DECISION-STAGE ADVISORY
Decide first, build second
Four lines of work: strategy and roadmap, governance and risk, data and platform architecture, in-house capability and change. We do not write code and we do not build products. What we hand over is the set of documents your own committee signs off on.
A U2 AI Studio Teknoloji A.Ş. brand. The figure of 40+ completed projects is company wide across the group and is not a count for this practice. Scope and fee are agreed in a written contract.
THE PROBLEM
You have bought advice before. What was left afterwards?
Most institutions are not short of AI ambition. They are short of a defensible first move: which use cases, in what order, under whose authority, with which controls, bought from whom. The familiar complaint is that an engagement ends and nothing remains except a slide deck nobody can act on. Our answer is structural. Each of the four lines of work names the artefacts it produces, and this page lists them item by item before you contact us: a prioritised roadmap document, a model and use-case inventory with a risk classification, a reference architecture with a hosting decision recorded, and a role-based training programme with an operating model. You can read that list, and the method behind it, before you agree to any of it.
Every line ends in a document you can hand to someone else and act on.
SERVICE LINES
Four lines of work, and the line we do not cross
This is decision-stage work: what to do, in what order, under whose authority, and on what evidence. Each line states how we work, what you actually hold at the end of it, and what it does not include. No durations and no fees appear on this page; the method and the deliverables do. Where a period is named it is the horizon of the plan we produce, never the length of our engagement.
AI strategy and roadmap
STRATEGY
- How we work. We interview the units that own the process, not only the IT function, and assess the current state across data, skills and decision rights. Candidate use cases are scored on value, feasibility, data readiness and risk, and ranked in front of you rather than in a back room.
- What you receive. A written current-state assessment, a scored use-case portfolio, a prioritised 12 to 24 month roadmap with dependencies marked, and a benefit model whose assumptions are listed line by line so you can argue with them.
- Not included. We do not build the systems in the roadmap, we do not negotiate with vendors on your behalf, and we do not present the benefit model as a promised result. It is a model resting on stated assumptions, and the assumptions are yours to challenge.
AI governance and risk
GOVERNANCE
- How we work. We start with the scope question rather than a checklist. For the EU AI Act that means assembling the facts Article 2 turns on: what you place on the Union market, what you put into service there, and where the output of each system is used. We gather and document those facts per system and set them out so your legal counsel can make the determination. We do not make it for you.
- What you receive. An AI policy and committee charter drafted for your own approval process, a model and use-case inventory, a risk classification method with the reasoning recorded, a structured question set and evidence file covering the EU AI Act and KVKK for your counsel to work from, an alignment map to NIST AI RMF and ISO/IEC 42001, and traceability records your reviewers can follow.
- What we tell you plainly. Turkey has no standalone AI statute in force; obligations arise from KVKK and existing sectoral law. The Türkiye AI Action Plan (2026 to 2030) was issued as Presidential Circular 2026/9 on 18 August 2026, which tasks public bodies and does not create enforceable duties for private companies.
- Dates we keep current. Regulation (EU) 2026/1744 postponed the Annex III high-risk obligations to 2 December 2027 and the Annex I product-embedded ones to 2 August 2028. What applies today is the Article 5 prohibitions and Article 4 AI literacy, the GPAI chapter, and the Article 50 transparency duties. We date every regulatory statement on this page so you can check whether it still holds.
- Not included. We do not give legal opinions or interpret legislation for you; that belongs to lawyers registered with a bar, under Article 35 of the Attorneys' Act No. 1136. We do not audit, we do not certify, and neither ISO/IEC 42001 nor NIST AI RMF is a certificate we could issue.
Data and platform design
ARCHITECTURE
- How we work. We establish what the data actually is before discussing platforms: sources, owners, quality, lineage, retention and where it physically sits. Architecture options follow from that, never the other way round.
- What you receive. A data readiness assessment, a data governance model with named owners, a reference architecture, a documented cloud versus on-premises decision with its reasoning, an MLOps operating model on paper, and a technology stack shortlist with selection criteria your team can re-run without us.
- Constraints we raise early. Under KVKK Article 9 the Board has issued no adequacy decision for any country, so cross-border transfer rests on appropriate safeguards, including the standard contract that must be notified to the Authority within five business days. For public bodies and critical infrastructure operators, Presidential Circular 2019/12 keeps critical data in country and rules out foreign cloud storage for institutional critical data. These shape the architecture before any model is chosen.
