Before an AI assistant reads your company's data, Morocco's Law 09-08 asks for four things: a defined purpose resting on one of the legal grounds in article 4, a filing with the CNDP (a declaration or a prior authorization, depending on the data), a legal basis for the transfer if the model or its logs sit outside Morocco, and a written contract that binds the provider to act only on your instructions. Most of the rest follows from those four. Retention is a good example, since the declaration has to state how long you keep the data (article 15).
No AI-specific text adds to that law yet. In a press release dated 18 March 2025, the CNDP, Morocco's data protection authority, wrote that AI processing of personal data "is governed by Law 09-08" (our translation), and it then scheduled hearings from June to December 2025 toward a deliberation on the subject. As of 1 November 2026, that deliberation is still listed under "deliberations in progress" on the CNDP website, and no AI guideline has been published. This guide is not legal advice.
Has your AI provider sent you its data processing agreement?
Ask for the data processing agreement attached to the contract (often called the DPA) and the provider's list of subprocessors. That document says where prompts and logs are processed, how long they are kept, whether they are used to train a model, and whether the provider acts only on your instructions, as article 23 requires. Getting it can take a few days, but those four points are quick to read.
What do you risk by launching before these checks?
The first cost is measured in weeks. A declaration gets a receipt within 24 hours (article 19), but the CNDP can move the processing to the authorization regime within eight days (article 20). For an authorization or a transfer request, the CNDP says it answers within two months, extendable once. An assistant finished before the file goes in just sits there.
The CNDP can also ban a processing operation (article 30). The law fines processing without a declaration or authorization 10,000 to 100,000 dirhams (article 52), and punishes an unlawful transfer abroad with three months to a year in prison and a fine of 20,000 to 200,000 dirhams, or either one (article 60). Fines double when the offender is a company (article 64). For an assistant your customers already use, a ban means switching the service off and explaining why.
Does Law 09-08 really apply to an AI assistant?
Yes, as soon as it touches personal data. Article 1 covers any information about an identifiable person and any operation on it, including consultation, extraction and storage. A customer message pasted into a prompt, a contract excerpt pulled up by the search engine and the log of that conversation are three separate processing operations under the law.
CNDP president Omar Seghrouchni put it plainly in a December 2025 interview with TelQuel: for personal data, "AI is one processing among others" (our translation). As early as 2018, the CNDP's secretary general spoke of revising the law to bring it closer to the GDPR, but we found no replacement text adopted as of 1 November 2026.
What are the twelve checks before launch?
Go through the table in one meeting with IT, the business owner of the assistant and your lawyer. A line is closed only when its evidence is in the project file.
| Check | Legal hook | Question to settle | Evidence to keep |
|---|---|---|---|
| 1. Purpose and legal ground | Art. 3-1 b), art. 4 | What does the assistant do, for whom, and on which ground in article 4? | One-page purpose sheet signed by the business owner |
| 2. Reuse of existing data | Art. 12-1 b) | Does each source serve the purpose its data was collected for? | Table of source, original purpose, receipt |
| 3. Data that reaches the model | Art. 1, 3-1 c), 12-1 a) and e) | What personal data goes into prompts, retrieved documents and logs (sensitive data, national ID numbers)? | Inventory per data flow, masking rules |
| 4. CNDP filing | Art. 12 to 15, 19 and 20 | Declaration, authorization, or an update to an existing declaration? | Receipt or authorization |
| 5. Transfer outside Morocco | Art. 43, 44, deliberation 236-2015 | Where do the model, the index and the logs run, and is that country on the CNDP list? | F118 form and CNDP decision |
| 6. Notice to people | Art. 5 | Do employees and customers know what the assistant does with their data, and under which receipt? | Updated notice, internal memo, banner |
| 7. Data subject rights | Art. 7, 8 and 9 | Can you extract, correct or erase what the assistant holds on one person? | Procedure tested on a dummy case |
| 8. Retention | Art. 3-1 e), 15 f) | How long do you and the provider keep prompts, indexes and logs? | Retention table, proof of deletion |
| 9. Security | Art. 23 (and 24 for sensitive data) | Who can open the console and the logs, and is that access recorded? | Security note, test results |
| 10. Provider contract | Art. 23-2 to 23-4, 25 | Does the provider act only on your instructions, without reusing your data or subcontracting without your consent? | Signed clauses, list of subprocessors |
| 11. Permissions | Art. 23-1, 25 and 61 | Can a user see more in the assistant than in the source system? | Tests per user profile |
| 12. Human review | Art. 11, 7 c) | Does the assistant alone decide anything with legal effects for a person? | Approval workflow and its log |
A free review of your assistant project checks these twelve lines with your team before you file; our AI transformation and AI governance pages describe how we work.
Settle lines 1 to 3 first. They decide the filing and the transfer, the two steps with the longest waits. The CNDP national register already shows your company's receipts. Our comparison of CNDP declaration and authorization helps with line 4, and our piece on AI assistant permissions covers line 11 in depth.
Why does the transfer abroad need the most lead time?
