What if an Algorithm Became the Manager: The Legal Limits of AI-Based Personnel Performance Appraisal?

Artificial intelligence systems are now used not only in recruitment processes but also in human resources applications such as measuring employee performance, determining bonuses, making promotion decisions, shift scheduling, and terminating employment contracts.

An employee's performance can be assessed using artificial intelligence by analyzing factors such as the number of tasks completed, customer satisfaction score, arrival and departure times, sales figures, email response time, or the quality of call center interactions.

However, the ability of artificial intelligence to make quick and quantitative assessments does not always mean that its decisions are correct, objective, or legally compliant. If the data used by the system is incomplete, inaccurate, or discriminatory, the resulting performance score may also be unfair.

Therefore, the fundamental question is not whether performance evaluation can be done with artificial intelligence, but rather what data, criteria, and legal safeguards will be used for this evaluation.

Is AI-based performance evaluation fair?

Using artificial intelligence for employee performance evaluations is not inherently illegal. A well-designed system can reduce discrepancies that may arise from managers' personal relationships, biases, or arbitrary opinions.

However, allowing artificial intelligence to conduct the assessment completely independently and implement its results without question carries serious legal risks.

For a fair assessment to take place, the system must:

• The employee uses data directly related to the work they are doing
• It should be based on predetermined criteria that have been communicated to the employee
• It should be applied equally to personnel working in the same or similar roles
• Taking into account technical malfunctions, leaves of absence, and events beyond the employee's control,
• Regular monitoring of whether it produces discriminatory results,
• It should grant the employee the right to appeal the result
• Reconsideration of the final decision by an authorized person

is necessary.

Artificial intelligence can be used as a tool to support a manager's decision under these circumstances. However, basing important outcomes such as employee promotion, salary reduction, or dismissal solely on the algorithm's score may be incompatible with the principles of fairness and proportionality.

The Basis for Performance Evaluation with Artificial Intelligence in Turkish Law

In Türkiye, a specific labor law comprehensively regulating the evaluation of employees using artificial intelligence has not yet been implemented. A general Artificial Intelligence Law Proposal is also currently before the Turkish Grand National Assembly committee as of July 31, 2026. Therefore, current practices should be evaluated within the framework of existing general provisions, primarily the Constitution, the Labor Law No. 4857, and the Personal Data Protection Law No. 6698.

1. Equality and prohibition of discrimination

Article 10 of the Constitution guarantees equality before the law. Article 5 of the Labor Law also prohibits employers from discriminating in employment relationships on the basis of language, race, gender, disability, political opinion, religion, sect, or similar reasons.

Even if an employer doesn't intend to discriminate, a discriminatory outcome can still occur if the AI ​​system they use systematically gives certain employee groups low scores.

For example, artificial intelligence trained on historical data from a company where male employees were predominantly selected for management positions could learn the characteristics of male employees as profiles for successful managers. Similarly, indirectly undervaluing the performance of women on maternity leave, employees with disabilities, union members, or older personnel could violate the prohibition against discrimination.

The defense that "the decision was made by artificial intelligence" does not absolve the employer of responsibility. The employer is the party that chooses, uses, and applies the system to the employment relationship.

2. The right to protection of personal data

Employee performance scores, sales figures, working hours, customer interviews, computer usage records, camera footage, audio recordings, location information, and behavioral analyses are considered personal data.

Article 20 of the Constitution guarantees individuals the right to be informed about personal data concerning them, to access this data, to request its correction or deletion, and to learn whether the data is being used for its intended purposes.

Therefore, an employer's right to manage does not give them the unlimited authority to monitor an employee and collect all kinds of data about them.

Basic Legal Limits from the Perspective of the Personal Data Protection Law

There must be a specific and legitimate purpose

The employer must first clearly state the purpose for which they are using the artificial intelligence system.

General and unsubstantiated statements such as "increasing productivity" are insufficient on their own. It must be clearly defined which positions will be evaluated, which performance indicators will be used, and how the results will be assessed in bonus, promotion, training, or termination processes.

The employee's data may not be used later for purposes other than those initially disclosed.

The data collected should be necessary and proportionate

According to the KVKK (Turkish Personal Data Protection Law), personal data must be processed for specific, explicit, and legitimate purposes; and in a manner that is relevant to the purpose, limited, and proportionate.

Measuring a sales representative's performance through sales volume, customer satisfaction, and return rates may be job-related. However, constantly monitoring an employee's keyboard movements, personal phone usage, facial expressions, tone of voice, or screen activity per minute can often constitute disproportionate interference.

