1. Introduction

The regulation of algorithm transparency in medical genetics systems in Morocco is an emerging area of biotechnology, healthcare, data protection and artificial intelligence law. Medical genetics systems increasingly use artificial intelligence (AI), machine learning, genomic sequencing and predictive algorithms to identify inherited diseases, detect genetic mutations, estimate hereditary disease risks and recommend personalised medical treatments.

Examples include:

AI-assisted diagnosis of hereditary cancer.

Automated detection of genetic mutations.

Predictive algorithms for inherited cardiovascular diseases.

Genetic screening for rare diseases.

AI-based embryo and reproductive genetic analysis.

Pharmacogenomic systems predicting patients' responses to medicines.

Automated interpretation of DNA sequencing results.

Although these technologies can improve diagnostic accuracy, they also create significant legal challenges concerning patient privacy, algorithmic accountability, informed consent, discrimination, medical negligence and the right to understand automated medical decisions.

Morocco does not yet have a clearly established, comprehensive statutory framework specifically regulating transparency of AI algorithms in medical genetics. Instead, the relevant legal framework is principally derived from the Moroccan Constitution, Law No. 09-08 on personal data protection, biomedical research legislation and medical-device regulation.

The central legal question is:

To what extent should hospitals, genetic laboratories, biotechnology companies and AI developers disclose how algorithmic systems analyse genetic information and produce medical recommendations?

2. Constitutional Framework in Morocco

The Moroccan Constitution of 2011 provides important foundations for regulating algorithmic medical systems.

A. Article 24: Right to Privacy

Article 24 protects the individual's right to private life.

Genetic information is particularly sensitive because it may reveal:

Hereditary diseases.

Family relationships.

Genetic predispositions.

Reproductive characteristics.

Information concerning biological relatives.

Consequently, hospitals and genetic laboratories using AI systems must protect genetic information against unauthorised disclosure.

An algorithm that analyses genetic information without adequate safeguards may interfere with constitutional privacy protections.

B. Article 27: Right of Access to Information

Article 27 recognises access to information, subject to legally recognised restrictions, including protection of private life.

In medical genetics, this principle supports patient access to relevant information concerning the processing of their genetic data.

Patients should be informed about:

Why their genetic information is collected.

Which organisation processes it.

Whether AI or automated systems are involved.

Whether the results are shared with third parties.

Whether information is transferred internationally.

C. Article 31: Access to Healthcare

Article 31 establishes the State's responsibility to facilitate access to healthcare and medical treatment.

Algorithmic medical systems should therefore operate consistently with the broader objective of safe, accessible and effective healthcare.

Legal significance: Constitutional privacy, access to information and healthcare principles provide the foundation for responsible algorithmic decision-making in Moroccan medical genetics.

3. Law No. 09-08: Protection of Personal Data

Principal applicable legislation

Morocco's Law No. 09-08, promulgated by Dahir No. 1-09-15 of 18 February 2009, is the principal legislation governing personal data processing.

It is especially important because the law expressly recognises genetic and health information as sensitive personal data.

cndp.ma+1

A. Article 1: Definition of Genetic and Health Data

Article 1 defines personal data broadly and includes information identifying individuals through genetic characteristics.

It also expressly classifies health information, including genetic information, as sensitive data.

This means that the following information falls within the scope of the legislation:

DNA sequencing results.

Genetic mutation reports.

Hereditary disease records.

Genomic profiles.

Genetic risk predictions.

AI-generated medical-genetic assessments.

An AI system cannot avoid data protection obligations merely because genetic information is processed through mathematical models rather than conventional medical records.

B. Article 4: Consent and Lawful Processing

Article 4 establishes the general requirement for valid consent to personal data processing, subject to statutory exceptions.

For medical genetics systems, consent and other lawful grounds must be considered in relation to:

Collection of genetic samples.

Digital storage of genomic information.

Algorithmic analysis.

Secondary use for research.

Sharing with biotechnology companies.

Disclosure to external laboratories.

Consent should be informed and sufficiently specific to the processing involved.

For example, a patient agreeing to genetic testing does not necessarily understand or agree to every possible secondary use of the resulting genomic information.

C. Article 7: Right to Understand Automated Processing

Particularly important provision

Article 7 provides individuals with the right to obtain information about the logic underlying automated processing of their personal data.

This provision is particularly relevant to AI-assisted genetic diagnosis.

For example, suppose a Moroccan hospital uses an AI system to analyse a patient's DNA and identifies a high probability of hereditary breast cancer.

The patient may seek information about:

The principal factors influencing the result.

The categories of genetic information analysed.

The purpose of the algorithm.

The origin of the processed information.

The recipients of the results.

The logic underlying the automated processing.

This provision creates an important legal foundation for algorithmic transparency.

