary such as a messenger or interpreter, or by a means”, the rules on error apply. When the legislator said “a means”, it had the telegraph in mind; today the word can be read to include an AI agent. In the case of a fundamental error (Art. 31), we can declare within one year of learning of it that we are not bound by the contract (Art. 39). But the party at fault for its own error must compensate the other side’s loss (Art. 35); a person who runs an agent without limits or oversight may not be considered free of fault.
The Payment Services Regulation (Art. 54), for its part, places the burden of proof on the payment service provider for a transaction we did not authorise and allows us to request a correction within thirteen months. But if we authorised the agent ourselves, will the transaction count as “unauthorised”? Today’s rules were not written with this question in mind.
If the contract of the company offering the agent says “we are not liable for the AI’s errors”, remember Article 115 of the Code of Obligations: an agreement excluding liability for gross negligence is absolutely void, and for services carried out under a licence, even an exclusion of liability for slight negligence is void.
The law will lag behind once again. But what about the human side?
Think of the fraudsters who call our technologically less confident parents every day. Now they will also face transactions made by agents they authorised without knowing it, or after being deceived. Who will be liable for the loss, and who will protect them?
It is easy to blame others. If what most distinguishes human beings from other living things is the ability to choose by free will, will handing all our daily decisions to AI simply because it is convenient not make us indistinguishable from machines? In the age of machines, how much room will be left for us?
Some of these questions will be answered by lawyers, some by thinkers. Our task is not to stay out of the process.
Sources
- Dünya, 6 October 2026 – Karahan’s speech at Istanbul Fintech Week (in Turkish)
- Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers, Article 54 (official Turkish text)
- Turkish Civil Code No. 4721, Article 8 (official Turkish text)
- Turkish Code of Obligations No. 6098, Articles 31, 33, 35, 39, 40-48 and 115 (official Turkish text)
Originally posted on LinkedIn.
