What Is AI Law in Morocco? Regulation and Stakes 2026
Morocco has no specific artificial intelligence law yet. The current legal framework relies on existing texts: Law 09-08 on personal data protection, the Penal Code for digital offenses, and Law 53-05 on electronic exchange. Companies therefore operate in a partial legal vacuum, filled by sector-specific rules and voluntary commitments.
A Legal Framework Under Construction
Morocco did not wait for an AI law to regulate. The CNDP plays a central role. It governs all automated processing of personal data, which de facto includes AI systems that collect, analyze, or make decisions based on individual data.
Law 09-08 imposes concrete obligations: prior declaration of processing activities, right of access and rectification for data subjects, prohibition of certain sensitive processing without explicit consent. An automated recruitment system analyzing CVs, a credit evaluation tool, a conversational agent collecting customer data: all fall under this law.
The Moroccan Penal Code covers attacks on computer systems, fraud, and defamation. It applies to malicious uses of AI, even though the texts were not drafted with AI in mind.
Liability: Who Answers When AI Gets It Wrong?
This is the question every executive should ask their legal counsel before deploying an AI system.
In Morocco, liability follows general civil law principles. The company deploying an AI system is responsible for damages caused by that system, just as it would be responsible for an employee or contractor. There is no AI-specific liability regime, unlike what the European Union is preparing with its AI Act.
In practice: if a recruitment algorithm systematically screens out candidates on discriminatory criteria, it is the company deploying that algorithm that is exposed. Not the software vendor, unless the contract states otherwise.
This grey area creates real risk. According to an article by CIO-Mag, 42% of AI users in Moroccan companies reportedly import complete documents into uncontrolled external tools. Customer data, contracts, HR information. Without a clear internal policy, the company is exposed to violations of Law 09-08 without even knowing it.
To structure your approach before an incident forces the issue, download the AI Board Pack 2026.
What Companies Must Do Today
In the absence of specific AI legislation, operational prudence is the only real protection available.
Map Existing AI Uses
Many Moroccan companies deploy AI without a formal inventory. Content generation tools, conversational agents, HR analytics systems. Any tool that processes personal data through automated means may be subject to the declaration or compliance obligations under Law 09-08. The exact scope depends on the nature of the processing and the data involved.
Define Internal Guardrails
Guardrails are not bureaucratic constraints. An acceptable AI use policy, contractual clauses with AI tool providers, minimal team training: these measures are accessible even for an SME, and they protect the company in the event of a dispute.
As I explained in my analysis of AI benefits in recruitment, AI tools deliver real value. But that value only materializes when deployment is controlled.
Anticipate Upcoming Regulation
Morocco is closely watching the European AI Act, which entered into force in 2024 with obligations applying progressively through 2027. Moroccan companies that export to Europe or work with European partners may be subject to certain of its provisions, particularly for high-risk AI systems. This point warrants case-by-case verification with specialized legal counsel.
International Comparison: Where Does Morocco Stand?
The European Union has the AI Act, the most comprehensive text in the world. The United States advances through executive orders and sector regulation. China has specific rules on recommendation algorithms and deepfakes.
Morocco is in a position similar to most African countries: no dedicated AI law yet, but existing texts that partially apply. At the AI Impact Summit, Senegal issued a declaration within the framework of the GPAI (Global Partnership on AI). Morocco participates in these international discussions without having yet translated them into positive law.
For executives recruiting AI profiles or structuring data teams, the legal question is inseparable from the skills question. My guide on which jobs will survive AI provides complementary insight on what teams need to master.
If you are a CHRO or CEO and want to assess your legal exposure before deploying AI, request a free diagnostic.
FAQ
Does an AI law exist in Morocco in 2026?
No. There is no AI-specific law in Morocco in 2026. The applicable framework rests on Law 09-08 on personal data protection, Law 53-05 on electronic exchange, and common civil and criminal law.
Can the CNDP sanction a company that uses AI?
Yes, if the AI use involves personal data processing that is undeclared or non-compliant with Law 09-08. Sanctions include fines and, in serious cases, criminal prosecution.
Does the European AI Act apply to Moroccan companies?
Partially, depending on the situation. A Moroccan company that provides AI systems to European clients, or whose systems process data of European residents, may be subject to certain AI Act obligations. This is a point to verify with specialized legal counsel.
What does a company risk by using AI without an internal policy?
It is exposed to violations of Law 09-08 (personal data), civil liability risks if damage is caused by an automated system, and reputational risks. Without an internal framework, the company bears the responsibility, and its executives may be personally implicated depending on the nature of the offense.