Add the Maroc Digital 2030 strategy, which puts AI at the centre of public discourse, and a CNDP that speaks about the topic more and more often: the risk is no longer theoretical. If you are starting from scratch, our CNDP Law 09-08 compliance checklist<\/a> covers the basics; here we focus on the specific case of AI.<\/p>\n The answer depends less on the tool than on the edition. The same logo can hide a free personal account that stores and may reuse conversations, and an enterprise offer with a contract, encryption and a no-training clause. Before any decision, list the editions actually in use in your company.<\/p>\n Free and Plus accounts are personal accounts: conversations are stored on OpenAI servers outside Morocco and can, by default, be used to improve the models unless the user turns the option off in their settings. The Team and Enterprise offers exclude training by default and come with a data processing agreement, but hosting remains abroad.<\/p>\n The consumer Copilot built into Windows or Edge behaves like a personal assistant. Microsoft 365 Copilot, on the other hand, works inside your tenant, under the contractual commitments of Microsoft 365. That is a clear improvement, provided the licence is actually that one and your Microsoft 365 data has already been declared as hosted abroad.<\/p>\n Same logic: consumer Gemini tied to a personal Gmail account may have conversations reviewed by humans; Gemini inside Google Workspace relies on the contractual commitments of Workspace. Here too, the hosting location remains outside Morocco.<\/p>\n These terms change several times a year. The useful reflex: archive the version of the terms you read, and re-read them at every renewal.<\/p>\n Law 09-08 predates generative AI, but its principles apply without ambiguity. Four points directly concern the use of AI assistants:<\/p>\n The penalties range from fines of tens to hundreds of thousands of dirhams depending on the offence, with prison sentences for the most serious cases. A reform of the law has been under discussion for several years to bring it closer to the European GDPR; follow its progress on the CNDP website, as it could tighten the obligations around AI.<\/p>\n Not every use carries the same risk. Writing a LinkedIn post or polishing an internal presentation with no personal data commits you to nothing. The risk concentrates in four functions:<\/p>\n A simple exercise: ask each department head to list the three tasks their team uses AI for. In the vast majority of cases, at least one involves personal data.<\/p>\n Faced with this, you have three paths. None is right in the abstract; the right one depends on your data and your means.<\/p>\n Filter AI assistant domains on the network and on workstations. Effective for a few weeks, then teams switch to their phones. Blocking only holds if it comes with an alternative.<\/p>\n Team, Enterprise or Microsoft 365 Copilot licences: expect roughly 250 to 350 MAD per user per month depending on the vendor and the exchange rate. You get a contract, no training on your data, and audit logs. You do not get hosting in Morocco: the transfer still exists and must be covered (CNDP authorisation or a legal exception). For most SMEs whose usage is office work, it is an acceptable compromise, provided the transfer is documented.<\/p>\n Open-weight models (Llama, Mistral, Qwen and their derivatives) deployed in a Moroccan data centre, connected to your documents, your email or your ERP. Data never leaves the country, the processing is declared normally, and you control the logging. We compare the available hosts in our article on sovereign cloud in Morocco<\/a>. Budget-wise, an internal document assistant hosted in Morocco usually lands between 120,000 and 400,000 MAD for setup, plus 6,000 to 30,000 MAD per month for hosting and maintenance depending on load and GPU needs. It makes sense as soon as you handle sensitive data, have regular volumes, or your clients (banks, insurers, public buyers) require data localisation.<\/p>\n In practice, the most frequent combination: enterprise editions for general office work, sovereign AI for the flows that touch customer, HR or health data.<\/p>\n Here is what you can do in four to six weeks, on your own or with light support:<\/p>\n These steps fit naturally into a broader digital roadmap: AI is only one workstream among others, but it is the one that moves fastest without you. If you are weighing several projects, our guide on the cost of an AI project in Morocco<\/a> helps you set priorities.<\/p>\n Once existing usage is under control, many SMEs move to the next step: a custom assistant, automated document processing, contract analysis. Here are the compliance questions to ask from the specification stage.<\/p>\n Be wary of “turnkey compliance” promises: compliance remains the company’s responsibility. The provider can only give you an architecture and documentation that make it possible.<\/p>\n AI at work is not banned in Morocco; it is regulated. An inventory, a charter, administered accounts and up-to-date declarations are enough for most SMEs; sovereign AI becomes necessary as soon as you touch health, finance or your customers’ data.<\/p>\n Arrowlancer designs and deploys AI solutions for Moroccan SMEs: internal assistants, automation, document analysis, with the option of sovereign AI hosted in Morocco, and helps you frame existing usage before launching a project. Explore our AI services<\/a>, or let’s talk about your situation directly: contact us<\/a> for a first no-commitment conversation.<\/p>\n","protected":false},"excerpt":{"rendered":" Your teams already use ChatGPT or Copilot? What Law 09-08 requires, which data is at risk, the sovereign AI trade-off and a checklist to frame usage now.<\/p>\n","protected":false},"author":0,"featured_media":92,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[267,270,63,273,276,279,75,282],"class_list":["post-91","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tech_et_development","tag-ai-en","tag-chatgpt-en","tag-cndp-en","tag-compliance-en","tag-copilot-en","tag-law-09-08-en","tag-morocco-smes-en","tag-sovereign-ai-en"],"_links":{"self":[{"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/posts\/91","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/comments?post=91"}],"version-history":[{"count":1,"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/posts\/91\/revisions"}],"predecessor-version":[{"id":94,"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/posts\/91\/revisions\/94"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/media\/92"}],"wp:attachment":[{"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/media?parent=91"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/categories?post=91"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/tags?post=91"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}ChatGPT, Copilot, Gemini: where your data really goes when your teams use them<\/h2>\n
![\"ChatGPT](\"https:\/\/storage.googleapis.com\/arrowlancer-prod.firebasestorage.app\/blog-ma\/ia-cndp-maroc-chatgpt-copilot-conformite-2026\/1.jpg\")
<\/p>\nChatGPT (OpenAI)<\/h3>\n
Copilot (Microsoft)<\/h3>\n
Gemini (Google)<\/h3>\n
AI CNDP compliance Morocco: what Law 09-08 says about transfers abroad<\/h2>\n
\n
The most exposed data and departments: HR, customers, health, finance<\/h2>\n
\n
Sovereign AI hosted in Morocco or general-purpose AI abroad: the real trade-off<\/h2>\n
1. Block<\/h3>\n
2. Move to enterprise editions<\/h3>\n
3. Deploy sovereign AI hosted in Morocco<\/h3>\n
The checklist to frame AI use internally, starting now<\/h2>\n
\n
What to check before launching an AI project with a provider<\/h2>\n
\n
What now?<\/h2>\n