1. Introduction

Autonomous Corporate Decision Intelligence Systems (ACDIS) refer to artificial intelligence (AI), machine-learning platforms, algorithmic management tools and automated governance systems that analyse corporate information and independently recommend, generate or execute business decisions.

These systems may be used by Moroccan companies to:

Approve or reject commercial transactions.

Evaluate corporate creditworthiness and financial risks.

Determine employee recruitment, promotion and dismissal.

Monitor directors' and managers' performance.

Allocate corporate resources and investments.

Predict contractual disputes and financial liabilities.

Assess suppliers, customers and business partners.

Automate compliance, auditing and corporate reporting.

Recommend mergers, acquisitions and restructuring.

Execute decisions through automated contractual and financial platforms.

The use of autonomous decision systems raises important civil-law questions concerning contractual validity, corporate responsibility, directors' duties, negligence, causation, compensation, personal data protection and liability for decisions generated by artificial intelligence.

The central legal question in Morocco is whether a company can avoid civil responsibility by arguing that a harmful decision was generated by an autonomous algorithm rather than by a human director, employee or representative.

The general answer is no. The use of an automated system does not, by itself, eliminate the legal responsibility of the company or the persons who selected, supervised or relied upon that system.

Morocco's existing civil-law framework can address many of these questions, even though it does not yet establish a comprehensive, independent civil-liability regime specifically for autonomous corporate decision intelligence systems.

2. Legal Framework Governing Autonomous Corporate Decisions in Morocco

A. Moroccan Code of Obligations and Contracts

The Moroccan Code of Obligations and Contracts (Dahir forming the Code of Obligations and Contracts of 1913) provides the principal foundation for civil liability.

Its relevance includes:

1. Contractual responsibility

Where an autonomous system produces an incorrect contractual decision, the company may incur liability if that decision results in non-performance, defective performance or breach of contractual obligations.

Examples include:

Automated rejection of a valid supplier order.

Incorrect calculation of contractual payments.

Automatic termination of a commercial relationship.

Failure to execute an agreed financial transaction.

2. Civil liability for wrongful conduct

Articles 77 and 78 provide important foundations for liability arising from wrongful acts and negligence.

A company may face liability where its deployment of an autonomous system constitutes negligent conduct causing legally recognised harm.

For example, a company that uses an inadequately tested algorithm to make high-value credit decisions may be responsible for foreseeable losses caused by defective system design or supervision.

3. Causation and damages

A claimant must establish the relevant wrongful conduct, legally recognised damage and causal connection.

The involvement of several actors—software developers, corporate directors, system operators and external service providers—may complicate the identification of responsibility.

B. Moroccan Law No. 17-95 on Public Limited Companies

Law No. 17-95 on Public Limited Companies is particularly important where autonomous decision intelligence is used by sociétés anonymes (SAs).

It regulates:

Powers of corporate management.

Responsibilities of directors.

Board supervision.

Corporate representation.

Shareholder rights.

Accountability for management misconduct.

Corporate governance and internal controls.

An AI platform may recommend a board resolution or automatically assess a proposed transaction. However, the statutory responsibilities of directors cannot simply be transferred to software.

Directors must exercise appropriate judgment, oversight and diligence.

C. Law No. 5-96 on Other Commercial Companies

Law No. 5-96 governs several other commercial company forms, including limited liability companies (SARLs).

It is relevant when automated systems are used for:

Management decisions.

Financial approvals.

Member and shareholder information.

Contractual commitments.

Internal financial controls.

Allocation of management responsibilities.

The precise liability analysis depends on the company's legal form and the applicable statutory provisions.

D. Law No. 09-08 on Personal Data Protection

Law No. 09-08 regulates the processing of personal data in Morocco.

Autonomous corporate intelligence systems frequently process:

Employee information.

Customer records.

Financial profiles.

Supplier information.

Identification data.

Behavioural and performance information.

The law establishes obligations concerning lawful data processing, security, confidentiality and the protection of individuals.

