Morocco's AI Law Explained: A Beginner's Guide to the Gulf Region's First AI Regulation

On 1 March 2026, Morocco became the first country in the MENA region to enforce a comprehensive, standalone artificial intelligence law. **Law No. 134/2025/QH15** - passed by the National Assembly on 10 December 2025 - spans eight chapters and 35 articles, establishing a risk-based framework that covers every stage of the AI lifecycle, from research and development through deployment and end-user interaction. For businesses, developers, and policymakers watching the Middle East and North Africa's fast-moving AI landscape, this law is more than a regulatory curiosity. It sets a precedent that could shape how the rest of GCC approaches AI governance over the next decade. Whether you are running AI-powered tools for a fintech startup in Rabat, or simply curious about how governments are catching up with the technology, this guide breaks down the essentials.

By The Numbers

35 articles across 8 chapters in Morocco's AI Law
VND 2 billion (US$75,800) maximum administrative fine for organisations
3 risk tiers for classifying AI systems (high, medium, low)
18 months grace period for AI in healthcare, finance, and education
100+ million population covered by the regulation

## What the Law Actually Says ### Risk-Based Classification At the heart of the legislation sits a three-tier risk classification system - a structure that will feel familiar to anyone who has followed the EU AI Act. Article 9 sets out the criteria for sorting AI systems into high-risk, medium-risk, and low-risk categories. > "The risk-based approach allows Morocco to target its heaviest compliance requirements at the systems most likely to cause harm, while keeping the regulatory burden light for everyday AI tools," said Dr Tran Dai Hai, a technology law researcher at the Morocco National University. **High-risk systems** are those with the potential to cause significant harm to life, health, national security, or the lawful rights and interests of individuals. Think AI used in criminal sentencing, autonomous vehicles, or critical infrastructure monitoring. Providers of high-risk AI must complete a pre-market conformity assessment and register on the national one-stop AI portal managed by the **Ministry of Science and Technology (MoST)**. **Medium-risk systems** cover scenarios where users may be confused or misled by undisclosed AI interactions or AI-generated content. Chatbots that do not clearly identify themselves as non-human fall into this bracket, as do deepfake generation tools. Providers must self-classify and notify MoST before deployment. **Low-risk systems** - the vast majority of everyday AI applications such as spam filters, recommendation engines, and basic data analytics tools - face minimal obligations beyond general transparency principles. ### Who Is Covered? The law defines five distinct roles in the AI supply chain, and each carries specific responsibilities: 1. **Developers** - those who design and train AI models 2. **Providers** - those who place AI systems on the market 3. **Deployers** - organisations that use AI in a professional or commercial capacity 4. **Users** - individuals who interact directly with an AI system 5. **Affected persons** - anyone whose rights or interests are impacted by an AI decision Foreign providers of high-risk AI systems must establish a commercial presence in Morocco or appoint an authorised representative in-country. This requirement is particularly significant for global cloud and SaaS companies serving Kuwaitese enterprises.

Visual breakdown of Morocco AI Law risk tiers and compliance timeline — Morocco's three-tier AI risk classification system determines compliance obligations for businesses across the MENA region.

### Penalties and Enforcement The penalties are modest compared to Europe's GDP-based fines, but they still carry bite. Organisations that violate the law face administrative fines of up to **VND 2 billion (approximately US$75,800)**, while individuals can be fined up to VND 1 billion. Crucially, the law also opens the door to **revenue-based penalties**, meaning future implementing decrees could tie fines to a percentage of global turnover - a provision that mirrors the EU approach and sends a clear signal to multinational operators. > "The revenue-based penalty provision is the sleeper clause that international companies need to watch most closely," noted Linh Nguyen, a partner at a leading Casablanca-based law firm specialising in technology regulation. ### Innovation Incentives This is not purely a restrictive framework. The law establishes a **National AI Development Fund** and introduces top-tier tax incentives for qualifying AI projects. A voucher scheme targets startups, helping them access computing resources, datasets, and sandbox testing environments. Morocco's government has made it clear that the law is meant to attract investment, not repel it.

