Who is in scope outside the EU?
The AI Act applies to providers that place an AI system on the EU market, wherever they are established. It also applies to providers and professional users, called deployers, located outside the Union when the output produced by the system is used in the Union.
A Moroccan company can therefore be in scope if it sells software that includes AI to European customers, if it provides them with AI-generated outputs (analyzes, documents, decisions), or if a European client requires it by contract to meet the client’s own obligations.
What already applies
- Since February 2025: prohibited practices, and the AI literacy obligation. Since the 2026 revision, this obligation means taking measures to develop the skills of people who use AI, with no minimum level imposed.
- Since August 2025: obligations for providers of general-purpose AI models.
- Since August 2026: transparency obligations, such as telling people they are interacting with an AI system, or labeling generated content. Generative systems already on the market have until 2 December 2026 for machine-readable marking.
What has been postponed
Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, published in the Official Journal on 24 July 2026, pushed back the obligations for high-risk systems:
- to 2 December 2027 for the uses listed in Annex III, such as recruitment, education or access to credit;
- to 2 August 2028 for AI embedded in regulated products, such as medical devices or machinery.
Where to start
- List the AI systems you use or provide, including consumer tools used by your teams.
- For each one, establish your role: provider or deployer. The obligations depend on it.
- Identify uses that could be high-risk, so they are ready before the end of 2027.
- Document what you already do to train your teams: it is the first evidence you will be asked for.
On the Moroccan side, Law 09-08 on personal data protection applies in parallel, with its own formalities with the CNDP.
Most companies do not need a heavy audit. They need to know which systems they use, and in which role.
Please note
This note is not legal advice. The interpretation of your situation is a matter for your legal counsel.
Want to know which of your systems are in scope? Our readiness assessment gives you the answer.
See the assessmentMore notes