The involvement of the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) is important where automated corporate systems process personal information.

A company cannot justify unlawful personal-data processing merely because the processing was performed automatically.

E. Moroccan Electronic Exchange and Electronic Signature Legislation

Law No. 53-05 concerning the electronic exchange of legal data is relevant to electronic contractual transactions and electronic signatures.

Law No. 43-20 concerning trust services for electronic transactions further modernises the legal framework.

These laws are relevant when autonomous systems:

Generate electronic contracts.

Approve digital transactions.

Produce electronic records.

Authenticate corporate representatives.

Execute electronic signatures through authorised processes.

An algorithm-generated document does not automatically establish that a legally authorised person consented to the transaction.

The authority, attribution, authentication and integrity of the electronic act remain important.

3. Legal Nature of Autonomous Corporate Decision Intelligence Systems

The legal classification of an autonomous corporate decision system depends on the function it performs.

A. Decision-support systems

These systems provide recommendations but leave final decisions to human directors.

For example, a Moroccan company may use AI to assess whether to acquire another business.

If directors blindly accept an inaccurate recommendation, their conduct may raise questions concerning managerial diligence and supervision.

B. Semi-autonomous decision systems

These systems make preliminary decisions subject to human approval.

Examples include:

Automated contract approval.

Supplier-risk classification.

Employee-performance scoring.

Automated financial authorisation.

The company must establish appropriate approval procedures and ensure that the responsible person can identify and correct material errors.

C. Fully autonomous decision systems

These systems execute decisions without case-by-case human intervention.

Examples include automated payment approval, algorithmic procurement and automatic contractual renewals.

Their use creates more complex questions about:

Whether the company authorised the system.

Whether the system acted within its delegated authority.

Whether the transaction is attributable to the company.

Whether the company maintained reasonable safeguards.

Whether the system's operation caused compensable damage.

Important distinction: Technical autonomy does not create an independent legal personality. An AI system is not automatically a legal person capable of assuming the company's contractual or civil obligations.

4. Corporate Directors' Civil Liability

Directors remain central to the legal governance of autonomous decision intelligence.

A. Duty of diligence

Directors should ensure that the company adopts reasonable procedures for selecting, testing and monitoring automated decision systems.

Potential failures include:

Using untested algorithms.

Ignoring known inaccuracies.

Failing to supervise automated transactions.

Allowing unauthorised access.

Failing to investigate abnormal outputs.

B. Duty of supervision

A board cannot treat the installation of an AI platform as a substitute for corporate supervision.

It should establish:

AI risk-management policies.

Internal audit procedures.

Human approval thresholds.

Incident reporting mechanisms.

Independent technical reviews.

Procedures for suspending defective systems.

C. Conflict of interest

An autonomous system may recommend transactions involving companies connected to directors or shareholders.

For example, an AI procurement system may repeatedly select a supplier associated with a director because its training data favours that supplier.

The board must examine the underlying conflict and comply with applicable related-party transaction rules.

D. Liability for defective governance

A director's responsibility must be determined under the applicable company legislation and the relevant facts.

The mere fact that an AI recommendation proves incorrect does not automatically establish director liability.

The claimant must identify the applicable legal duty, breach, damage and causal relationship.

5. Contractual Liability Arising from Autonomous Decisions

The Moroccan Code of Obligations and Contracts is especially important when an autonomous system participates in contract formation or performance.

A. Automated offer and acceptance

An AI platform may generate an offer, accept a purchase order or confirm a commercial transaction.

The relevant questions include:

Was the system authorised to act for the company?

Were the contractual terms sufficiently determined?

Was acceptance communicated?

Was there a valid manifestation of consent?

Did the automated transaction exceed the authority granted?

The use of an algorithm does not dispense with the ordinary requirements of contractual consent.

B. Automated contractual breach

Suppose a Moroccan manufacturing company uses an autonomous procurement system.

The system mistakenly terminates a long-term supply agreement because it classifies a supplier as financially unreliable.