The Personal Data Protection Authority also emphasizes that in workplace camera applications, the purposes should be determined in advance, data minimization should be carried out, and no more data should be processed than is necessary to achieve the purpose.

The fact that data is technologically obtainable does not mean it can be legally processed.

Obtaining explicit consent is not a solution in every case

Employers often believe they have made all data processing activities lawful by obtaining broad, explicit consent from employees under the Turkish Personal Data Protection Law (KVKK). However, this approach is incorrect.

Explicit consent must be a declaration of will given freely and based on informed knowledge regarding a specific matter. Whether the employee truly made a free choice must also be examined, given the economic and hierarchical dependency between employee and employer.

The Personal Data Protection Board explicitly states that consent cannot be considered based on free will in cases where the employee is not effectively given the opportunity to refuse consent, or where refusing consent could have negative consequences for the employee.

Therefore, data processing activities in performance systems primarily focus on:

• Being directly related to the establishment or performance of an employment contract,
• The employer must fulfill its legal obligations
• The establishment, exercise, or protection of a right,
• The legitimate interest of the employer, provided that it does not prejudice the fundamental rights of the employee

This should be evaluated in terms of the data processing conditions in Article 5 of the KVKK (Law on Protection of Personal Data).

When performance evaluation is based on legitimate interest, a balance must be struck between the employer's interest and the employee's right to privacy and protection of personal data. If a less intrusive method for performance evaluation is available, a method that intensively monitors the employee should not be preferred.

The employee must be clearly informed

The employer must inform the employee when collecting personal data;

• Which data was collected,
• From what sources the data was obtained,
• For what purpose is artificial intelligence used?
• How the performance score is generated,
• To whom the data was transferred,
• How long the data will be stored,
• What legal basis the assessment is based on,
• Employee's rights to object and appeal

It should be explained.

The disclosure to be made under Article 10 of the KVKK (Turkish Personal Data Protection Law) must be clear, understandable, and concrete. General statements such as "Your data is processed for the purpose of carrying out human resources processes" may not be sufficient to explain intensive algorithmic monitoring activities.

The Personal Data Protection Board's principle decision dated February 18, 2026, also stated that information texts should be simple and understandable, vague expressions should not be used, and the information text and the explicit consent text should be prepared separately.

The employee has the right to appeal the automated decision

According to Article 11, paragraph 1, subparagraph (g) of the KVKK (Law on Protection of Personal Data), the data subject may object to a result that is detrimental to them arising from the analysis of their personal data exclusively by automated systems.

This provision does not completely prohibit performance evaluation using artificial intelligence. However, it requires that an effective appeals mechanism be provided to the employee if the system produces negative results about the employee without human intervention.

For example, as a result of a low score given by artificial intelligence, the employee;

• Deprivation of bonuses,
• Removal from the promotion list,
• Changing duty station,
• Salary reduction,
• Facing disciplinary action,
• Termination of employment contract

In such cases, the employee may request a review of the data and results on which the evaluation was based.

It is not enough for the human authority reviewing the appeal to simply approve the algorithm's result. The authority must genuinely consider the data, the context, the employee's explanations, and the possibility of system error.

Can AI Performance Scores Be a Reason for Dismissal?

According to Article 18 of the Labor Law, reasons stemming from an employee's competence or conduct may constitute a valid reason for termination if certain conditions are met. However, for poor performance to be considered a valid reason for termination, the evaluation must be objective and verifiable.

According to the established approach of the Supreme Court, performance criteria are:

• It must be predetermined
• It must be communicated to the worker
• It should be related to the knowledge, skills, and experience required for the job
• It must be measurable and verifiable
• It should be created in a way that is specific to the workplace and the job being done
• It should be based on realistic and achievable goals.

Therefore, terminating an employment contract based solely on a score generated by artificial intelligence is significantly risky. The employer must also:

• The poor performance is persistent,
• That the performance targets are reasonable and achievable,
• That the same principles apply to employees in the same position,
• Systemic failures and external factors have been eliminated
• The employee was given a reasonable amount of time to improve their performance
• That the necessary training and guidance have been provided,
• The employee's statement has been taken
• Feshin is the last resort

It needs to be presented.

An algorithmic report can be evidence supporting an employer's assessment; however, it should not be used as the sole and unquestioned ground for termination.

Can facial, voice, and emotion analysis be used?

Some artificial intelligence systems can deduce factors such as stress, anger, motivation, loyalty, or likelihood of leaving an employee based on their facial expressions, tone of voice, or manner of speaking.

Such practices carry extremely high legal risks.

Facial and voice analyses may lead to the processing of biometric data; inferences about stress, mental state, or health status may lead to the processing of health data. Biometric and health data are considered special categories of personal data under the Turkish Personal Data Protection Law (KVKK).

