My company works in Morocco. What does the law ask of us when an AI agent reads our data?
The short answer
Law 09-08 of 2009 applies, and the CNDP enforces it. Processing needs the person's unambiguous consent unless one of the law's exceptions applies, and it must first be declared to the CNDP or authorized by it. Using data for a purpose other than the one it was collected for needs prior authorization. Data may go abroad only to a country with sufficient protection, or under the exceptions the law lists, among them the CNDP's express authorization.
The law that applies
Law 09-08 on the protection of natural persons with regard to the processing of personal data was promulgated by Dahir 1-09-15 of 18 February 2009. It was published in the Official Bulletin 5714 of 5 March 2009. The law set up the National Commission for the Control of Personal Data Protection, the CNDP. I found no amendment to the law as of October 2026.
The law covers controllers established in Morocco. It also covers a controller outside Morocco that uses means located in Morocco to process personal data. That controller must give the CNDP the identity of a representative based in Morocco.
Morocco is also a party to the Council of Europe’s Convention 108 on data protection and its additional protocol. Both entered into force for Morocco on 1 September 2019.
Can the agent read personal data at all?
The default rule is that personal data may be processed only if the person has given unambiguous consent. Consent is not needed where the processing is necessary for one of the cases the law lists. Among them are a legal obligation, performing a contract the person is party to, and the legitimate interest of the controller, provided it does not disregard the person’s interests or rights.
Three rules matter most for an agent:
- Declare or ask first. Every processing needs a prior declaration to the CNDP. Some processing needs its prior authorization instead. This includes sensitive data, and using data for purposes other than those for which it was collected. Health data used only for medical care under professional secrecy needs only a declaration. An agent that reads records for a new purpose falls within this.
- No decision made by machine alone. No decision with legal effects on a person may be based solely on automated processing meant to define the person’s profile or assess aspects of their personality. This does not cover decisions taken to conclude or perform a contract where the person could present their views, or decisions that grant the person’s request.
- Security. You must protect the data with suitable technical and organizational measures against loss, alteration and unauthorized access.
The model provider, and data sent abroad
When the agent sends text to a model run by a provider, the provider processes that data on your behalf. You must choose a processor that gives sufficient guarantees on security. A contract must bind the processor, and it must state that the processor acts only on your instructions and is bound by the same security duties.
The law allows a transfer to a foreign country only if that country offers a sufficient level of protection. The CNDP draws up the list of countries that meet this test. By way of exception, you may transfer to a country without that protection in listed cases. They include the person’s express consent, performing a contract with the person, and the CNDP’s express and reasoned authorization where the processing guarantees sufficient protection, for example through contract clauses.
When something goes wrong
I found no duty in Law 09-08 to notify the CNDP or the affected people of a data breach.
The CNDP may withdraw a declaration receipt or an authorization where the processing harms security or public order, or is contrary to morals. Running a file without the required declaration or authorization can bring a fine of 10,000 to 100,000 dirhams. A transfer abroad in breach of the law can bring 3 months to 1 year in prison, a fine of 20,000 to 200,000 dirhams, or one of the two. Fines are doubled when the offender is a company.
What Morocco says about AI itself
The CNDP said in its newsletter for the first quarter of 2025 that Law 09-08 also covers AI processing when it uses personal data. In the same newsletter it said it had been working for years on adjusting the law, without changing its spirit. I found no published draft of a new law as of October 2026.
On 8 September 2026 the Ministry of Digital Transition and Administration Reform presented the latest progress on its Maroc IA 2030 roadmap. The roadmap rests on three pillars: sovereignty and trust, innovation and competitiveness, and impact, adoption and outreach. It is a policy, not a law. I found no Moroccan law that regulates AI as such, as of October 2026.
What this means for you
- Declare each processing the agent performs to the CNDP before it starts, and ask for authorization where the law requires it.
- If the agent reads data for a purpose other than the one it was collected for, get the CNDP’s prior authorization first.
- If the agent decides anything that has legal effects on a person, keep a human in the decision, or let the person present their views.
- If your model provider processes data outside Morocco, check whether the country is on the CNDP’s list. If it is not, settle the exception you rely on before you go live.
I am not a lawyer. This page summarizes the official texts as I read them in October 2026. Ask a lawyer about your own case.
References
- CNDP, Law 09-08
- CNDP, Law 09-08, full text in French
- Ministry of Justice of Morocco, Law 09-08 on the protection of natural persons with regard to the processing of personal data
- Council of Europe, Welcome to Morocco, 55th State Party to Convention 108, May 2019
- CNDP, Lettre Artemis No. 34, first quarter 2025
- Maroc.ma, Morocco moves AI strategy implementation, September 2026