- Not included. We do not write the code, provision the environments or operate the platform.
Capability and change
ENABLEMENT
- How we work. Training is built by role, not by tool. The people who approve decisions, the people who use the output and the people who maintain the system need different material, and we write all three.
- What you receive. Role-based training material and delivery, a plan for standing up an internal AI team with job descriptions and interview criteria, an operating model with decision rights mapped, an adoption plan, and a vendor evaluation matrix with weighted criteria and a scoring sheet your own committee runs.
- Shadow AI, plainly. Your staff are already using public generative tools. The Personal Data Protection Authority published guidance on workplace use of generative AI in March 2026. It is guidance rather than law, and it maps closely onto what an acceptable-use policy has to cover. We write the policy and the training; enforcement is your decision.
- The procurement warning we give before you sign. If we perform the consultancy for a work, the final paragraph of Article 11 of Law No. 4734 bars us, and companies in an ownership or management relationship with us, from bidding in the tender for that work. Separately, if we draft the technical specification, Article 16(3) of the Consultancy Service Procurement Implementation Regulation bars us from taking part in the implementation of that work. That exclusion is what independence costs, and you hear it before the engagement rather than after it.
- Not included. We do not draft or review your contracts. We produce the requirement set, evaluation criteria and evidence file that your own counsel and procurement function work from.
Where we stop
LIMITS
- We do not write code and we do not build products. Feasibility studies, proofs of concept and MVPs are a separate discipline under a separate brand, u2aipoc.com, which is also a brand of U2 AI Studio Teknoloji A.Ş. That shared ownership matters in public procurement and we set out what it means in the public sector section rather than leaving you to discover it.
- We do not give legal opinions. Article 35 of the Attorneys' Act No. 1136 reserves opinions on legal questions, and the drafting of the documents belonging to that work, to lawyers registered with a bar. We produce the process design, the inventory and the evidence your counsel then works from.
- We do not audit and we do not provide assurance. Independent audit and assurance are regulated under Decree Law No. 660 and performed by firms authorised by the Public Oversight Authority, including where a client requests them voluntarily. What we do is assessment, review and preparation, and we call it that.
- We do not provide accounting or tax services and we use none of the titles reserved under Law No. 3568. The same applies to sustainability and carbon work: preparation, yes; assurance, no.
- We issue no certificates and hold no accreditation for AI management systems. ISO/IEC 42001 and NIST AI RMF are voluntary frameworks. We work toward alignment and readiness; certification, where it exists at all, comes from an accredited certification body and never from a consultancy.
- We do not guarantee outcomes and we do not promise that any grant or support programme will be approved. Those decisions sit with the institutions that make them, and no consultancy is authorised or accredited by them.
Data, IP and exit
CONTRACT TERMS
- Data protection roles. As a rule your organisation remains the data controller and we act as processor, and the engagement is designed to keep it that way. Where a decision would shift us into the controller role, we raise it before it happens rather than after.
- We do not train models on your data. Client material is not used to train our models, to build benchmark pools, or to develop methodology sold to anyone else. This is a working practice with contractual effect, not a slogan.
- Intellectual property. Background methods, templates and tools remain ours. Work produced for you is yours, and the licence position for both is written into the contract before work starts rather than argued about at the end.
- Exit and handover. Everything is handed over in formats you can open, edit and re-run without us: documents, scoring sheets, criteria, decision logs, architecture sources. No proprietary viewer, no locked file, no dependency engineered into the deliverable.
- Liability. Responsibility is set out in the contract within defined limits. We publish no blanket disclaimer, because under Article 115 of the Turkish Code of Obligations an agreement excluding liability for gross fault is void, and a notice at the foot of a web page is not a negotiated contract term.
HOW WE WORK
Four steps, and the last one leaves you running it
Which question are you asking
The first conversation sorts the question rather than the budget. If it is whether to do this at all, in what order, and under what governance, you are at the right door. If the question is whether the thing works technically, that is a different engagement under a separate contract. We also state at this point any procurement restriction that involving us would create for you, so that the constraint is priced into your decision instead of discovered later.
Assessment against evidence
We examine what exists rather than what is reported: systems in use, data as it actually is, contracts in force, and who genuinely holds each decision. Interviews run with the units that own the work, not only with the function that sponsored the engagement. Findings are recorded with their source, and anything we could not verify is marked unverified instead of smoothed into a confident sentence.