If the model, its index or its logs are hosted outside Morocco, article 43 allows the transfer only to a country with an adequate level of protection. The CNDP's list (deliberation 236-2015) names 32 countries: 26 EU member states (Croatia is not among them), the United Kingdom, Switzerland, Norway, Iceland, Liechtenstein and Canada. The United States is not on it, so a model hosted there falls under the exceptions in article 44. Even for a listed country, the deliberation says every transfer must also be notified to the CNDP.
Among those exceptions, article 44 allows the person's explicit consent or a reasoned CNDP authorization based on contractual clauses. Getting explicit consent from every customer named in your files is rarely workable. In practice the route is usually an authorization backed by clauses signed with the provider. The CNDP also grants a transfer only if the underlying processing has already been declared or authorized.
Are prompts and logs personal data?
They are whenever they identify someone, and a useful log nearly always does, since it records who asked, what they asked and what the assistant answered. Article 3 limits retention to what the purpose requires, article 15 makes you declare the retention period, and article 55 punishes keeping data past it.
People named in a log keep their rights too: access without delay and free of charge (article 7), and correction or erasure of unlawfully processed data within ten clear days (article 8). Logs you can only search by date won't meet those deadlines. Build a search by person, set a retention period per log type, and check that the provider applies the same period on its side.
Can the assistant use data collected for something else?
This one is easy to miss, because nothing in the architecture flags it. Article 12 requires prior authorization for "the use of personal data for purposes other than those for which it was collected" (our translation). Consumption data in a file declared for billing changes purpose if the assistant uses it to suggest commercial offers to subscribers. The same article covers sensitive data and national ID card numbers, which often turn up in attachments.
You have two options. Restrict the assistant to uses already declared and mask ID numbers and sensitive data before they reach the model, or accept the new purpose and apply for authorization. Since the line between a related use and a new purpose is drawn case by case, have your lawyer sign off on the choice.
Who has to sign off when the assistant affects a decision about a person?
A named human, and article 11 explains why. No decision with legal effects for a person may rest solely on automated processing meant to profile them or assess aspects of their personality. The law makes two exceptions: a decision taken to conclude or perform a contract where the person could present their views, and a decision that grants the person's own request. We recommend letting the assistant propose and a person decide, logging each approval with its author, and being able to explain the logic of the processing, which article 7 entitles the person to know.
What does an operator lose by filing after the build?
This case is an illustration, with a fictional telecom operator and assumed numbers. The operator gives its 120 customer service agents an assistant that finds a clause in a subscription contract or explains a line on a bill. It reads the contract base and the billing system, and the model is hosted in Ireland.
The team reviews 500 randomly picked subscriber files and finds a national ID number in 470 of them, or 94%. It masks those numbers before anything reaches the model, with its lawyer's sign-off. Ireland is on the CNDP list, but the transfer still has to be notified, so the F118 form goes in with the declaration.
The build takes eight weeks, and the team plans on the two months (about nine weeks) the CNDP announces, without an extension. Filed in week 1, the application gets its answer around week 10, two weeks after the build ends. Filed in week 8, it gets it around week 17. The order of tasks alone adds seven weeks of waiting to a finished tool. If the CNDP extends, both dates move back by the same amount and the seven-week gap stays.
On retention, the team keeps full conversations for three months, long enough to settle a billing complaint, then a reduced log (who, when, which sources) for twelve months, filed by contract number so it can answer access requests. It declares both periods.
FAQ
- Our staff already paste customer data into ChatGPT. What should we do?
Treat it as existing processing with no framework around it. Map the actual uses, stop personal data going into individual accounts, and offer a company-contracted tool with set retention and known hosting, then file with the CNDP. The replacement tool matters as much as the stop, because a ban on its own rarely holds.
- Do we need a data protection officer before launching an AI assistant?
Law 09-08 has no general obligation to appoint a data protection officer, and we found no CNDP text requiring one for AI. Someone still has to own the file, because the declaration names the department where people exercise their rights (article 15). An in-house lawyer can take it on.
- If we run the model on our own servers in Morocco, are we exempt from the CNDP?
You avoid the transfer rules if nothing leaves the country, including logs, backups and the provider's remote maintenance. You still need the filing, the notice to people, a way to honor their rights and set retention periods, because the law follows the processing wherever it runs.
- Will the CNDP's AI deliberation change these rules?
Nobody can say before it is published. The topics reported in the press (technical documentation, impact assessment, human oversight) do overlap with this table, though, and a file kept with its evidence should only need completing.
Sources
- Law 09-08, official text published by the CNDP (PDF, French)
- CNDP press release on AI and personal data, 18 March 2025 (PDF, French)
- CNDP deliberation 236-2015, list of adequate countries (PDF, French)
- CNDP, transfer abroad, declaration and prior authorization procedures
- CNDP, AI and personal data hearings and deliberations in progress
- TelQuel, interview with Omar Seghrouchni, December 2025
- TelQuel, AI and data, April 2026
- Finances News Hebdo, interview with Lahoussine Aniss, June 2018
Last verified: 1 November 2026.
As of 1 November 2026, the CNDP's response time only starts running once the documents it asked for have been supplied. The shortest timeline is to send a complete file as soon as hosting is settled, before the first build sprint.
