What Is the Law on Artificial Intelligence in Morocco?
Morocco does not yet have a specific law on artificial intelligence. The applicable legal framework relies on existing texts: Law 09-08 on personal data protection, Law 53-05 on electronic exchange, and general civil and commercial law. No dedicated legislation is currently in force.
A Legal Gap, Not a Legal Void
Many executives ask me the question this way: “Are we allowed to deploy AI in Morocco?”
Short answer: yes. But without a safety net.
Morocco has not legislated specifically on AI. That does not mean everything is permitted. Several existing texts already govern AI uses, even indirectly.
Law 09-08 on personal data protection is the most directly applicable text. It imposes obligations whenever a system processes data on natural persons. An automated recruitment tool, a customer conversational agent, a credit scoring system: all fall within its scope. The National Commission for Personal Data Protection Control (CNDP) is the supervisory authority.
Law 53-05 on the electronic exchange of legal data governs the probative value of digital documents and electronic signatures. It becomes relevant whenever an automated decision-making process produces legal effects.
Common law also applies: civil liability, contract law, labor law. If a recruitment algorithm discriminates, it is Moroccan labor law that applies, not a non-existent AI text.
What Companies Are Actually Doing
In the projects I run between Casablanca and Brussels, I observe two postures.
The first: wait and see. “We’ll deal with it when the law comes out.” That is a mistake. The risks exist today, specific law or not.
The second: align with international standards in anticipation. That is the smart posture.
Why international standards? Because the European AI Act, which entered into force in 2024, is currently the most structured regulatory reference available. Moroccan companies that export to Europe or work with European partners are already within its sphere of influence, even without formal local obligation.
According to dabafinance.com, Nvidia is targeting Morocco as an AI hub in Africa. According to LesEco.ma, Nexus Core Systems announced the launch of what is reported to be the continent’s first “AI Factory” in Casablanca. These investments will mechanically draw regulatory attention to the uses that follow.
I have built a 6-dimension diagnostic framework to help executive teams assess their legal and ethical exposure before deploying an AI system. Download the AI Board Pack 2026.
Real Risk Areas for a Business Leader
Personal Data and AI
This is the number one risk. Law 09-08 provides for declaration or authorization obligations with the CNDP for personal data processing. Many companies deploy AI tools without checking whether this step applies to their situation. That is a potential violation.
Recruitment algorithms are particularly exposed. As I explained in my analysis on integrating AI into HR practices, a CV screening tool can reproduce systemic biases and engage the employer’s liability.
Automated Decisions and Liability
Who is responsible when an algorithm makes a bad decision? Under Moroccan law, the answer is: the company that deployed it. There is no legal personality for an AI system. Liability always flows back to a legal or natural person.
This means your contracts with AI vendors must explicitly address liability allocation. Most do not.
Intellectual Property
Who owns the rights to AI-generated content? Moroccan intellectual property law protects works of the human mind. A text generated by a language model without significant human intervention sits in a grey area. Moroccan courts have not yet ruled on this.
What Happens in the Next 18 Months
The influence of the European AI Act on the future regulations of partner countries is well documented. Several provisions could inspire a Moroccan framework, particularly on high-risk systems (recruitment, credit, healthcare). But at this stage, no formally published national AI strategy or precise legislative calendar is available in accessible sources.
Companies that have structured their AI governance before the law arrives will be in a strong position. Those who wait will have to catch up under pressure.
For HR directors and legal teams, the question is not “when does the law come out?”. The question is “are we ready when it does?”
For more on tool selection in this context, see my guide on choosing the right AI for a business.
If you want to structure your approach before regulation forces your hand, request a free diagnostic.
FAQ
Does Morocco have an AI law?
No specific law exists today. The applicable framework relies on Law 09-08 (personal data), Law 53-05 (electronic exchange), and common law.
Can the CNDP sanction a company for using AI?
Yes, if the tool processes personal data without complying with the obligations set out in Law 09-08, particularly regarding declaration or authorization. The CNDP has supervisory and sanctioning powers. Deploying an HR or commercial AI tool without this prior verification is a potential violation.
Does the European AI Act apply to Moroccan companies?
Directly, no. But if a Moroccan company processes data from European residents or provides services on the European market, it could fall within the regulation’s scope under a reading of its extraterritorial application. Consulting a specialized lawyer to assess your specific situation is advisable.
How do I choose the right AI tool given Morocco’s legal framework?
Start by identifying whether the tool processes personal data. If so, verify your obligations under Law 09-08 and the CNDP. Then analyze liability clauses in the vendor contract. For a broader selection guide, see my analysis on choosing the right AI for a business.