The supplier may pursue a contractual claim if the termination constitutes unjustified non-performance.

The company cannot necessarily avoid liability by arguing that the algorithm independently initiated the termination.

C. Defective AI services

Where an external technology provider supplies corporate decision intelligence software, liability may arise under the relevant service agreement.

Possible disputes include:

Failure to meet contractual accuracy requirements.

Inadequate cybersecurity.

Failure to maintain the software.

Incorrect system updates.

Inadequate data processing.

Failure to provide promised audit records.

The contract should distinguish between the technology provider's obligations and the company's responsibility for business decisions.

6. Personal Data, Automated Profiling and Employee Rights

Autonomous corporate decision systems frequently process personal information.

Moroccan Law No. 09-08 therefore has considerable importance.

A. Employee profiling

A company may use AI to calculate:

Productivity scores.

Attendance patterns.

Promotion eligibility.

Performance rankings.

Disciplinary risk.

Employee retention probabilities.

Unlawful processing, inadequate security or improper use of personal information may give rise to regulatory and civil consequences.

B. Customer profiling

Financial institutions and commercial enterprises may use automated systems to assess customer behaviour and financial reliability.

The company must consider the lawfulness and proportionality of the processing, the purpose for which the information was collected and the applicable security obligations.

C. Transparency and human review

Companies should explain relevant data-processing practices and establish appropriate mechanisms for correcting inaccurate information.

A significant qualification is necessary: Moroccan Law No. 09-08 should not simply be described as containing an identical equivalent of Article 22 of the European GDPR. The precise scope of rights concerning exclusively automated decisions must be assessed under Moroccan legislation rather than assumed from European law.

7. Evidence, Explainability and Judicial Review

One of the most difficult issues is proving that an autonomous corporate system caused legally recognisable harm.

A claimant may need to establish:

The decision generated by the system.

The company's adoption or execution of that decision.

The relevant contractual or legal duty.

The defect, negligence or other legally relevant wrongful conduct.

The actual damage.

The causal relationship.

Important evidence

System audit logs.

Algorithmic decision records.

Software versions.

Training-data documentation.

Corporate board minutes.

Internal approval records.

Emails and electronic communications.

Vendor agreements.

Independent technical reports.

Cybersecurity incident records.

Explainability

A company should be able to explain the material factors underlying an important automated decision.

For instance, if an algorithm rejects a supplier, the company should preserve the information needed to establish whether the decision was based on financial risk, delivery performance, inaccurate information or a technical malfunction.

An opaque algorithm may make it more difficult for a company to demonstrate that it exercised reasonable care.

8. Important Judicial Decisions and Case Laws

Preliminary clarification: There is no established body of reported Moroccan judgments specifically deciding the civil liability of autonomous corporate AI decision systems. The following cases are therefore comparative judicial authorities. They provide useful principles for interpreting Moroccan civil-law obligations, corporate accountability, evidence and data protection. They are not binding precedents in Morocco.

Case 1: SCHUFA Holding AG v OQ

Court: Court of Justice of the European Union
Citation: Case C-634/21, 7 December 2023.

Facts:

SCHUFA generated automated creditworthiness scores using personal information and statistical methods. A bank relied heavily on the score when deciding whether to grant credit.

Legal principle:

The CJEU held that automated scoring may itself constitute automated decision-making where the score plays a determining role in a subsequent decision producing significant effects for an individual.

Relevance to Morocco:

A Moroccan financial institution using autonomous credit intelligence should consider whether its system effectively determines the outcome, even if a human formally approves the final decision.

The case illustrates why nominal human approval may not be sufficient when the algorithm effectively controls the decision.

Case 2: State v. Loomis

Court: Supreme Court of Wisconsin, United States
Citation: 881 N.W.2d 749 (Wis. 2016).

Facts:

Eric Loomis challenged the use of the COMPAS algorithm in criminal sentencing. The software generated a risk assessment used by the sentencing court.

