AI Regulation Tracker / Data protection
Morocco's data protection authority says Law 09-08 already governs AI processing, and has started work on a dedicated deliberation
The CNDP issued a communique in Rabat stating that AI processing of personal data already falls under Morocco's Law 09-08, and that work toward a deliberation on AI processing has begun. It is opening auditions to experts, professional bodies and civil society.
What the CNDP actually said
The communique is short and it is worth being precise about its claims, because it has been reported more aggressively than it reads.
Lorsqu’ils utilisent les données à caractère personnel, les traitements d’intelligence artificielle (IA) sont encadrés par la loi 09-08.CNDP communique, Rabat, 18 March 2025
That is a statement of existing law, not a new rule. Where an AI system touches personal data in Morocco, the existing data protection statute already applies to it. The CNDP is asserting jurisdiction it already has.
The four qualities it named
The communique says these processing operations require particular attention, and it lists what that attention is directed at: integrity, transparency, fairness and legibility. It frames this around a specific concern, which is making sure citizens always have a route to challenge automated decisions.
Legibility is the interesting word. It is not the same as transparency. Transparency is about disclosure. Legibility is about whether a person can actually follow how a decision was reached. For anyone running scoring or eligibility models into the Moroccan market, that is the phrase to watch as the deliberation develops.
How Law 09-08 reaches AI systems
Law 09-08 concerns the protection of individuals with regard to the processing of personal data. It was promulgated by Dahir No. 1-09-15 of 22 safar 1430, corresponding to 18 February 2009, and published in Bulletin Officiel No. 5714 of 5 March 2009. The CNDP was created by that same instrument, and one of its stated missions is to ensure that personal data processing complies with the law.
Underneath sits Article 24 of the Moroccan Constitution, which the communique quotes: every person has the right to the protection of their private life.
Who the CNDP is auditioning, and how to be heard
The CNDP says it ran an international benchmark and consulted data protection authorities and bodies abroad before starting this work. It will now hear national experts, international experts, scientific organisations, professional organisations, institutions and civil society associations, plus anyone else able to shed particular light on the subject.
Parties wanting to be heard are asked to write to auditions-ia@cndp.ma. For a US firm with Moroccan data operations, that is an open consultation channel, and those are usually cheaper to influence than a finished rule.
Where Morocco sits in North Africa
Morocco is moving through its existing data protection authority rather than standing up a new AI regulator. That is the same path several neighbours are on, and it is a different model from the dedicated-agency approach further south.
| Jurisdiction | Route to AI oversight | Lead body | Stage |
|---|---|---|---|
| Morocco | Existing data protection statute, Law 09-08 | CNDP | Deliberation work initiated; auditions open |
| Egypt | National AI strategy alongside data protection law | Government AI strategy bodies | Strategy published January 2025 |
| Tunisia | National AI strategy alongside data protection framework | National strategy bodies | Policy and strategy stage |
| Algeria | Draft bill on ethical and security standards for AI | Government, bill in preparation | Draft, not tabled at last report |
The cross-border read for US firms
Morocco is a significant offshoring destination for French-language business process work, which means a lot of European and American customer data is processed there by service providers. If your vendor runs AI-assisted quality scoring, call summarisation or fraud triage out of Casablanca or Rabat, Law 09-08 applies to that processing on the Moroccan side, independently of whatever your GDPR or state-law analysis says.
The practical step is not complicated. Ask your Moroccan processors whether they have registered the AI processing with the CNDP and whether they can explain an automated decision to a data subject. Those two questions map directly onto the qualities the CNDP named, and they are the ones a future deliberation is most likely to formalise.
What this is not
It is not a deliberation. It is not an enforcement action, and it names no company. It does not create AI-specific obligations, set a penalty, or announce a deadline. It does not put AI developers on formal notice in any legal sense. Anyone describing it that way is over-reading a preparatory communique. The binding instrument here remains Law 09-08, and it was binding before March 2025.
Frequently asked questions
Has Morocco adopted an AI regulation?
No. The CNDP has stated that AI processing of personal data is already covered by Law 09-08 and that work toward a dedicated deliberation on AI processing has been initiated. No deliberation had been adopted at the date of the communique.
Does this create new obligations for AI developers in Morocco?
No. The obligations come from Law 09-08, which was already in force. The communique confirms the CNDP reads that law as reaching AI processing and signals a future instrument.
Can an outside organisation take part?
Yes. The CNDP invited national and international experts, scientific and professional organisations, institutions and civil society associations, and anyone able to shed particular light on the subject, to express interest at auditions-ia@cndp.ma.
What should a US company with Moroccan operations do now?
Treat AI processing of Moroccan personal data as in scope of Law 09-08 today, with particular attention to explaining automated decisions, and monitor the deliberation as it develops. The consultation is open, which is the cheapest point to raise practical concerns.
Last verified: July 27, 2026