Data & AI: Law 09-08, the CNDP and AI, without fear or jargon

AI governance is the set of rules, roles and controls that make an artificial intelligence system reliable, traceable and accountable throughout its life cycle. For a Moroccan business, three frameworks matter: Law 09-08 on personal data protection as soon as the AI processes personal data, the EU AI Act as soon as its output is used in the European Union, and ISO/IEC 42001 to bring everything together in a certifiable management system.

4 min read

AI can triage, classify and summarise complaints and prepare draft replies. The main risks are a misclassified regulatory complaint that escapes the deadlines, a reply that promises what the company has not decided, gaps by language, and data leakage. In Morocco, Law 09-08 and its Article 11 apply; since 2 August 2026, the AI Act requires EU customers to be told they are interacting with AI.

7 min read

In banking and insurance, AI is involved in decisions with significant effects: granting credit, pricing, fraud detection. In Morocco, Article 11 of Law 09-08 on personal data protection restricts decisions based solely on automated processing. The AI Act classifies creditworthiness assessment of individuals and life and health insurance pricing as high risk, with obligations applying from 2 December 2027 where the regulation applies.

4 min read

AI in customer service carries six main risks: inaccurate answers, bias, lack of transparency, data leaks, no handover to a human, and weak performance in local languages. The essential safeguards are a limited scope, answers grounded in a validated knowledge base, informing the customer, an easy handover to a human, testing in French, Arabic and darija, event logging, and an incident procedure.

4 min read

As of 25 September 2026, Morocco has no AI-specific law in force. AI remains governed by existing legislation, first and foremost Law 09-08 on personal data protection, whose Article 11 restricts automated decisions. A draft digital framework law, Digital X.0, is in preparation, and the Maroc IA 2030 roadmap was presented in January 2026.

4 min read

Assessing an AI system means distinguishing three exercises: the audit of the management system (ISO/IEC 42001, certified by bodies accredited under ISO/IEC 42006), the technical evaluation of the model (bias, robustness, accuracy, with ISO/IEC TR 24027 and TS 12791) and the impact assessment on people (ISO/IEC 42005). For high-risk Annex III systems, the AI Act's requirements will apply from 2 December 2027.

8 min read

Since 2 August 2026, Article 50 of the AI Act requires that anyone interacting with a chatbot or voicebot be told, clearly and accessibly and at the latest at the first interaction, that they are talking to AI. A Moroccan call centre is concerned when the output of its conversational agents is used in the Union: directly if it is the provider of the tool, and in practice, as a deployer, by checking that the disclosure has not been switched off. The "obvious" exception is interpreted narrowly.

7 min read

Law 09-08 on personal data protection provides for criminal penalties ranging from 10,000 to 300,000 MAD in fines depending on the offence, with prison terms of three months to one year for most breaches. Fines are doubled for legal entities (Article 64) and for repeat offences (Article 65). The CNDP (Morocco's data protection authority) can also withdraw a receipt or an authorisation.

4 min read

Banks and insurers process some of the most sensitive data there is: identity, income, transactions and, in insurance, health. Law 09-08 on personal data protection applies in full, on top of professional secrecy and know-your-customer obligations. The points to watch are health data, which in principle requires authorisation from the CNDP (Morocco's data protection authority), transfers to the cloud, direct marketing, automated decisions and data sharing between bank and insurer.

4 min read

Since 2 February 2025, Article 5(1)(f) of the AI Act has prohibited using AI to infer people's emotions in the workplace, except for medical or safety reasons. In a call centre, this covers voice or video analysis of agents' emotions. Analysing customers' emotions is not prohibited, but it has required disclosure since 2 August 2026 and will be treated as a high-risk use from 2 December 2027.

7 min read

Health data is sensitive data within the meaning of Article 1 of Law 09-08 on personal data protection. In principle, processing it requires prior authorisation from the CNDP (Morocco's data protection authority). Article 22, however, provides for a simple notification where the processing serves prevention, diagnosis, care or the management of health services and is carried out by a professional bound by secrecy. In every case, clinics, practices, laboratories and platforms must complete the correct formality, inform patients and strictly secure access to records.

4 min read

ISO/IEC 42001:2023 is the first certifiable international standard for an artificial intelligence management system. It applies to any organisation that develops, provides or uses AI. It requires an AI policy, a risk and impact assessment, a statement of applicability and a treatment plan, supported by 38 reference controls grouped into nine domains.