Legal principle:

The court permitted the use of the assessment subject to important limitations and warnings concerning its use, including its proprietary nature and the risks of treating its prediction as determinative.

Relevance to Morocco:

This case is relevant to autonomous corporate risk-assessment systems.

A Moroccan company should not treat an algorithmic prediction as conclusive evidence of:

Employee misconduct.

Supplier dishonesty.

Customer default.

Financial fraud.

Commercial risk.

The case supports the importance of understanding the limitations of predictive systems.

Case 3: Ewert v. Canada

Court: Supreme Court of Canada
Citation: 2018 SCC 30.

Facts:

The dispute concerned the use of actuarial and psychological assessment tools in evaluating Indigenous prisoners. The claimant challenged the reliability of the tools when applied to individuals for whom their validity had not been established.

Legal principle:

The Supreme Court emphasised the statutory obligation to take reasonable steps to ensure that assessment tools are valid and reliable when used for the relevant population.

Relevance to Morocco:

Corporate decision intelligence systems may produce inaccurate outcomes when their training data do not adequately represent the population being assessed.

For example, a Moroccan employer using an imported employee-performance algorithm should consider whether the system is suitable for the local workforce and employment environment.

The decision supports proper validation rather than unquestioning reliance on automated assessments.

Case 4: Uber BV v Aslam

Court: UK Supreme Court
Citation: [2021] UKSC 5.

Facts:

The case concerned the employment status of Uber drivers and the practical control exercised by Uber through its platform.

The company's technology influenced the allocation of work, remuneration and the management of drivers.

Legal principle:

The Supreme Court examined the practical relationship between the parties rather than allowing contractual descriptions to determine the legal classification.

Relevance to Morocco:

This judgment is important where autonomous corporate intelligence systems manage employees or independent contractors.

A company cannot necessarily avoid legal obligations by claiming that an algorithm, rather than management, determines working conditions.

The actual operation of the system and the degree of corporate control remain important.

Case 5: Mata v. Avianca, Inc.

Court: United States District Court, Southern District of New York
Citation: 2023 WL 4114965, 22-cv-1461 (PKC), 22 June 2023.

Facts:

Lawyers representing a claimant used generative AI to prepare legal submissions containing fabricated judicial decisions and citations.

The lawyers failed to verify the material and continued to rely on it after its accuracy was challenged.

Legal principle:

The court imposed sanctions because the lawyers had failed in their professional responsibility to verify the accuracy of their submissions.

Relevance to Morocco:

This judgment illustrates an important governance principle: responsibility cannot be delegated entirely to an AI system.

A Moroccan company's directors, lawyers, compliance officers and professional advisers should verify AI-generated legal and financial information before relying upon it for consequential corporate decisions.

The case also supports maintaining human verification procedures for corporate legal analytics.

Case 6: Lloyd v. Google LLC

Court: UK Supreme Court
Citation: [2021] UKSC 50.

Facts:

The claimant alleged that Google had collected and used personal information from millions of iPhone users without their knowledge or consent.

The proceedings concerned data protection violations and the requirements for recovering compensation through a representative action.

Legal principle:

The Supreme Court held that compensation under the relevant legislation required proof of individual damage and unlawful processing; a claimant could not obtain compensation for an entire class merely by asserting a general loss of control over personal data.

Relevance to Morocco:

The judgment is useful when assessing the civil consequences of corporate AI systems that process employee, customer or supplier information.

It demonstrates the importance of identifying:

The relevant data-processing violation.

The affected individual.

The actual legally recognised damage.

The causal connection between the processing and the damage.

It is particularly relevant to automated profiling and corporate data analytics.

Bailii+2

Case 7: R (Bridges) v Chief Constable of South Wales Police

Court: Court of Appeal of England and Wales
Citation: [2020] EWCA Civ 1058.

Facts:

The case concerned the use of automated facial recognition technology by South Wales Police.

The claimant challenged the legality of the technology's deployment and the adequacy of the applicable safeguards.