However, it should not automatically be interpreted as granting unrestricted access to source code, proprietary software or every technical component of an algorithm.

The relevant objective is meaningful understanding of the processing logic.

D. Article 8: Right to Rectification

Article 8 establishes rights to correct, update, erase or block personal data processed contrary to the law, including inaccurate or incomplete information.

This is significant because incorrect genetic information may produce serious medical consequences.

For example:

An AI system incorrectly identifies a patient as carrying a hereditary disease-associated mutation.

The patient may seek correction of the underlying genetic information and rectification of associated records.

A correction process should also consider whether an erroneous algorithmic conclusion has been communicated to other healthcare providers.

E. Article 11: Restrictions on Automated Decisions

Article 11 is one of the most significant provisions for algorithmic medical genetics.

It restricts decisions having legal effects on individuals when they are based solely on automated processing intended to evaluate aspects of their personality or establish their profiles.

The provision contains exceptions, including certain contractual decisions where the individual has been able to present observations.

Its application to medical genetics requires careful legal interpretation.

For example:

An AI system independently determining access to medical insurance based on genetic risk may raise serious Article 11 concerns.

An algorithm generating a preliminary diagnostic recommendation for a qualified physician to evaluate is not necessarily a decision based solely on automated processing.

A hospital relying entirely on an automated genetic risk score to deny a medical service may raise questions concerning the provision's scope.

The distinction between automated assistance and automated decision-making is therefore critical.

bdj.mmsp.gov.ma+1

4. Regulatory Authority: CNDP

The National Commission for the Control of Personal Data Protection (CNDP) supervises compliance with Law No. 09-08.

Its responsibilities include:

Monitoring personal data processing.

Examining compliance with statutory requirements.

Supervising relevant declarations and authorisations.

Protecting individuals' data rights.

Addressing unlawful processing.

Supervising relevant international data transfers.

For medical genetics laboratories, CNDP supervision is particularly important because genetic and health information receives special protection.

Prior authorisation

Article 12 establishes prior authorisation requirements for certain categories of processing.

This includes sensitive personal data and genetic data, subject to specified exceptions.

Importantly, Article 12 provides an exception for certain genetic-data processing undertaken by healthcare professionals for medical purposes, including preventive medicine, diagnosis and treatment.

Article 22 also establishes a specific declaration regime for certain health-data processing undertaken for medical diagnosis, treatment and healthcare administration by persons subject to professional confidentiality.

Therefore, laboratories must determine the correct regulatory procedure rather than assume that every medical-genetic processing operation is automatically exempt.

5. Biomedical Research Regulation: Law No. 28-13

Morocco's Law No. 28-13 concerning the protection of persons participating in biomedical research was promulgated in 2015.

It is relevant when medical genetics algorithms are developed or validated through biomedical research involving human participants.

sante.gov.ma

The legislation provides an important framework for protecting research participants.

Major regulatory considerations

A. Informed consent

Research participants must receive appropriate information concerning the research and its implications.

When AI is used to analyse genetic information, researchers should explain its role in the research methodology.

B. Protection of participants

Genetic research may reveal information extending beyond the immediate medical question.

For example, sequencing undertaken to investigate one hereditary disorder may identify unrelated genetic risks.

C. Research ethics

Research institutions must respect applicable ethical review and participant-protection requirements.

D. Scientific accountability

Researchers should maintain sufficient documentation to establish how genetic data were analysed and how research conclusions were reached.

A critical distinction exists between clinical diagnosis and research experimentation. The applicable requirements depend on the purpose and circumstances of the processing.

6. Medical Device Regulation: Law No. 84-12

Morocco's Law No. 84-12 regulates medical devices.

The Ministry of Health also identifies Law No. 11-08 on in-vitro diagnostic reagents as relevant legislation.

sante.gov.ma

These laws may become relevant where genetic testing equipment, diagnostic software or associated products fall within their respective regulatory definitions.

For example:

Genetic sequencing diagnostic devices.

In-vitro diagnostic testing systems.

Software integrated into genetic diagnostic equipment.

Technology used to identify disease-associated mutations.

Algorithm transparency implications

Manufacturers and healthcare institutions should pay particular attention to:

Intended medical purpose.

Technical performance.

Diagnostic accuracy.

Validation evidence.

Known limitations.

Risks associated with incorrect results.

Appropriate instructions for healthcare professionals.

A software system that merely supports administrative work may be treated differently from software intended to provide medical diagnoses.

Therefore, classification under the applicable medical-device framework is essential.

7. Legal Requirements for Algorithm Transparency

Algorithm transparency in Moroccan medical genetics can be analysed through six major legal requirements.

A. Explainability

Medical institutions should be able to explain how AI systems produce genetic diagnostic results.

