AI Legal Framework in Morocco: What Businesses Must Know
Morocco’s legal framework for artificial intelligence is still being built. There is no dedicated AI law yet, but several existing texts already apply: Law 09-08 on personal data protection and the orientations of the AI white paper published in 2025. Companies operate in a partially regulated space, with real risks.
What Exists Today
Morocco has not yet adopted legislation specifically dedicated to AI. But saying there is no framework would be inaccurate.
Law 09-08 on the protection of personal data governs all automated data processing. If your AI system processes employee, customer, or candidate data, you are already subject to this law. The National Commission for the Control of Personal Data Protection (CNDP) is the competent authority for overseeing personal data processing.
In 2025, an AI white paper was published in Morocco. It outlines the contours of a sovereign and inclusive Moroccan model. It is not a law. But it is a strong signal about the direction regulation is heading. Companies that read these signals have a head start.
The Real Risk: Internal Usage Without Clear Policy
According to Kaspersky, as reported by Medias24, Moroccan companies are using AI on a massive scale with little governance in place. EcoActu.ma documented the same finding: the absence of an internal AI policy represents a concrete operational and legal risk.
What does this mean in practice? Employees using consumer AI tools to process client data. Recruiters running CVs through uncertified tools. Sales teams feeding sensitive contractual data into conversational agents.
These practices expose the company to three types of risk:
- Violation of Law 09-08 if personal data passes through servers outside the company’s control.
- Contractual liability if an internally unmanaged automated decision causes harm to a third party.
- Reputational risk if an incident becomes public.
The problem is not AI. The problem is the absence of a clear internal policy on its use.
I built a 6-dimension diagnostic framework to assess exactly this kind of legal and operational exposure. Download the AI Board Pack 2026.
What the Morocco-EU Dialogue Changes for You
Morocco and the European Union have launched a strategic dialogue on digital sovereignty and AI. This is not a footnote.
The EU AI Regulation is being progressively applied. It concerns any company that provides or uses AI systems on the European market, regardless of where it is based. A Moroccan company working with French, Belgian, or Dutch clients needs to analyse its exposure to this text.
The Morocco-EU strategic dialogue signals that regulatory convergence is underway. Moroccan companies that anticipate these requirements position themselves better for export markets. Those waiting for a specific Moroccan law before acting are falling behind.
As I covered in my analysis of AI tools for HR, choosing a tool is not just a performance question. It is also a question of compliance and data localisation.
Best Practices to Adopt Now
You do not need to wait for a law to act. Here is what serious companies are doing.
Map Existing AI Usage
Before deploying anything new, know what already exists in your teams. Tools without policy or guardrails are often already in use. A simple internal audit reveals actual exposure.
Update Your Data Processing Policy
Your privacy policy and data processing agreements must explicitly mention automated processing. The CNDP can request these documents during an audit.
Designate an Internal AI Lead
Not necessarily a lawyer. Someone who understands the tools being used and can bridge the gap between business teams and legal. In the projects I work on, this role is often underestimated at the start and becomes critical at scale.
Document Automated Decisions
If your AI makes or influences decisions affecting people (recruitment, credit, service access), document the logic. This is a requirement under Law 09-08 and a protection in case of dispute.
For more on internal capabilities, see my article on jobs that resist AI. AI governance is precisely one of the domains where human judgment remains irreplaceable.
What Happens in the Next 18 Months
Morocco’s AI white paper lays the groundwork for future regulation. The EU dialogue accelerates convergence. The Nexus AI Factory project, whose details were reported by Le Desk at 12 billion dirhams, illustrates the scale of investment at stake in Morocco’s AI ecosystem.
A specific AI law in Morocco is likely by 2027. It will probably draw from the EU AI Regulation, with adaptations to the local context. Companies that have already structured their AI governance will not need to rebuild from scratch.
Those who wait will be in catch-up mode.
If you are a CHRO, CEO, or board member and want to structure your approach before regulation forces your hand, request a free diagnostic.
FAQ
Does a specific AI law exist in Morocco in 2026?
No. There is no dedicated artificial intelligence law in Morocco yet. Law 09-08 on personal data protection already applies to many AI use cases. A white paper published in 2025 outlines the orientations of future regulation.
Does the EU AI Regulation apply to Moroccan companies?
Potentially yes. This text applies to any company that provides or deploys AI systems on the European market, regardless of its registered office. A Moroccan company with clients in France or Belgium needs to analyse its exposure.
What are the concrete risks of unmanaged AI use in Morocco?
Three main risks: violation of Law 09-08 if personal data passes through uncontrolled tools, contractual liability in the event of a harmful automated decision that was not governed internally, and reputational risk if a public incident occurs. Kaspersky and several Moroccan business media outlets have recently documented these risks.
Where to start to achieve compliance?
With an audit of existing AI usage across your teams. Then update your data processing policy, designate an internal lead, and document automated decisions. These four steps cover the bulk of current exposure without waiting for a specific law.