4 min read

Law 09-08 on personal data protection and the GDPR share the same core principles (purpose limitation, proportionality, security, individuals' rights), but their underlying logic differs profoundly. Moroccan law relies on prior formalities with the CNDP (Morocco's data protection authority) and criminal penalties. The GDPR relies on organisational accountability, internal documentation and administrative fines of up to 4% of worldwide turnover.

4 min read

A Moroccan centre that processes data for a European client usually acts as a processor within the meaning of the GDPR. As there is no adequacy decision for Morocco, the transfer relies on the 2021 standard contractual clauses (module 2 if the client is the controller, module 3 if it is itself a processor), supplemented by a six-step transfer impact assessment. Law 09-08 continues to apply to processing carried out in Morocco.

7 min read

Privacy by Design means building data protection into a product, website or process from the design stage, rather than adding it afterwards. Formalised by Ann Cavoukian as seven principles, it became an obligation in the European Union through Article 25 of the GDPR. Law 09-08 on personal data protection does not use the term, but its proportionality and security requirements lead to the same approach.

4 min read

Since 11 August 2026, the business on whose behalf a call centre solicits consumers in France by phone must be able to prove prior consent given by an affirmative act, naming the brand and the purpose of the call, and less than a year old; in practice, it requires this proof from the centre for each number. Decree No. 2026-662 requires this proof to be kept for at least three years and made available to the consumer. Without proof, the business cannot show that the call was lawful, since the burden of proof lies with it.

7 min read

Under the AI Act, the provider is whoever develops an AI system and places it on the market under its own name (Article 3(3)); the deployer is whoever uses it under its own authority (Article 3(4)). A Moroccan call centre is most often a deployer, but it becomes a provider if it develops or markets its own tool, or if it puts its name on a high-risk system (Article 25).

7 min read

Since 11 August 2026, French Law No. 2025-594 has prohibited calling a consumer to solicit them without their prior consent, except under an existing contract or for a press subscription. Decree No. 2026-662 limits the validity of consent to one year and requires proof of it to be kept for three years. The ban also covers calls made by a third party, and therefore by a centre located in Morocco.

7 min read

The life cycle of an AI system runs from its design to its retirement. ISO/IEC 22989 offers a generic model: inception, design and development, verification and validation, deployment, operation and monitoring, continuous validation, re-evaluation, and retirement. ISO/IEC 42001 requires documented requirements and controls to be defined for each stage.

4 min read

Law 09-08 on personal data protection does not require the appointment of a data protection officer (DPO). A Moroccan company may nevertheless be required to appoint one under the GDPR if it targets people located in the European Union and meets the criteria in Article 37. In every case, designating a person responsible for data protection is good practice, and in 2025 the CNDP (Morocco's data protection authority) asked companies to clearly designate who is responsible internally.

4 min read

The EU AI Act applies to Moroccan call centres and BPOs whenever the output of their AI systems is used in the European Union, for example a chatbot or voicebot answering French customers. Since 2 August 2026, such systems must tell people they are interacting with AI. Obligations for high-risk systems were postponed to 2 December 2027 by Regulation (EU) 2026/1744.

5 min read

Article 4 of the AI Act has applied since 2 February 2025. As amended by Regulation (EU) 2026/1744, in force since 27 July 2026, it requires providers and deployers to take measures to support the development of AI literacy among their staff, with no level to be guaranteed and no certificate or designated officer. A Moroccan company is covered as soon as the output of its AI systems is used in the Union.

7 min read

In Morocco, personal data may only be transferred abroad to a country on the list of States providing adequate protection set by the CNDP (Morocco's data protection authority) in deliberation No. 236-2015, or in one of the exceptional cases set out in Article 44 of Law 09-08 on personal data protection. Outside those cases, the transfer requires authorisation from the CNDP, applied for using form F118.

4 min read

A firm subject to Law 43-05 must identify its clients; Law 09-08 requires it to do so without excess. The legal basis for processing is the legal obligation (Article 4 of Law 09-08), the client must be informed (Article 5), and processing national identity card (CIN) numbers requires prior authorisation from the CNDP (Article 12). Collect what the law requires, keep it for ten years, then delete it.

7 min read