For instance, a system identifying a BRCA1-associated mutation should provide clinically meaningful information about the genetic finding, the evidence supporting the interpretation and the limitations of its conclusion.

B. Data Transparency

Patients should receive appropriate information about:

Genetic data collected.

Data sources.

Processing purposes.

Data recipients.

Retention periods.

International transfers.

C. Training Data Transparency

AI developers should maintain documentation about the origin and characteristics of training datasets.

This is particularly important where datasets disproportionately represent certain populations.

A genetic diagnostic model developed primarily using European genomic datasets may perform differently when analysing Moroccan populations.

This creates concerns about diagnostic accuracy, unequal healthcare outcomes and scientific validity.

D. Human Oversight

AI-generated medical conclusions should be subject to appropriate professional review.

A genetic algorithm should not automatically replace clinical judgment where professional interpretation is necessary.

E. Auditability

Hospitals and laboratories should maintain records of:

Algorithm versions.

Diagnostic inputs.

Outputs.

Changes in model performance.

Validation procedures.

Human interventions.

Significant errors.

F. Accountability

Responsibility should be allocated according to the role of each participant:

8. Important Case Laws and Judicial Principles

An important limitation must be recognised: publicly identifiable Moroccan judicial precedents specifically addressing transparency of AI-based medical genetic algorithms are not established in the legal materials identified for this analysis.

It would therefore be misleading to invent Moroccan judgments directly deciding this issue.

Nevertheless, the following international decisions provide useful comparative principles. They are persuasive analytical references, not binding Moroccan precedents.

Case 1: S. and Marper v. United Kingdom (2008)

European Court of Human Rights · Applications Nos. 30562/04 and 30566/04

S. and Marper v. United Kingdom

Facts:

The case concerned the retention of fingerprints, cellular samples and DNA profiles of individuals who had not been convicted of criminal offences.

Judgment:

The European Court of Human Rights found a violation of Article 8 of the European Convention on Human Rights.

It emphasised the sensitive nature of genetic information and the importance of protecting private life.

Relevance to Morocco:

This judgment provides an important comparative principle for medical genetics.

Moroccan genetic laboratories should consider:

Whether genetic information is necessary.

Whether its retention is proportionate.

Whether access is appropriately restricted.

Whether information is being used for purposes beyond those originally authorised.

The judgment reinforces the importance of privacy safeguards in genomic databases.

Case 2: SCHUFA Holding (Case C-634/21, 2023)

Court of Justice of the European Union · 7 December 2023

SCHUFA Holding AG v. Data Protection Commissioner

Facts:

The case concerned automated credit scoring and the legal consequences of using a calculated probability score in decision-making.

Judgment:

The CJEU examined when automated scoring constitutes automated decision-making under Article 22 of the GDPR.

Relevance to Morocco:

The judgment offers a useful comparison for AI-based genetic risk scoring.

Suppose a Moroccan health insurer uses an AI-generated genetic risk score to determine whether a patient qualifies for a particular insurance product.

The legal issue would be whether the score merely assists a human decision-maker or effectively determines the outcome.

Moroccan Law No. 09-08, Article 11, provides a related domestic framework, although its precise language and scope differ from the GDPR.

Case 3: Dun & Bradstreet Austria (Case C-203/22, 2025)

Court of Justice of the European Union · 27 February 2025

Dun & Bradstreet Austria

Legal issue:

The case concerned the right of individuals to receive meaningful information about the procedure and principles involved in automated decision-making.

Judicial significance:

The Court addressed the practical meaning of providing information about automated decision-making and the need for an explanation that allows the individual to understand and challenge the decision.

Relevance to Morocco:

This reasoning is particularly valuable when interpreting the transparency objectives of Article 7 of Law No. 09-08.

For example, if an AI genetic diagnostic system reports a high probability of an inherited disorder, a patient should receive an understandable explanation of the principal factors influencing the result.

Simply stating that a proprietary algorithm produced the conclusion would provide little meaningful transparency.

This comparative judgment can help inform the development of Moroccan standards for explainable medical AI.

9. Major Legal Challenges in Morocco

A. The Black-Box Algorithm Problem

Some AI systems use complex neural networks that produce diagnostic conclusions without easily understandable explanations.

This creates difficulties for patients, physicians and regulators.

A patient may receive a genetic diagnosis without understanding the evidence behind it.

The right to know the logic underlying automated processing under Article 7 is particularly relevant.

B. Genetic Discrimination

Genetic information may reveal a predisposition to hereditary diseases.

If employers, insurers or other organisations improperly obtain such information, individuals may face discrimination.

Morocco needs effective safeguards against the misuse of algorithmic genetic risk predictions.

C. Algorithmic Bias

AI systems trained on insufficiently representative genetic datasets may generate inaccurate conclusions for Moroccan populations.

This could result in:

Incorrect genetic classifications.