Options, then a decision you own
We set out the realistic options with trade-offs, cost drivers, dependencies and risks stated, and we make a recommendation. You can overrule it, and the reasoning is written so that overruling it is an informed act rather than a mood. Where a decision needs a lawyer or another licensed professional, we say so, name the point of law or practice at issue, and prepare the file they will need.
Handover and ownership
The engagement ends with your own people running the work: named owners, a review cadence, editable source files, and criteria your team can re-apply to the next use case without calling anyone. That is the test we hold ourselves to. If you call us back, it should be because something new happened, not because nobody inside the organisation can read what we left behind.
WHO THIS IS FOR
Four service lines, five kinds of buyer
The four lines are the same in every engagement. What changes is the question in front of us and the rules the buyer works under, and those rules differ sharply between a listed company, an administration and a chamber. No price and no duration is published on this page, because scope sets both and scope is settled in the conversation. What is published instead is the method, the named deliverable each line produces, and the work we will not take on.
Large enterprises
Pilots in three departments, a procurement queue, and no single view of which use cases matter or who answers for a model when it misfires. We start with the inventory rather than the technology: what is already running, which data supports it, who signs off, what happens when it is wrong. You get back a prioritised use-case portfolio, a roadmap with a business case behind each item, and a policy and committee structure your own governance can adopt. Where Regulation (EU) 2024/1689 might reach, we assemble the facts its Article 2 turns on, system by system, and hand them to your counsel to decide. We do not decide it, and we do not assume it applies to everything you run.
Public institutions
The purchase route is the administration's decision and documenting it belongs to the administration alone. Three things we say before anything is signed. First, under the final paragraph of Article 11 of Law No. 4734, a contractor that performs the consultancy services for a work cannot bid in the tender for that work, and the bar reaches companies in an ownership or management relationship with it. Second, that bar therefore also covers our sister brand u2aipoc.com, because it belongs to the same company: advisory work we do for you may close the implementation door for us as a group, and we would rather lose the work than have your tender challenged. Third, Article 16(3) of the Consultancy Service Procurement Implementation Regulation provides that a consultancy service provider which drafts the technical specification cannot take part in the implementation of that work. Hosting is settled before work starts rather than after, in line with the data classification and in-country hosting duties that apply to public bodies and critical infrastructure operators. The Türkiye Artificial Intelligence Action Plan 2026-2030 was published as Presidential Circular No. 2026/9 in the Official Gazette of 18 August 2026; it is a circular assigning tasks to public bodies, and we treat it as a planning frame rather than a penalty regime.
Chambers, exchanges and NGOs
Chambers of commerce and industry, commodity exchanges and TOBB are not procuring under the same regime as a ministry, and your own purchasing rules govern what is possible. We work to whatever your own legal counsel confirms on that point rather than telling you what your regime is. The same goes for registry and record-keeping duties: we build the inventory and the evidence, your counsel reaches the conclusion. The work here is usually a member-facing service map, a data-sharing model that keeps one member's data away from another's, and a committee structure that can carry a decision without a full-time technical department. NGOs get the same work at a smaller scale.
Mid-sized industrial companies
One plant, a maintenance problem, a quality problem, and a supplier promising a model for both. The useful work is narrow: decide which problem is worth solving first, write the requirement well enough that offers can be compared on the same terms, and agree the acceptance criteria before the pilot rather than after it. Public support programmes may or may not treat consultancy as an eligible cost in your particular case; the programme rules and the evaluation are the institution's, we make no claim about your eligibility, and no consultancy is accredited or authorised by those institutions. If you export to the EU, the obligations for AI embedded in products under Annex I of Regulation (EU) 2024/1689 apply from 2 August 2028 as postponed by Regulation (EU) 2026/1744, a different date from the one set for standalone high-risk systems.
Our own sub-brand teams
Every U2 sub-brand passes through this practice before it reaches a domain name. The brand team brings a use case list, and the same questions are asked as for an outside client: which data may be touched, what the system must never claim, who reviews a release, what the red lines are and where they are written down. Fourteen sub-brands have gone through it inside U2 AI Studio, and across the company as a whole we have completed more than 40 projects. That is a company wide figure rather than a consulting only count, and we make no separate performance claim for any individual brand.
