Morocco - AI Regulation Overview

Overview

Morocco has embarked on an ambitious journey to position itself as a leading digital economy in Africa and a competitive global player through its comprehensive 'Maroc Digital 2030' strategy. This national roadmap, championed by the Ministry of Digital Transition and Administrative Reform, views artificial intelligence (AI) not merely as a technological tool but as a transversal lever for economic growth, administrative modernization, and social inclusion. The Moroccan approach is characterized by a strong emphasis on digital sovereignty, ensuring that the deployment of AI systems respects national cultural values, linguistic diversity (including Arabic and Amazigh), and the protection of citizen data within national borders. As of 2026, the regulatory maturity of Morocco is transitioning from general data protection principles to specific, risk-based AI governance. The government has moved beyond high-level strategy into the legislative phase, introducing the 'Digital X.0' Framework Law to provide a unified legal backbone for digital services and AI. This philosophy balances the need for innovation—aiming to create 240,000 digital jobs and support 3,000 startups by 2030—with a robust ethical framework designed to build public trust. The Kingdom's proactive stance is further evidenced by its participation in international AI ethics forums and its strategic partnerships with global technology leaders to develop sovereign AI infrastructure. The strategy also emphasizes the importance of 'AI for Good,' focusing on sectors like agriculture, where AI can optimize water management in the face of climate change, and healthcare, where it can bridge the gap in medical services for rural populations. By integrating AI into the national fabric, Morocco aims to increase its GDP contribution from the digital sector significantly, fostering an environment where technology serves the human development goals outlined in the New Development Model.

Regulatory Approach

Morocco's regulatory approach to AI is predominantly horizontal, aiming to create a cross-sectoral framework that applies to both public administration and the private sector. The strategy is built on four pillars: strengthening digital infrastructure, establishing effective governance, fostering innovation, and ensuring equitable access. Rather than adopting a purely prescriptive model, Morocco is moving toward a risk-based classification system, heavily influenced by international standards such as the EU AI Act and UNESCO's Recommendation on the Ethics of Artificial Intelligence. This allows for lighter regulation of low-risk applications while mandating strict oversight for high-risk systems used in sensitive areas like justice, healthcare, and social protection. A key feature of the Moroccan approach is the integration of AI governance with data interoperability and digital identity. The proposed 'Digital X.0' framework introduces a 'traceable consent' model, ensuring that data exchanges between administrations or private actors are explicitly authorized and recorded. This approach prioritizes transparency and accountability, requiring that AI algorithms used in public services be explainable and subject to human oversight. By embedding these principles into a framework law, Morocco seeks to provide legal certainty for investors while safeguarding the fundamental rights of its citizens against algorithmic bias and opaque decision-making processes. The regulatory philosophy also emphasizes 'Digital Trust' (Confiance Numérique), which is viewed as a prerequisite for the mass adoption of AI technologies. This involves creating a secure environment where data is protected, systems are resilient, and the legal consequences of AI-driven actions are clearly defined.

Key AI Legislation

The Moroccan legislative landscape for AI is a blend of foundational data laws and emerging technology-specific frameworks. The cornerstone remains Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data, enacted in 2009, which provides the essential guardrails for any AI system involving personal information. However, the centerpiece of the modern era is the 'Digital X.0' Framework Law (Draft 2025), a landmark legislative initiative designed to modernize public administration and set the rules for AI deployment, data sovereignty, and digital interoperability across the national ecosystem. This law is complemented by the Bill for the Establishment of the National Agency for AI Governance (Proposed 2024), which aims to create a centralized regulatory body responsible for setting national AI policy, licensing high-risk systems, and enforcing ethical standards. Furthermore, Law No. 05-20 on Cybersecurity (2020) provides the legal framework for protecting critical information systems, which is essential for the secure deployment of AI in national infrastructure. Law No. 43-20 on Trust Services for Electronic Transactions also plays a vital role by regulating electronic signatures and digital trust, providing the necessary legal recognition for automated digital interactions. Together, these laws form a multi-layered legal structure that addresses the technical, ethical, and security dimensions of artificial intelligence, ensuring that the Kingdom's digital transition is both rapid and responsible.

Governance & Enforcement Bodies

The governance of AI in Morocco is currently a multi-stakeholder effort led by the Ministry of Digital Transition and Administrative Reform (MMSP). The MMSP is responsible for the overall strategic direction and the implementation of the Maroc Digital 2030 roadmap. Working closely with the ministry is the Digital Development Agency (ADD), which serves as the technical arm for overseeing digital transformation projects and ensuring that AI initiatives align with national priorities and technical standards. Oversight of data-related aspects of AI falls under the National Commission for the Control of Personal Data Protection (CNDP). The CNDP has a broad mandate to monitor compliance with Law 09-08, investigate complaints, and issue authorizations for complex data processing. Additionally, the General Directorate of Information Systems Security (DGSSI) acts as the national cybersecurity authority, setting the standards for system resilience and data classification. To centralize these efforts, the government is finalizing the creation of a dedicated National Agency for AI Governance, which will serve as the primary regulator for AI-specific ethical and technical compliance. This new agency will have the authority to conduct technical audits of algorithms, manage a registry of high-risk AI systems, and coordinate with sectoral regulators in finance, health, and telecommunications. The interplay between these bodies ensures that AI governance is not siloed but integrated into the broader national security and digital development frameworks.

