AI Governance in Banking and Insurance in Morocco

The uses concerned#

What Law 09-08 says#

Article 11 prohibits basing a decision with legal effects on a person solely on the result of automated processing intended to define their profile or assess certain aspects of their personality. The law provides for exceptions, notably where the decision is taken in the context of a contract and the person has been able to present their point of view.

In practice, a credit refusal based solely on an automated score, with no human involvement and no opportunity for the customer to put their case, exposes the bank. The rights of access and objection under Law 09-08 also mean being able to explain, in understandable terms, the logic of a score that has effects on a person.

What the AI Act says#

Annex III of the AI Act classifies as high risk:

• systems intended to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of those used to detect fraud;
• systems intended for risk assessment and pricing in relation to natural persons in life and health insurance.

These obligations apply from 2 December 2027. A Moroccan bank is affected when these systems produce output used in the European Union, for example through subsidiaries or activities involving customers who live there. Each situation must be assessed case by case.

Governance good practice#

• An inventory of the models used in customer decisions, with an owner for each one.
• Human review of any significant adverse decision, with a channel for the customer to present their point of view.
• Bias testing on data representative of the Moroccan customer base, by region, age, sex and income type.
• Explainability: being able to tell the customer which factors weighed in the decision.
• Monitoring of model drift and periodic revalidation.
• Oversight of third-party models: documentation, test results, conditions of use.
• Integration into the internal control and risk management framework that Bank Al-Maghrib (Morocco's central bank) requires across all of a bank's activities.

See also The AI System Life Cycle: From Design to Retirement.