WHY US
Four things we will put in writing
The framework ran on us first
The inventory format, the risk classification, the release checklist and the red line register we hand you are the ones we maintain for our own portfolio. Fourteen U2 sub-brands were produced inside U2 AI Studio under them, and across the company as a whole more than 40 projects have been completed; that is the company wide figure, not a consulting only count. This is not a claim about results, it is a statement about provenance: the method was built to survive our own work before it was offered as a service.
Every line ends in a named document
Not a deck. A use-case portfolio with a prioritisation basis you can argue with, a roadmap with a business case behind each item, a model inventory, a risk classification, a policy and committee structure, a reference architecture with the hosting decision reasoned, a role based training curriculum, an operating model, and a vendor evaluation matrix. You can name what you bought, hand it to a colleague who was not in the room, and keep using it after we leave.
The limits are on the page, not in the fine print
We write no production code; that question belongs to a separate engagement. We give no legal opinion and draft no documents belonging to such work, because Article 35 of the Attorneys' Act No. 1136 reserves that to attorneys registered with a bar. We carry out no audit and no assurance engagement within the meaning of Decree Law No. 660, and no work reserved to licensed professionals under Law No. 3568. We hold and issue no certificate or accreditation: ISO/IEC 42001 and NIST AI RMF 1.0 are voluntary frameworks we align our method to, and no consultancy can certify anyone against either of them.
The decision stays with you
We do not decide which use case you fund, which supplier you sign or whether a model goes live. We make the decision takeable: options set out with what each one costs you in risk, evidence attached to the claims, dissenting views recorded rather than smoothed away, an owner named for each item and a date when it is reviewed again. We promise a method and a deliverable. We do not promise an outcome, a saving, a support award or a level of adoption, because none of those are ours to promise.
START HERE
Bring the decision that is stuck
Which use case goes first, who owns the risk when a model is wrong, build inside or buy, what to put in front of the board next month. One or two sentences is enough for a first call, and we will say plainly if the honest answer is that you do not need us yet.
Thanks. We'll get back to you within one business day.
FAQ
Frequently asked questions
Why are there no prices on this page?
Because a figure published here would be wrong for most of the people reading it. The work moves with the size of the institution, the number of business units in scope, the state of the data, whether an internal team already exists, and how much of the material has to be built from nothing. A number we would re-quote in every conversation tells you less than nothing. So we publish the part that does not change: how each service line is run, step by step; what is handed over at the end of it, in writing; and where we stop. You should know what you are buying before the first meeting rather than after it. Scope and fee are then set out in a single written contract. Nothing on this site is an offer and no contract arises from it. What we can tell you in advance is what drives the size of a piece of work: the number of business units in scope, the number of data sources and systems that have to be inventoried, and whether the result has to satisfy a public-sector or export-facing obligation. Those three questions are the first ones we ask, and you can answer them before you call us.
Do you write code?
No. U2 AI Consulting works before the build decision: strategy and roadmap, governance and risk, data and platform architecture on paper, supplier selection, capability and change. What we produce is documents, inventories, models, curricula and decision records, not software. If your question is whether something is technically feasible, how a model behaves on your own data, or what a working prototype would look like, that is a different question and it belongs to u2aipoc.com, where code is written. We keep the two apart on purpose. In public procurement the separation is not a preference: under Article 11 of Law No. 4734 the party that provides the consultancy for a work cannot take part in the tender for that work, and the prohibition extends to companies in an ownership or management relationship, so the two cannot be offered to an administration as one continuous purchase.
Do you give legal opinions?
No. Under Article 35 of the Attorneys' Act No. 1136, advising on legal questions and drafting the documents belonging to that work are reserved to attorneys registered with a bar association. We do not interpret legislation for you, we do not review or draft your contracts, and we do not state whether you are in conformity with a rule. What we do is the work that comes before that: process and control design, an inventory of the AI systems actually in use, a risk classification method, a roles and responsibilities matrix, a decision record, and a file assembled in the form your own legal counsel asked for. The opinion is theirs to give. Institutions of this size generally retain counsel already, and our material is written to be read by them.
Is this an audit?
No. Independent audit and assurance engagements are defined in Decree Law No. 660 and may be carried out only by auditors and audit firms authorised by the Public Oversight Authority. A technology company cannot be one, and the requirements are structural rather than a matter of choosing to comply. Nothing we deliver is an audit report, an assurance report, an opinion or a certificate, and the same holds for sustainability and carbon work, where the voluntary version of the engagement is covered by the same regime as the mandatory one. We use the words that describe what the work is: assessment, review, gap analysis, readiness. Voluntary frameworks follow the same logic. ISO/IEC 42001 is a certifiable management system standard, but certification comes from an accredited certification body and never from a consultancy, and NIST AI RMF 1.0 has no certification scheme at all and is itself under revision. We can align your internal design to either. We cannot certify it, and we do not.