Furthermore, drawing definitive conclusions about a person's diligence, honesty, motivation, or reliability based solely on facial expressions or tone of voice is debatable from both scientific and legal perspectives. Cultural differences, disability status, speech patterns, and personal characteristics can all lead to inaccurate assessments.

The European Union Artificial Intelligence Regulation prohibits the use of emotion recognition systems in the workplace, except for limited exceptions for medical or safety purposes. The regulation also considers certain AI systems used in recruitment, employee management, task assignment, monitoring, and performance evaluation to be high-risk.

Although this regulation does not directly apply to every employer in Türkiye, it constitutes an important international standard in terms of protecting employee rights. For Turkish companies operating in the European Union or using the system within the EU, the scope of application of the Regulation should be evaluated separately. With the AI ​​Omnibus regulation, which entered into force in the EU on July 27, 2026, the implementation date of the rules regarding high-risk systems under Annex III has been postponed to December 2, 2027.

The Use of Artificial Intelligence Services Abroad

If an employer uses a foreign AI or human resources platform, employee data may be transferred to servers located abroad.

Cloud-based performance software;

• Employee names,
• Email and meeting contents,
• Performance reports,
• Audio or video recordings,
• Customer reviews

Uploading this data may result in the transfer of personal data abroad.

In this case, the conditions for transferring data abroad stipulated in Article 9 of the KVKK (Turkish Personal Data Protection Law) must be met. Appropriate safeguards include standard contracts and binding company rules. The standard contract must be notified to the Authority within five business days of its signing.

Employers should not rely solely on the software company's statement that it is "compliant with GDPR". They should also examine where the data is stored, who the subcontractors are, whether the data is used for model training purposes, and whether the data will be deleted upon termination of the contract.

How to Establish a Legally Compliant AI Performance System?

Employers who follow these steps will significantly reduce legal risks:

1. An analysis of objectives and needs should be conducted

It should be evaluated whether artificial intelligence is truly needed and whether the same goal can be achieved with a method that processes less data.

2. Position-specific criteria should be determined

Instead of applying the same criteria to every employee, performance criteria appropriate to the nature of the job should be established. It is not fair to evaluate sales personnel and legal counsel using the same productivity metrics.

3. Factors beyond the employee's control must be eliminated

Technical malfunctions, customer volume, differences in task assignments, leaves of absence, illnesses, regional economic conditions, and delays caused by management must be taken into account by the system.

4. A discrimination test should be conducted

The system should be regularly checked to see if it systematically produces more negative outcomes for women, people with disabilities, older workers, union members, or specific groups.

5. Employees should be informed in advance

The criteria, data sources, scoring methodology, and how the results will be used should be explained to employees before the implementation begins.

6. Human supervision should be mandatory

Important decisions such as bonuses, promotions, disciplinary actions, or termination should not be left solely to the results of artificial intelligence. The responsible person should also consider the employee's statements and the specific working conditions.

7. An appeals mechanism should be established

Employees should be able to easily file complaints alleging incorrect data, erroneous scoring, or discriminatory results; their complaints should be processed with reasoned justification.

8. A registration and monitoring system should be established

The algorithm must record which data it used, how the score was generated, how human intervention was involved, and who made the final decision.

9. Storage times should be limited

Performance data should not be stored indefinitely; it should be deleted, destroyed, or anonymized after the period required by purpose and legislation.

10. Supplier contracts should be reviewed

The AI ​​service provider's obligations regarding data security, privacy, subcontractors, transfer of data abroad, data breach notification, and data deletion should be clearly defined in the contract.

Conclusion

Using artificial intelligence for employee performance evaluations is not absolutely prohibited. In fact, when used correctly, it can help in making more consistent and measurable human resources decisions.

However, artificial intelligence is not a tool that gives employers unlimited management rights. Continuous monitoring of employees, collection of data unrelated to their private lives, personality analysis based on facial expressions or voice, application of unexplained algorithmic scores, and completely automated negative judgments about employees can all lead to serious legal liability.

In a fair system, artificial intelligence is a decision support tool, not the decision-maker. The final evaluation must be based on objective criteria, accurate data, transparency, human oversight, and the employee's right to effective objection.

Especially in cases of termination based on poor performance, the score given by the algorithm alone should not be considered sufficient; the objectivity, prior notice, continuity, defense, training, and termination as a last resort requirements sought by the Supreme Court must also be met.

Otherwise, a system that appears technological and neutral could in reality turn into a discriminatory, disproportionate, and unlawful employer practice.