Morocco - Digital Services Framework (2025)

Overview

The Digital X.0 Framework Law is a proposed 2025 Moroccan legislative initiative to modernize public administration and the national digital ecosystem by providing an integrated legal and technical framework for digital public services, artificial intelligence (AI) deployment, data governance, interoperability, and cybersecurity. The initiative is presented as part of the national digital transformation agenda under the broader "Maroc Digital 2030" strategy and the Administration X.0 modernization program. The proposal sets out to establish a legal backbone for digital services and AI across public and private actors that interact with the public sector and to coordinate implementation with existing supervisory bodies. Official communications and ministry releases indicate the Ministry/Agency in charge of digital transition is leading preparatory work in cooperation with national authorities. (See: mmsp.gov.ma; maroc.ma)

Definitions

The Framework establishes a set of legal definitions to create clarity and harmonisation across instruments and institutions. Key defined terms include “digital public service”, “interoperability layer”, “data controller and processor” (with reference to CNDP terminology), “AI system” (including categories or tiers by risk), “sensitive public data”, and “sovereign data assets”. These definitions are intended to align with existing national legislation on personal data and international good practices and to enable consistent application of obligations across central and local administrations, public institutions, and private vendors providing services to the public sector. (See CNDP references at cndp.ma.)

Governance and Institutional Framework

The proposal foresees a multi-level governance model to coordinate policy, technical standards, oversight and enforcement. Primary elements described in the draft include: a central coordinating office (located within the Ministry/Agency responsible for the digital transition and Administration X.0) to supervise overall implementation and drive common architectures; technical standard-setting bodies charged with defining interoperability, certification and technical conformity criteria; and mandated coordination arrangements with existing supervisory authorities and security bodies. Specifically, the Framework contemplates formal collaboration and division of responsibilities with the CNDP (national data protection authority) on personal data matters, the DGSSI (national cybersecurity authority) for cyber resilience and system integrity, and relevant national security services (DGSN) on security, law enforcement access and related safeguards. The governance design aligns institutional roles with the Administration X.0 program and seeks to integrate technical standardisation, certification, and compliance oversight into a coherent institutional model. (See: mmsp.gov.ma.)

Key Focus Areas

• Legal recognition and prioritisation of digital-first administrative procedures and common platform architectures for public services.
• Mandatory interoperability and API standards to ensure systems can exchange data and services across administrations and reduce fragmentation.
• Data sovereignty measures governing government-held datasets and designation of “sovereign data assets”.
• Baseline requirements for AI governance including transparency, risk assessment, and human review rights where automated decisions affect individuals.
• Enhanced obligations for cybersecurity, system integrity and incident handling tied to national cybersecurity mandates.
• Compliance, audit and reporting obligations for administrations and regulated private actors participating in public digital services, including documentation and logging requirements.
• Obligations to publish service-level commitments and transparency statements for AI-assisted services that interact with citizens.

Implementation Framework

The Framework is presented as a phased 2025 initiative intended to be implemented progressively in coordination with technical rulemaking, standard-setting and piloting. The draft envisages that the law will establish legal principles and mandatory obligations, while subsequent decrees, technical rules and certification schemes will define interoperability layers, common technical stacks, and compliance procedures. Administrations are expected to adopt common technical stacks or adhere to national reference architectures to facilitate mutualisation of services and reduce duplication. Implementation tasks include preparatory stakeholder consultations, development of technical standards, pilots of shared platforms, and the roll-out of certification and conformity assessment mechanisms in later phases. The Framework is described as complementary to sectoral laws (e.g., health, justice, finance) by providing enabling technical norms for interoperability and data governance while preserving sector-specific regulatory constraints. (See: maroc.ma.)

Monitoring and Evaluation

Monitoring and evaluation arrangements described in the draft include mandatory reporting obligations, periodic audits, technical conformity checks (interoperability, security hardening), and maintenance of documentation and logs to support oversight. The Framework foresees risk-based oversight for AI systems, requiring mandatory risk assessments before deployment and periodic reassessments for systems in use. It anticipates registration or notification regimes for certain high-risk systems and envisages coordinated inspection and audit activities by the central coordinating office together with sectoral and supervisory authorities (including CNDP and DGSSI) to evaluate compliance and system performance. The detailed modalities for monitoring, evaluation and reporting are to be elaborated in implementing regulations and technical standards.

Penalties, Liability, and Appeals

The Framework sets out administrative enforcement tools and remedies. Enforcement measures referenced in the draft include corrective orders, suspension of non-compliant services, and fines calibrated to the nature of the violation (for example data breaches, failure to adhere to AI risk management requirements, or refusal to interoperate with mandated standards). Enforcement responsibility is allocated across the coordinating digital ministry/agency, the CNDP with respect to data protection breaches, and cybersecurity authorities for security incidents, with judicial remedies and complaint mechanisms available to citizens. The Framework also contemplates obligations on vendors and contractors supplying services to the public sector, establishing contractual and certification-based paths for demonstrating compliance. Specific penalty levels, liability rules and detailed appeal procedures are expected to be specified in the implementing instruments that accompany the primary law.

Relationship to Other Instruments

The draft Framework explicitly references and is intended to operate alongside existing national instruments and supervisory bodies. It is designed to complement the national data protection law and CNDP oversight, decrees delineating the DGSSI’s remit on cybersecurity, and the policies and roadmaps set out under Maroc Digital 2030. The Framework also aims to be complementary to sectoral laws by providing enabling technical norms for interoperability and data governance while allowing sector-specific regulatory restraints to remain in force. The law is therefore presented as part of an integrated regulatory ecosystem rather than a replacement of existing sectoral or data protection regimes. (See: cndp.ma and maroc.ma.)

International Alignment

While the draft is framed primarily as a national instrument supporting Maroc Digital 2030, the Framework indicates an intention to harmonise definitions and governance approaches with international good practices and to align with recognized approaches to data protection, AI risk management and cybersecurity. The Framework’s definitions and baseline requirements are explicitly described as intended to harmonize with existing national legislation on personal data and with international good practices to facilitate interoperability, compliance and potential regional or international collaboration. Specific international instruments or conventions are not enumerated in the draft summary, and further alignment details are expected to emerge in the technical rulemaking and implementing regulations.

Implementation Timeline

Additional phased rollout described in the draft (narrative): initial parliamentary proposal and stakeholder consultation in 2025; technical rulemaking and standards development during 2025–2026; pilot deployments of shared platforms and certification schemes in 2026; and wider mandatory compliance deadlines staggered through 2027–2028 to align with the Maroc Digital 2030 roadmap and the Administration X.0 reform agenda.

Sources and References