Law and AI in Morocco
Law and AI in Morocco currently rests on an existing legal base, but it is still fragmented. To my knowledge, there is no single law dedicated to AI. Companies therefore have to work with personal data law, cybersecurity, digital evidence, intellectual property, and sector-specific rules. That is enough to operate, but not enough to sleep well.
A real legal base, but not designed for AI
Morocco is not legally empty. The country already has texts that cover part of AI use, even if none of them treats AI as the central object.
The first pillar is personal data protection, with Law No. 09-08 and the CNDP. As soon as an AI use case processes customer, employee, candidate, or patient data, the issue stops being theoretical. It becomes legal.
The second pillar is cybersecurity and information system security. A poorly governed AI model can expose sensitive data, create leaks, or produce decisions that are impossible to explain.
The third pillar is digital evidence. When a company uses a conversational agent, a recommendation engine, or an automated evaluation system, it must be able to show who decided what, on what basis, and with what human oversight.
This is exactly the kind of topic I cover in my analysis of daily AI use at work and in my reading of the 3 phases of change management.
What companies should look at first
The real question is not “can we use AI?”. The real question is “under what conditions?”.
A Moroccan company deploying AI should check four points.
First, the legal basis for data processing. If the tool ingests CVs, customer files, or HR data, the company must know where the data goes, who can access it, and how long it is kept.
Second, responsibility and accountability. If a model makes a mistake, who answers for it? The vendor, the CIO, the HR director, the business owner? Without a clear answer, the company is exposed.
Third, transparency. An employee or candidate should understand that a tool is involved in the process. Otherwise, trust erodes quickly.
Fourth, human oversight. AI can assist. It should not decide alone on sensitive matters such as hiring, credit, insurance, or health.
The case covered by Le Matin.ma on writing a CV with AI without exposing personal data shows the level of vigilance expected. Even a simple use can become risky if data circulates badly.
The grey areas in the Moroccan AI legal framework
The Moroccan AI legal framework still leaves several gaps.
There is no clear doctrine on high-risk systems. There are also no precise rules on model explainability, bias audits, or decision log retention.
Another grey area is intellectual property. Who owns content generated with AI assistance? The company? The employee? The vendor? The answer often depends on the contract, not on a specific law.
The same applies to evidence. A document produced with AI assistance can be useful. It can also be challenged if the company cannot document its process.
On this point, Moroccan companies should look at Europe, without copying it mechanically. The GDPR, then the European AI Act, impose a logic of risk classification, documentation, and control. Morocco has not yet reached that level of formalisation, but international groups already expect it from their subsidiaries.
What the market signals are saying
Recent signals are clear. AI is no longer a lab topic. It is entering operations.
The article from Industrie du Maroc on customs control shows that AI can already support control and analysis functions. That is not anecdotal. When an administration starts using it, companies must follow, because compliance standards rise with it.
At the same time, the funding round of ABA Life reminds us that regulated sectors, such as healthcare, will accelerate. And the more sensitive a sector is, the more central AI governance becomes.
The message is simple. Companies waiting for a perfect law will lose time. Those that structure their guardrails now will move faster.
What I advise leaders to do
A Moroccan CEO or HR director does not need a legal treatise. They need a decision-making structure.
I recommend treating AI as a governance issue, not as a gadget. That means three things.
First, map the use cases. Not all of them. The ones that touch sensitive data, HR decisions, customer relations, and critical operations.
Second, create a light AI governance committee with legal, IT, business, and compliance.
Third, impose simple guardrails. Human validation, logging, retention rules, and a ban on using sensitive data in unapproved tools.
This is also where my AI governance services become relevant. When a company wants to move from experimentation to execution, it needs a clear methodological framework, not promises.
International perspective and the Moroccan opportunity
Morocco has a real opportunity. The country can become a serious AI adoption space between Europe and Africa, provided trust is secured.
International standards will continue to matter. European groups will ask for traceability. African partners will look at execution capacity. Regulators will ask for evidence.
The right move is therefore not to wait for a big AI law. The right move is to build, now, a robust operating model compatible with local and international requirements.
If you are a leader and want to frame your AI use, request a diagnostic. It is often more useful than a long theoretical debate.
FAQ
Is there a specific AI law in Morocco?
Not yet, to my knowledge. Morocco mainly relies on existing texts, such as Law No. 09-08 on personal data, cybersecurity, and digital evidence rules.
Can a company use AI for hiring in Morocco?
Yes, but carefully. It must inform candidates, limit the data collected, keep human oversight, and document the criteria used.
What is the main legal risk for a company?
The main risk is deploying a tool without clear governance. That creates data, responsibility, and compliance issues.
Is Morocco aligned with European standards?
Not fully, but Moroccan companies exposed to Europe already need to align with similar expectations on data protection, transparency, and control.