Legal principle:

The Court of Appeal identified deficiencies in the legal framework and the safeguards governing the deployment of the technology.

Relevance to Morocco:

The decision provides useful guidance for companies using biometric identification, automated monitoring and AI-powered employee surveillance.

Corporate deployment should be supported by clearly defined purposes, adequate safeguards and appropriate legal controls.

It also demonstrates that technical capability does not establish legal permission to use a system.

UK Supreme Court+1

9. Practical Application: Autonomous Corporate Decision-Making in Morocco

Consider the following hypothetical situation.

A Moroccan financial services company introduces an autonomous corporate intelligence platform to approve business loans, select commercial partners and monitor employee performance.

The system automatically rejects applications, terminates supplier relationships and flags employees as potential fraud risks.

Several problems subsequently emerge:

The system incorrectly rejects financially sound applicants.

Suppliers lose contracts because of inaccurate risk classifications.

Employees suffer reputational damage because of false fraud alerts.

The board cannot explain the factors behind the decisions.

The technology provider refuses to disclose certain technical information.

A. Possible legal consequences

B. Allocation of responsibility

Responsibility should be examined separately for each participant.

1. The company

The company may be responsible for defective corporate processes, contractual non-performance or negligent deployment.

2. Directors

Directors may incur responsibility where their own statutory or managerial misconduct satisfies the applicable legal requirements.

3. Software developers

A developer may be liable where defective design, negligent implementation or contractual non-performance causes legally recognised damage.

4. Technology providers

The provider's responsibility depends on its contractual obligations, conduct and applicable law.

5. Employees and system operators

An operator may be responsible for unauthorised intervention, negligent configuration or failure to comply with established procedures.

There is no automatic rule that all participants are jointly liable merely because they contributed to the same AI decision.

10. Recommended Corporate Governance Framework for Morocco

Moroccan companies adopting autonomous decision intelligence should develop a governance framework that connects technological innovation with civil-law accountability.

A. Human accountability

Every important automated decision should have an identifiable person or corporate body responsible for its approval and supervision.

B. Algorithmic audit

Companies should periodically examine:

Accuracy and reliability.

Discriminatory outcomes.

Data quality.

Cybersecurity vulnerabilities.

Model updates.

Unauthorised decision-making.

Commercial and financial consequences.

C. Corporate decision registers

Companies should maintain records of important automated decisions, including:

Date and time of the decision.

System responsible.

Data considered.

Decision criteria.

Human approval, where applicable.

Subsequent review or correction.

Resulting contractual consequences.

D. AI procurement agreements

Contracts with AI vendors should address:

Accuracy and performance standards.

Data ownership and permitted use.

Confidentiality.

Cybersecurity.

Audit and inspection rights.

Disclosure of material system limitations.

Incident notification.

Liability allocation.

Indemnification, where appropriate.

Termination and transition arrangements.

E. Independent review

High-impact decisions should be subject to meaningful human review.

This is particularly important for decisions involving employment, substantial financial commitments, termination of long-term contracts and sensitive personal information.

F. Judicial accessibility

Where litigation arises, companies should preserve relevant electronic records and make appropriate evidence available through lawful procedural mechanisms.

Trade secrets and confidential algorithms may require protective arrangements, but commercial confidentiality should not automatically prevent meaningful examination of disputed evidence.

11. Major Legal Challenges in Morocco

12. Proposed Reforms for Moroccan Civil Law

Morocco could consider the following reforms to strengthen autonomous corporate decision governance.

1. Recognition of automated decision attribution

Legislation could clarify when an automated transaction or decision is legally attributable to the company.

2. Corporate AI responsibility standards

Companies using high-impact autonomous systems could be required to establish documented governance and oversight procedures.

3. Algorithmic transparency

Affected parties should have access to sufficient information to challenge materially harmful automated decisions, subject to legitimate confidentiality protections.

4. Technical audit requirements

Independent audits could be required for systems involving significant financial, employment or contractual consequences.

