What Is AI Law in Morocco? Regulation and Stakes 2026
Morocco has no specific artificial intelligence law yet. The legal framework relies on existing texts: Law 09-08 on personal data protection, Law 53-05 on electronic exchange, and guidelines from the CNDP (National Commission for Personal Data Protection). No dedicated AI law has been enacted as of 2026.
What Moroccan Law Says Today
Several existing texts already apply to AI systems, even though they were not designed with AI in mind.
Law 09-08 governs personal data processing. Any AI system that collects, analyzes, or uses data on individuals falls under its scope. The CNDP can sanction violations. This is the most directly applicable text to AI projects today.
Law 53-05 governs electronic exchanges and digital signatures. It applies to contracts concluded through automated systems.
The Labor Code makes no mention of AI. But questions around employee monitoring and automated decision-making in recruitment or performance evaluation fall into a legal gap that Moroccan HR directors are starting to feel concretely. This is a topic I address directly with clients deploying AI-assisted recruitment tools.
The CNDP: The Authority Mobilized on AI-Related Data
In the absence of a dedicated AI regulator, the CNDP plays a central role on everything related to personal data. It has published recommendations on the ethical use of data in automated systems. It is progressively aligning with European GDPR standards, which is no coincidence: Morocco is pursuing adequacy status with the European Union to facilitate cross-border data flows.
For a Moroccan company deploying an AI system that processes customer or employee data, the CNDP is the primary regulatory interlocutor today on this perimeter. Ignoring its recommendations means taking a real legal risk.
What Is Being Prepared
The public debate on AI regulation is accelerating in Morocco. The AI:Casablanca conference, which Casablanca hosted on May 23rd according to available sources, put the question of AI regulation in the workplace on the table. This type of event often precedes legislative initiatives.
In this context, several regulatory workstreams are being discussed publicly, without any definitive text enacted to date. Companies waiting for a law before structuring their AI governance are taking a different kind of risk: being behind when the framework arrives.
If you are defining your company’s AI strategy, now is the right time to integrate the regulatory dimension from the start. I have built a diagnostic framework to evaluate exactly that. Download the Board Pack AI 2026.
What This Means for Companies
Concretely, here is what a business leader needs to retain today.
First: the absence of an AI law does not mean the absence of risk. Existing texts apply. A dismissal decision based on an undocumented algorithm can be challenged. A customer evaluation system that discriminates can fall under Law 09-08.
Second: companies working with European partners are already indirectly subject to the European AI Act. If your AI software provider is based in Europe, they must comply with the AI Act. You inherit their constraints contractually.
Third: documenting your AI systems now means preparing for the regulation that is coming. Companies that have a register of their AI use cases, an AI governance policy, and human oversight procedures will be ahead when the law arrives. Those that have let ungoverned AI proliferate will have a problem.
As I explained in my guide on corporate AI strategy, AI governance is not a technical subject. It is a matter for general management.
Morocco in the African Context
Morocco is not alone on this path. Senegal spoke at the AI Impact Summit within the framework of the GPAI (Global Partnership on Artificial Intelligence). The African Union is working on a continental framework. Google and the African Continental Free Trade Area (AfCFTA) Secretariat have launched an AI skills development program for African SMEs.
In this context, Morocco has a card to play: its regulatory proximity to Europe, its rapidly developing digital infrastructure, and its position as a hub between Africa and the Mediterranean basin. But this card will only be played if the legal framework follows.
For a Moroccan HR director or CEO, the question is not to wait for the law. It is to build practices now that will be compliant when it arrives. And if you want to see how other business leaders are already integrating AI into their processes, read my practical guide on AI in business.
If you want to structure your approach before regulation forces you to, request a free diagnostic.
FAQ
Does an AI law exist in Morocco in 2026?
No. There is no specific artificial intelligence law in Morocco as of today. AI systems are governed by general texts, primarily Law 09-08 on personal data protection and Law 53-05 on electronic exchanges.
Which body regulates AI in Morocco?
In the absence of a dedicated regulator, the CNDP (National Commission for Personal Data Protection) is the most directly mobilized authority for AI systems processing personal data. It is not a dedicated AI regulator in the strict sense, but it is the primary regulatory interlocutor on this perimeter today.
Does the European AI Act apply to Morocco?
Not directly. But Moroccan companies using AI software or services provided by European actors are indirectly affected by the obligations those providers must meet.
What risk does a Moroccan company face deploying AI without governance?
It faces sanctions under Law 09-08 if the system processes personal data without declaration or legal basis. It also faces contractual and reputational risks, particularly with European partners subject to the AI Act.