What Is AI Law in Morocco? Legal Framework and Stakes
Morocco does not yet have a specific artificial intelligence law. The applicable legal framework relies on existing texts: Law 09-08 on personal data protection, Law 17-97 on intellectual property, and a digital code still being consolidated. Companies therefore operate in a partial legal vacuum, with real risks.
A Fragmented Framework, Not an Absent One
The absence of a dedicated AI law does not mean the absence of rules. Several existing texts apply directly to AI systems deployed in Morocco.
Law 09-08 governs personal data processing. It requires consent, declared purpose, and data security. Any AI system processing data of Moroccan citizens falls under its scope. The CNDP (National Commission for Personal Data Protection Control) is the supervisory authority. It can impose sanctions.
Law 17-97 on intellectual property raises a question few executives have anticipated: who is the author of an AI-generated work? Moroccan law, like most continental legal systems, requires a human author. A purely AI-generated creation is not protectable as it stands.
The Penal Code also applies. Fraud, defamation, or data manipulation committed through AI tools remain criminal offenses. The tool does not change the operator’s legal responsibility.
The European AI Act: A Concrete Risk for Moroccan Companies
This is where it becomes urgent. The European AI Act is now in force and applies to any company that provides or deploys AI systems on the European market, regardless of its location.
Morocco ranks in the global Top 20 for outsourcing. Hundreds of Moroccan companies work for European clients. If they use AI tools in their processes, they are potentially within the scope of the AI Act. This is not a hypothesis. It is what Le Matin.ma signals this week: Moroccan players are being caught by European rules.
Concretely, the AI Act classifies AI systems by risk level. High-risk systems (automated recruitment, credit scoring, access control) are subject to strict obligations: technical documentation, transparency, human oversight. A Moroccan company using an automated CV screening tool for a European client must assess its compliance position.
I have built a 6-dimension diagnostic framework to assess exactly this regulatory exposure. Download the AI Board Pack 2026.
What Moroccan Companies Should Do Now
EcoActu puts it plainly: the real risk is not technological lag, it is the absence of AI governance. As an operator, I would add: without a legal anchor, any governance policy remains fragile.
Three concrete actions for an executive today.
First, map the AI tools used across the organization. Not just officially purchased ones. Ungoverned AI, meaning teams using ChatGPT, Gemini Enterprise, or other tools without internal policy, creates real legal exposure. Maroc Cloud just launched Gemini Enterprise in Morocco: adoption will accelerate.
Second, review contracts with European clients. Do they contain clauses on AI use? On AI Act compliance? If not yet, they will in the coming months.
Third, designate an AI governance lead. Not necessarily a lawyer. Someone who understands the processes, the deployed tools, and can bridge the legal department and executive leadership. As I explained in my analysis of the best AI solutions for HR, the question is no longer whether AI enters your HR processes. It already has.
Morocco’s National AI Strategy: Where Do Things Stand?
Morocco has launched structural initiatives. The Maroc Digital 2030 strategy includes AI as a priority axis. Players like TCS Morocco are positioning the country as a digital services hub for francophone Europe. The ecosystem is taking shape.
But regulation lags behind. For now, companies cannot wait for a law that does not yet exist. They must build their own AI governance framework, aligned with international standards, particularly European ones.
This is exactly what I cover in my 2-to-3-week AI Governance Sprint, designed for executives who want to structure their approach without waiting for legislators to decide. Learn more about this approach.
If you are a CHRO, CEO, or board member and want to assess your regulatory exposure, request a free diagnostic.
And if change management around AI concerns you as much as the legal framework, read my analysis on the 3 pillars of change management: the two topics are deeply connected.
FAQ
Does Morocco have a specific artificial intelligence law?
No. As of today, no dedicated AI text has been adopted in Morocco. The applicable framework consists of existing texts: Law 09-08 on personal data, Law 17-97 on intellectual property, and the Penal Code.
Is a Moroccan company subject to the European AI Act?
Yes, if it provides services or products incorporating AI to clients or users in Europe. The company’s geographic location is not sufficient to exempt it. This is a point many Moroccan executives still underestimate.
Who oversees data use in AI systems in Morocco?
The CNDP (National Commission for Personal Data Protection Control) is the competent authority for all matters relating to personal data processing, including in AI systems. It holds sanctioning powers.
Who is liable if an AI makes a bad decision in my company?
Under current Moroccan law, legal responsibility remains with the human operator or legal entity deploying the system. AI is not a legal person. If an AI tool causes harm, it is the company using it that bears the exposure.