5. Clarification of civil liability

The law could clarify how existing fault-based liability principles apply to autonomous systems, including responsibility for defective design, inadequate supervision and foreseeable system failures.

6. Protection against discriminatory decisions

Specific safeguards could address discriminatory automated recruitment, credit assessment and customer classification.

7. Judicial expertise

Courts should have access to qualified technical experts capable of examining algorithmic evidence and explaining complex system operations.

8. Director accountability

Corporate governance rules could expressly address the responsibilities of directors who approve, deploy or supervise high-impact autonomous decision systems.

13. Hypothetical Moroccan Case Study

Case: Atlas Corporate Intelligence SARL v. Moroccan Industrial Supplier

A Moroccan manufacturing company adopts an autonomous procurement intelligence system.

The system evaluates suppliers according to financial stability, delivery performance and commercial risk.

Because of inaccurate financial information, the system automatically excludes a long-standing supplier and recommends another supplier with higher prices.

The excluded supplier alleges contractual losses and reputational harm.

Legal analysis

Issue 1: Contractual responsibility

If a valid supply contract existed and the company wrongfully terminated it, the supplier may seek contractual remedies under the Code of Obligations and Contracts.

Issue 2: Negligence

If the company failed to verify obviously inaccurate information or ignored known system defects, Article 78 may become relevant.

Issue 3: Director responsibility

If directors failed to exercise their applicable statutory responsibilities, their individual liability may require examination under the relevant company legislation.

Issue 4: Technology provider responsibility

If the system failed to meet contractual accuracy or maintenance obligations, the supplier of the software may face contractual liability to its customer.

Issue 5: Damages

The supplier would need to establish legally recoverable damage and the necessary causal connection.

Possible remedies

Depending on the facts and applicable contractual provisions, the remedies may include:

Compensation for established losses.

Contractual remedies.

Rectification of inaccurate information.

Independent technical assessment.

Appropriate injunctive or protective relief.

Termination of defective technology services.

The case illustrates why a company's adoption of autonomous technology does not automatically transfer all legal responsibility to its software provider.

14. Overall Conclusion

Civil Law and Autonomous Corporate Decision Intelligence Systems in Morocco represents an emerging area of legal governance involving traditional civil liability, corporate law, electronic transactions, data protection and artificial intelligence.

Morocco already possesses several legal foundations for addressing the consequences of autonomous corporate decision-making:

The Code of Obligations and Contracts establishes the general framework for contractual and non-contractual obligations.

Articles 77 and 78 provide important principles concerning wrongful conduct, fault and compensation.

Law No. 17-95 regulates public limited companies and corporate management responsibilities.

Law No. 5-96 regulates other commercial company forms.

Law No. 09-08 governs personal-data protection.

Laws Nos. 53-05 and 43-20 address electronic transactions and trust services.

Law No. 05-20 provides a framework for cybersecurity.

The comparative judgments in SCHUFA, Loomis, Ewert, Uber v Aslam, Mata v Avianca, Lloyd v Google and Bridges demonstrate important principles concerning algorithmic accountability, data protection, human supervision, evidence and legal responsibility.

Central legal principle

Autonomous corporate intelligence may exercise operational decision-making capacity, but it does not independently acquire the legal personality or accountability of the company.

The company must remain legally accountable for its contractual commitments and its own wrongful conduct. Directors must continue to discharge their applicable statutory responsibilities, while technology providers must answer for their own contractual or legally actionable failures.

The most appropriate approach for Morocco is therefore a model of human accountability, corporate responsibility, algorithmic transparency and judicial review, ensuring that technological autonomy does not become a means of avoiding civil-law obligations.

Academic qualification: The seven judicial decisions discussed above are foreign comparative authorities, not Moroccan AI judgments. They illustrate principles that may assist interpretation of Moroccan law but do not establish binding Moroccan rules. The statutory provisions should be checked against the applicable consolidated legislation when preparing formal legal submissions.