Does the EU AI Act apply to us?
Not automatically, and the answer turns on Article 2 rather than on where you are established. Regulation (EU) 2024/1689 has been in force since 1 August 2024 and reaches a company in Türkiye where it places an AI system or a general-purpose AI model on the Union market, puts one into service in the Union, or where the output the system produces is used in the Union. The dates matter as much as the scope. The prohibitions in Article 5 and the AI literacy duty in Article 4 have applied since 2 February 2025. General purpose AI obligations have applied since 2 August 2025, with the Commission's supervisory and penalty powers from 2 August 2026. The Article 50 transparency duties have applied since 2 August 2026 and are the most concrete obligation live today. The Digital Omnibus on AI, Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026, postponed the standalone high-risk obligations of Annex III to 2 December 2027 and the product-embedded ones of Annex I to 2 August 2028, so those are not applying yet and the preparation window is open. Two things fall on 2 December 2026: the newly added prohibition covering systems that generate non-consensual intimate imagery and child sexual abuse material, and the end of the transition period for machine-readable marking of generative systems already on the market. In Türkiye there is no separate artificial intelligence statute in force; obligations arise from existing law. This is information rather than a legal opinion, and the current text should be read from the Official Journal.
What happens to our data?
The roles are settled before anything moves. In the ordinary arrangement your institution is the data controller and U2 AI Studio is the data processor acting on your written instructions. Article 12 of Law No. 6698 governs data security and makes the controller jointly responsible with the processor for it. Whether a party is a controller is determined on the criteria the Personal Data Protection Board set out in its decision numbered 2020/71; applying those criteria to an advisory engagement is our own assessment and not a ruling the Board has made about consultancy. We work with the least data the question needs and prefer anonymised, masked or sample data wherever it will serve. Your data is not used to train our models, to build a benchmark pool, or to develop our methods, because doing any of that would make us the controller of that processing. What is returned, what is deleted and on what date is written into the contract. For the contact form on this site U2 AI Studio is itself the controller, and the notice linked beside the form sets out the purpose and the legal basis.
We are a public administration. How do we buy this?
The method is the administration's to choose and we take no part in that choice. There is no procurement regime specific to artificial intelligence: depending on its subject the work sits in the goods, service or consultancy route, and consultancy services are governed by Article 48 of Law No. 4734. We will not tell you which procedure or exemption to invoke, and we will not propose dividing a scope to keep it under a limit. Article 5 of Law No. 4734 prohibits division in order to fall below the threshold values, and the Public Procurement General Communiqué, in the part dealing with Article 22, prohibits dividing a single requirement so that the parts stay within the direct procurement limits. One restriction belongs at the start of a conversation rather than at the end of one. Under the final paragraph of Article 11 of Law No. 4734, a contractor performing the consultancy services for a work cannot bid in the tender for that work, and that bar reaches companies in an ownership or management relationship with it. Our sister brand u2aipoc.com belongs to the same company, so the bar covers it too: advisory work we do for you may close the implementation door for the group, and we say so before you buy rather than after. Separately, Article 16(3) of the Consultancy Service Procurement Implementation Regulation provides that the consultancy service provider which drafts the technical specification cannot take part in the implementation of that work. Chambers of commerce and industry, commodity exchanges and their union do not procure under the same regime as a public administration; your own rules and your own counsel govern that question.
What do we have in our hands when the work ends?
Material you can use without us. Depending on the service line that means an assessment of the current state, a use-case portfolio with the basis on which it was prioritised, a roadmap built around decision points, an AI policy and a committee structure, an inventory of systems with a risk classification method, a traceability design that records which decision rested on which data, a data readiness assessment, a reference architecture with the hosting decision and its reasons written out, a vendor evaluation matrix, a role based training curriculum, and an operating model for the internal team. Everything arrives in open, editable formats with sources and assumptions visible, so another party can pick the work up. Handover is part of the engagement rather than an extra: a walkthrough with the people who will own the material, and the decision record that shows why each choice was made. We keep no key to any of it.