Morocco - National AI Governance Bill (2024)

Overview

The Bill for the Establishment of the National Agency for AI Governance proposes creation of an independent public authority responsible for national AI strategy, regulatory coordination, oversight, and enforcement to ensure safe, ethical and sovereign deployment of artificial intelligence across Morocco. The draft envisions the Agency setting national AI policy, coordinating oversight across sectors, and enforcing compliance with ethical, safety, privacy and security standards to harmonize AI governance across public and private sectors, align Moroccan policy with international norms, and protect fundamental rights while promoting innovation. The concept aligns with government initiatives to develop a national AI roadmap and multi-stakeholder consultations on AI policy. See recent ministry communications: mmsp.gov.ma - Assises Nationales de l'IA. The drafting discussions indicate momentum for formal legislation, but an authorized consolidated draft law published in an official government legislative database or in the Official Gazette was not located for 2024.

Definitions

The Bill sets out operational, technology-neutral definitions intended to maximize legal clarity and interoperability. Key defined terms described in the draft include "artificial intelligence system," "high-risk AI system," "developer/provider," "deployment," "automated decision-making," and "personal data processing". Definitions are intended to be aligned with international instruments and to provide a foundation for scope, compliance obligations, and enforcement. The Bill also contemplates definitions that enable a risk-based approach to classification and regulation of systems operating in sensitive domains.

Governance and Institutional Framework

The Agency would be constituted as an independent administrative authority with a governing board composed of government representatives, independent experts, civil society and possibly industry observers, supported by technical units such as policy, risk assessment, inspections, research and capacity-building teams. The head of the Agency would be appointed by the executive branch with statutory safeguards intended to ensure operational independence. The Agency would collaborate with the Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP) on privacy and compliance matters; see CNDP communications: cndp.ma - Communiqué. The institutional architecture envisaged includes coordination mechanisms with sectoral regulators (health, education, finance, etc.) and formal interfaces with national data protection authorities to avoid regulatory overlap and to ensure coherent oversight across domains.

Key Focus Areas

• Legal establishment and mandate of the Agency: creating a centralized authority for AI governance with a statutory remit for policy, oversight, and enforcement.
• Technical and ethical guidance: powers for the Agency to issue technical standards, ethical guidelines, and sector-specific guidance to support safe deployment.
• Risk-based classification: a framework to classify AI systems by risk level, including explicit categories for high-risk systems used in sensitive domains (health, justice, social services) and systems materially affecting Moroccan residents or critical infrastructure.
• Registration and conformity assessment: requirements for registration/notification of specified AI systems and pre-deployment conformity assessments for high-risk systems.
• Audit, inspection and enforcement powers: authority to conduct audits and inspections, require corrective actions, suspend or withdraw systems, and impose administrative fines calibrated by severity and recurrence.
• Rights for individuals: transparency obligations, the right to information about automated decisions affecting individuals, remedies and complaint channels, and data protection safeguards.
• Provider obligations: documentation and accountability, risk assessment and mitigation, impact assessments for high-risk systems, record-keeping, and cooperation with the Agency for audits and corrective measures.
• Regulatory sandboxes and national infrastructure: authority to operate sandboxes and to support national AI infrastructure intended for public-interest models and capacity-building.
• Exemptions and transitional measures: contemplated exemptions or tailored transitional provisions for research and small-scale developers to preserve innovation while moving toward comprehensive oversight.

Implementation Framework

The Bill anticipates a phased implementation model and a set of operational mechanisms to bring systems into compliance. Compliance mechanisms described include mandatory registration or notification for specified categories of AI systems, pre-deployment conformity assessments for high-risk AI, periodic post-market monitoring, incident reporting obligations, algorithmic documentation and "explainability" requirements, and privacy-by-design data governance standards. Entities would be required to perform algorithmic impact assessments and technical testing prior to large-scale deployment of certain systems. The Agency would be empowered to establish regulatory sandboxes to facilitate experimentation and to operate or coordinate national AI infrastructure for public-interest models. The Bill would also contemplate transitional provisions to mitigate burdens on research activities and small developers while enabling regulatory objectives.

Monitoring and Evaluation

Monitoring and evaluation mechanisms in the draft include periodic post-market monitoring, mandatory incident reporting, audit and inspection regimes, and obligations for providers to maintain records and documentation for review. The Agency would carry out risk-based monitoring and could require corrective actions or technical remediation following inspections or investigations. Performance indicators and ongoing stakeholder consultations are anticipated to refine technical standards over time. The Bill anticipates coordination between the Agency and sectoral regulators and the CNDP for privacy-related compliance monitoring.

Penalties, Liability, and Appeals

The Agency would be empowered to impose administrative sanctions, including fines, and to order suspension or withdrawal of non-compliant systems. Sanctions would be calibrated according to the severity and recurrence of violations, with enhanced measures for breaches that affect fundamental rights or critical infrastructure. Procedural safeguards would be provided, including rights to appeal Agency decisions and judicial review. The draft signals intent to balance deterrence and proportionality in enforcement while preserving mechanisms for due process and redress.

Relationship to Other Instruments

The Bill is intended to operate alongside Morocco’s existing data protection law and the CNDP’s oversight, as well as applicable sectoral laws in health, education, finance, and other regulated domains. It anticipates formal coordination mechanisms with the CNDP for personal data matters and with sectoral regulators to avoid regulatory overlap and to enable domain-specific governance. The architecture seeks to align national requirements with existing legal frameworks to provide legal certainty for public-sector organizations and private providers operating in Morocco.

International Alignment

The draft is designed with an eye toward alignment with international norms and evolving guidance from multilateral bodies. It references the goal of interoperability with international instruments and evolving EU/UN guidance to facilitate cross-border cooperation and consistency with widely-used governance approaches. Alignment priorities include technology-neutral definitions, a risk-based approach, and mechanisms for cooperation with foreign regulators to address cross-border services that materially affect Moroccan residents or infrastructure.

Implementation Timeline

Sources and References