Penalties & Enforcement

Enforcement of AI-related regulations currently relies heavily on the penalties established under Law No. 09-08. Organizations that fail to comply with data protection requirements—such as processing personal data without prior declaration or authorization from the CNDP—face significant sanctions. Fines range from MAD 10,000 to MAD 600,000 (approximately USD 1,000 to USD 60,000). For serious violations, including the unauthorized transfer of data abroad or the misuse of sensitive personal data, the law provides for criminal penalties, including imprisonment for terms ranging from three months to four years. The upcoming Digital X.0 Framework Law and the National AI Agency Bill are expected to introduce a more nuanced administrative penalty regime. These proposed laws contemplate graduated sanctions, including formal warnings, temporary suspension of AI systems, and administrative fines calibrated to the severity of the risk and the scale of the entity involved. The CNDP and the future AI Agency will have the power to conduct audits and inspections, with the right to demand the deactivation of non-compliant algorithms. Appeals against these decisions can be made through the Moroccan administrative court system, ensuring a process of judicial review for regulated entities. Furthermore, the government is exploring the concept of 'algorithmic liability,' where developers and deployers could be held responsible for damages caused by biased or malfunctioning AI systems, particularly in high-stakes sectors like autonomous transport or medical diagnostics.

Data Protection Framework

Morocco's data protection framework is one of the most established in the region, centered on Law No. 09-08. This law was designed to harmonize Moroccan standards with international norms, particularly those of the European Union. It mandates that all personal data processing must be fair, lawful, and transparent. For AI developers, this means that the collection of training data must have a clear legal basis and that data subjects must be informed about how their information is being used in automated systems. The law grants individuals the rights to access, rectify, and object to the processing of their data, which are critical in the context of AI-driven profiling. A significant aspect of the framework is the strict regulation of cross-border data transfers. Any transfer of personal data outside of Morocco requires prior authorization from the CNDP, which assesses whether the destination country provides an 'adequate level of protection.' This has led to a strong push for data sovereignty, with the government investing in national cloud infrastructure to ensure that sensitive Moroccan data remains under national jurisdiction. The CNDP has also been active in issuing guidelines on Data Protection Impact Assessments (DPIAs), which are increasingly expected for AI systems that process large volumes of sensitive information. The 'Data-Tika' program, launched by the CNDP, further encourages organizations to adopt a culture of data ethics, moving beyond mere legal compliance to a proactive stance on privacy by design in AI development.

Sector-Specific Rules

While the general framework is horizontal, several sectors in Morocco have begun implementing specific AI guidelines. In the Judiciary, the Ministry of Justice has introduced AI-powered systems to assist in court management and legal research, governed by internal directives that emphasize the primacy of human conscience and the right to an explanation for any automated administrative decision. Similarly, the Education sector has seen the rollout of AI-powered learning systems in universities, which must comply with strict student privacy standards set by the CNDP and the Ministry of Higher Education. In the Financial Sector, Bank Al-Maghrib (the central bank) and the Moroccan Capital Market Authority (AMMC) are developing frameworks for the use of AI in fintech and algorithmic trading. These rules focus on operational resilience, the prevention of market manipulation, and the mitigation of systemic risks. Furthermore, the Healthcare sector is undergoing a digital transformation that includes AI for diagnostics and patient management; these initiatives are subject to enhanced security requirements for sensitive medical data under the DGSSI's classification guidelines and the national health data governance framework. The agricultural sector is also seeing specific guidelines for the use of AI in precision farming and water resource management, focusing on data sharing protocols between public research institutions and private tech providers to ensure the sustainable use of national resources.

International Alignment

Morocco's AI policy is deeply influenced by its strategic partnerships and its desire for international interoperability. The Kingdom was one of the first countries to pilot the implementation of the UNESCO Recommendation on the Ethics of Artificial Intelligence, reflecting a commitment to human-centered technology. Furthermore, Morocco closely monitors developments in the European Union, particularly the EU AI Act, to ensure that its local regulations remain compatible with its largest trading partner. This alignment is intended to facilitate the 'adequacy' status for data transfers and to attract European tech investments. On a regional level, Morocco is a key player in the African Union's Continental AI Strategy and a member of the Digital Cooperation Organization (DCO). In February 2025, Morocco joined global leaders at the Paris AI Action Summit in adopting the Statement on Inclusive and Sustainable AI. The country also collaborates with organizations like the World Bank and the UNDP on digital inclusion projects. These international engagements are aimed at ensuring that Morocco's AI ecosystem is built on global best practices while asserting the country's role as a bridge between the Global North and the African continent. The establishment of the 'AI Movement' center at the Mohammed VI Polytechnic University (UM6P) as a UNESCO Category 2 center further solidifies Morocco's position as a regional hub for ethical AI research and policy development.

Future Developments

The next 12 to 24 months will be a defining period for Morocco's AI regulatory landscape. A primary milestone is the expected passage and implementation of the Digital X.0 Framework Law, which will trigger a series of implementing decrees defining the technical standards for AI interoperability and digital identity. Additionally, the formal launch of the National Agency for AI Governance is anticipated in late 2026, which will move the country toward a more centralized and proactive enforcement model. This agency is expected to begin the process of registering and auditing high-risk AI systems currently in use across the public sector. Infrastructure developments will also drive regulatory changes. The rollout of the National Sovereign Cloud Architecture in 2026 will introduce new compliance requirements for cloud service providers and AI developers regarding data residency and security. Morocco also plans to expand its 'JAZARI' institutes for AI training and launch a national platform for responsible AI, focusing on Large Language Models (LLMs) tailored to the Moroccan context. These initiatives, combined with the goal of achieving 70% 5G connectivity by 2030, will create a high-speed, regulated environment for the next generation of AI innovation in the Kingdom. The government is also expected to introduce a 'Digital Talent' visa and specific tax incentives for AI startups, further integrating economic policy with technological regulation to ensure the long-term sustainability of the Moroccan digital ecosystem.

Key Regulations

Enforcement Bodies