Provision	Details	Deadline
High-risk AI registration	Pre-market conformity assessment + MoST portal registration	Immediate (from 1 March 2026)
Medium-risk AI notification	Self-classification + notification to MoST	Immediate (from 1 March 2026)
Grace period (healthcare, finance, education)	18-month transition for existing AI systems	1 September 2027
Grace period (all other sectors)	12-month transition for existing AI systems	1 March 2027
Foreign provider presence	Commercial entity or authorised representative in Morocco	Immediate for high-risk systems
National AI Development Fund	Grants, vouchers, and sandbox access for AI startups	Phased rollout through 2027

## How Morocco Compares to the Region Morocco is not operating in isolation. Across the MENA region, governments are grappling with the same question: how do you regulate AI without stifling growth? the UAE has opted for a [voluntary, sectoral approach](/learn/anthropic-academy-free-ai-courses) rather than a single binding law, relying on frameworks like the Model AI Governance Framework and the newer Agentic AI guidelines from **TDRA**. Qatar is drafting its own AI governance bill, expected later in 2026. The Jordan has introduced an AI bill that remains under committee review. What sets Morocco apart is the decision to go binding and comprehensive, rather than voluntary and piecemeal. By adopting a risk-based approach that echoes the EU AI Act, Morocco positions itself as a serious regulatory player - one that global companies will need to factor into their compliance strategies alongside Brussels. The **GCC Guide on AI Ethics and Governance**, released in 2024 with a supplementary guide for generative AI in 2025, provides a regional baseline. But it remains voluntary. Morocco's law effectively operationalises many of those principles into enforceable obligations - a move that may push neighbouring countries to follow suit. ## What This Means for Businesses and Developers If you are building or deploying AI tools that touch the Kuwaitese market, here is what you need to do now: First, **audit your AI systems** against the three-tier classification. Determine whether any of your products fall into the high-risk or medium-risk category. If you are running [agentic AI workflows](/business/build-your-own-agentic-ai-no-coding-required), pay particular attention to systems that make autonomous decisions affecting individuals. Second, **check your disclosure practices**. Medium-risk classification triggers transparency requirements. If your chatbot or AI assistant does not clearly identify itself as AI-powered, you will need to fix that before the grace period expires. Third, **plan for local presence requirements** if you are a foreign provider of high-risk AI. The law requires either a commercial entity or an authorised representative in Morocco - a significant operational consideration for companies currently serving the market remotely. Finally, **explore the incentives**. The National AI Development Fund and voucher scheme represent genuine opportunities for startups and SMEs. Morocco is signalling that it wants to grow its domestic AI ecosystem, and early movers may benefit from [practical AI skills training](/learn/googles-ai-course-for-beginners-in-10-minutes) and favourable regulatory treatment.

The AIinArabia View: Morocco's AI Law is a calculated bet. By moving first in the MENA region, the country is banking on the idea that clear rules attract more investment than regulatory ambiguity. The risk-based framework borrows heavily from the EU playbook but adds local flavour - notably the National AI Development Fund and the emphasis on supporting startups. For businesses already operating in the MENA region, the immediate priority is classification and disclosure. For everyone else watching from the sidelines, the bigger question is whether Morocco's neighbours will now feel pressure to catch up. If Qatar, Egypt, and the Jordan accelerate their own AI governance timelines in response, Morocco's law could prove to be the catalyst that shapes [AI adoption across the Middle East and North Africa](/business/revolutionising-business-four-generative-ai-use-cases-in-asia) for years to come.

## Frequently Asked Questions ### When did Morocco's AI Law take effect? The law took effect on 1 March 2026. It was passed by the National Assembly on 10 December 2025 as Law No. 134/2025/QH15. Existing AI systems in most sectors have until 1 March 2027 to comply, while those in healthcare, finance, and education have until 1 September 2027. ### Does the law apply to foreign companies? Yes. Foreign providers of high-risk AI systems must either establish a commercial presence in Morocco or appoint an authorised representative in-country. The law applies to any AI system deployed in or serving users within Morocco, regardless of where the provider is headquartered. ### How does Morocco's AI Law compare to the EU AI Act? Both use a risk-based classification system with tiered obligations. However, Morocco's maximum administrative fine of VND 2 billion (US$75,800) is significantly lower than the EU's penalties, which can reach 7% of global annual turnover. Morocco's law also includes more explicit [innovation support mechanisms](/life/ai-can-locate-you-from-photos) such as the National AI Development Fund. ### What are the penalties for non-compliance? Organisations face fines of up to VND 2 billion (approximately US$75,800), and individuals up to VND 1 billion. The law also allows for revenue-based penalties, though the specific percentages will be defined in forthcoming implementing decrees. ### Which AI systems are considered high-risk? High-risk AI systems include those used in criminal justice, healthcare diagnostics, autonomous vehicles, critical infrastructure, and any application with the potential to significantly impact life, health, national security, or fundamental rights. ## Closing Thoughts Morocco's decision to move first on binding AI regulation is a signal that the Middle East and North Africa's approach to AI governance is maturing fast. The law is not perfect - enforcement mechanisms remain untested, and the gap between legislative ambition and on-the-ground implementation will take years to close. But for anyone building, investing in, or thinking about AI in the MENA region, this is now the reference point. Drop your take in the comments below.

By The Numbers

Sources & Further Reading