Morocco AI Regulation Overview

Overview

Morocco's approach to digital governance and artificial intelligence combines binding foundational cybersecurity law with dedicated, forward-looking AI legislative proposals. As part of its broader national digital transformation initiatives, including the "Maroc Digital 2030" strategy and the Administration X.0 program, the Kingdom is developing an integrated legal and institutional framework designed to modernize public administration, protect critical national infrastructure, and establish safeguards for AI deployment across public and private sectors.

The binding core of Morocco's current legal framework is Law No. 05-20 on Cybersecurity, which sets strict technical standards, data residency mandates, and compliance obligations for Entities of Vital Importance (Organismes d’Importance Vitale - OIV). In parallel, the Moroccan government is progressing specialized legislative proposals, notably the Digital X.0 Framework Law and a Bill for the Establishment of the National Agency for AI Governance. Together, these measures aim to create a structured, sovereign, and trustworthy digital environment that balances technological innovation with fundamental rights and national security.

Regulatory Approach

Morocco's regulatory architecture employs a combination of mandatory cybersecurity baselines and proposed risk-based AI rules. Under Law No. 05-20, a prescriptive approach applies to critical entities and sensitive information systems, requiring strict technical adherence, qualified auditing, and local data hosting. In contrast, proposed AI legislation introduces a technology-neutral, risk-based classification system that differentiates low-risk applications from high-risk AI systems operating in sensitive domains such as healthcare, justice, social services, and critical infrastructure.

The proposed governance frameworks prioritize data sovereignty, public transparency, and human oversight. Systems classified as high-risk or involved in automated decision-making that affects individuals will face specific compliance obligations, including algorithmic impact assessments, mandatory logging, explainability rules, and pre-deployment conformity assessments. Additionally, the approach incorporates flexibility through proposed regulatory sandboxes and shared national infrastructure to support public-interest models and small-scale innovation.

Key AI Legislation

• Law No. 05-20 on Cybersecurity (Loi n° 05-20): Enacted in July 2020 and operationalized by Decree No. 2-21-406, this law establishes security baselines, mandatory data residency within national territory, biennial compliance audits, and incident reporting for Entities of Vital Importance (OIV).
• Digital X.0 Framework Law (Draft 2025): A legislative proposal aligned with the Maroc Digital 2030 strategy designed to set legal rules for digital public services, data governance, interoperability, data sovereignty, and AI transparency across public administrations and vendors.
• Bill for the Establishment of the National Agency for AI Governance (Proposed 2024): A proposed law to create an independent central authority tasked with national AI policy, risk-based system classification, high-risk system registration, conformity checks, and regulatory enforcement.

Governance & Enforcement Bodies

The governance structure for digital security and AI oversight in Morocco involves established cybersecurity and data protection authorities working alongside proposed specialized bodies. Under Law No. 05-20, the General Directorate of Information Systems Security (DGSSI), operating under the National Defense Administration, serves as the national cybersecurity authority. The DGSSI defines technical standards, approves qualified audit providers (PASSI), conducts inspections, and manages the national computer emergency response team (maCERT). Strategic inter-ministerial coordination is led by the Strategic Cybersecurity Committee (CSSI).

For personal data protection, the Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP) enforces privacy compliance and coordinates on automated processing safeguards. Under proposed draft legislation, AI-specific policy and enforcement will be spearheaded by a centralized National Agency for AI Governance alongside a central coordinating office situated within the Ministry responsible for digital transition.

Penalties & Enforcement

Enforcement mechanisms under Law No. 05-20 on Cybersecurity center on mandatory compliance audits and regulatory oversight by the DGSSI. Entities of Vital Importance (OIVs) are subject to mandatory security audits every two years conducted by DGSSI-qualified PASSI auditors. The DGSSI holds the authority to conduct scheduled and unannounced inspections, access technical documentation, and issue formal notices requiring mandatory corrective actions within specified timelines.

Under the proposed Bill for the Establishment of the National Agency for AI Governance, enforcement powers for non-compliant AI deployment would include pre-deployment inspections, mandatory algorithmic audits, orders for technical remediation, and authority to suspend or withdraw non-compliant AI systems from the market. The bill also contemplates administrative fines calibrated by the severity and recurrence of violations, as well as formal complaint channels for individuals affected by automated decisions.

Data Protection Framework

Data protection and privacy safeguards across digital and AI systems are overseen by the Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP). Proposed AI legislation, including the Digital X.0 Framework Law and the Bill for the Establishment of the National Agency for AI Governance, formally incorporates CNDP terminology and requires explicit compliance with national personal data processing standards and privacy-by-design principles.

A central tenet of Morocco's digital legal framework is data sovereignty and data localization. Law No. 05-20 strictly mandates that sensitive information systems and critical data belonging to State administrations, public institutions, and OIVs must be hosted within national territory. The draft Digital X.0 Framework Law reinforces this requirement by designating "sovereign data assets" and setting strict rules for government-held datasets and public cloud services.

Sector-Specific Rules

The existing legal corpus holds no record of enacted sector-specific AI laws for individual industries such as autonomous vehicles or financial services. However, the proposed Digital X.0 Framework Law is designed to function as an enabling framework that complements sectoral legislation in fields such as healthcare, justice, and finance by providing unified technical standards for interoperability and data governance while respecting sector-specific constraints.

Furthermore, the proposed Bill for the Establishment of the National Agency for AI Governance highlights sensitive sectors within its risk classification framework. AI applications deployed in healthcare, justice, social services, public administration, and critical infrastructure are explicitly categorized for heightened oversight, requiring pre-deployment impact assessments and conformity checks before large-scale implementation.

International Alignment

Morocco's draft AI legislation reflects an emphasis on aligning national legal definitions and governance principles with emerging international standards. Definitions in proposed bills—such as "AI system," "high-risk AI system," "automated decision-making," and "developer/provider"—are standardizing terminology to facilitate technical interoperability with international frameworks and cross-border digital governance practices.

This international alignment strategy aims to position Morocco as a regional leader in safe, ethical, and sovereign digital governance. By balancing international compatibility with strict national data residency and sovereign asset protections, Morocco seeks to protect fundamental rights while encouraging foreign investment and technological development.

Future Developments

Future legislative and regulatory developments in Morocco will center on the formal progression and enactment of the proposed AI governance frameworks. Key pending items include the advancement of the draft Digital X.0 Framework Law under the Maroc Digital 2030 strategy and the formal establishment of the National Agency for AI Governance.

Once enacted, these legislative frameworks will be operationalized through executive decrees, technical rulemaking, and national certification schemes. Anticipated implementation steps include the rollout of mandatory AI registration regimes, technical standards for algorithmic explainability, regulatory sandboxes for testing AI applications, and shared national AI infrastructure for public-interest models.

Enforcement Bodies