Delayed diagnoses.

Unnecessary medical procedures.

Unequal treatment.

Misinterpretation of rare genetic variants.

D. Commercial Confidentiality

Biotechnology companies may argue that their algorithms are commercially confidential.

However, commercial confidentiality should not eliminate applicable data protection rights or prevent patients from receiving meaningful information about the processing of their personal data.

E. Cross-Border Genetic Data Transfers

International laboratories and biotechnology companies may process Moroccan genetic information outside Morocco.

Law No. 09-08 contains specific provisions governing transfers of personal data abroad, including Article 43.

Such transfers require examination of the applicable statutory conditions and CNDP procedures.

F. Medical Negligence

If an algorithm incorrectly identifies a genetic mutation and a doctor relies on that result, questions may arise concerning professional negligence and the responsibility of the laboratory or technology provider.

Liability must be assessed according to the conduct of each participant, applicable professional duties, contractual obligations and the causal relationship between the failure and the harm.

10. Hypothetical Moroccan Legal Case

Consider the following hypothetical situation.

A private genetic laboratory in Casablanca introduces an AI-based hereditary cancer diagnostic system.

A woman undergoes genetic testing. The AI system incorrectly identifies her as having a high-risk hereditary cancer mutation.

Based on the algorithmic result:

The patient experiences serious psychological distress.

Her physician recommends additional invasive testing.

The laboratory refuses to explain the algorithm's diagnostic process.

The patient discovers that her genetic information has also been shared with an overseas biotechnology company.

Potential legal issues

Possible remedies

Depending on the facts, the patient could:

Exercise her access rights.

Request correction of inaccurate genetic information.

Request blocking or erasure where legally justified.

Submit a complaint to the CNDP.

Seek appropriate civil remedies where the legal requirements are satisfied.

Pursue professional accountability where medical negligence is established.

This hypothetical demonstrates how existing Moroccan legislation can address several aspects of algorithmic medical genetics without requiring a separate AI-specific statute.

11. Recommendations for Strengthening Moroccan Law

Morocco could develop a more specific regulatory framework for transparent AI-assisted medical genetics.

The following reforms would be particularly relevant.

1. Mandatory algorithm documentation

Require appropriate documentation of diagnostic algorithms, their intended purpose, validation and limitations.

2. Patient explanation rights

Develop clear standards requiring medical institutions to explain significant AI-generated genetic conclusions in understandable language.

3. Human review requirements

Establish appropriate human oversight for high-impact genetic diagnostic and treatment decisions.

4. Genetic algorithm audits

Introduce periodic independent audits assessing diagnostic accuracy, population representation and discriminatory outcomes.

5. Training-data governance

Require stronger documentation concerning the provenance, quality and representativeness of genomic training datasets.

6. Clear liability rules

Clarify the respective responsibilities of AI developers, laboratories, hospitals and medical professionals.

7. Stronger cross-border safeguards

Improve supervision of international transfers of genomic information and ensure that foreign service providers respect applicable Moroccan requirements.

8. Special protection for minors

Introduce particularly careful safeguards for genetic information concerning children, especially where testing reveals conditions that may not manifest until adulthood.

12. Conclusion

Regulation of algorithm transparency in medical genetics systems in Morocco is an important emerging field at the intersection of biotechnology law, healthcare regulation, artificial intelligence and fundamental rights.

The existing legal framework provides several important protections.

The Constitution of 2011 protects privacy and recognises access to information and healthcare. Law No. 09-08 provides specific protection for genetic and health information. Article 7 recognises the right to understand the logic underlying automated processing, while Article 11 restricts certain decisions based exclusively on automated processing. Law No. 28-13 provides additional safeguards in biomedical research, and Law Nos. 84-12 and 11-08 are relevant to medical devices and in-vitro diagnostic products.

International judgments, particularly S. and Marper, SCHUFA and Dun & Bradstreet Austria, offer valuable comparative guidance.

Ultimately, Morocco's regulatory challenge is to ensure that medical genetics algorithms remain scientifically reliable, understandable, accountable and respectful of individual rights.

The fundamental principle should be that patients must not become powerless subjects of genetic algorithms: they should have meaningful access to information, appropriate human medical oversight and effective legal remedies when automated systems cause harm.

13. Important Legal References

Useful official legal sources:

Moroccan CNDP – Data Protection Legislation.

Official Moroccan Law No. 09-08.

Moroccan Ministry of Health – Medical Practice Regulations.

Moroccan Ministry of Health – Health Product Regulations.

Academic note: The international judgments discussed above are comparative authorities. They should not be cited as binding Moroccan case law. A comprehensive examination of published Moroccan judgments and CNDP decisions would be necessary before claiming that a particular court has directly adjudicated algorithm transparency in medical genetics.