1. Introduction

Algorithmic Clinical Decision Systems (ACDS) are digital technologies that assist healthcare professionals in making medical decisions through artificial intelligence (AI), machine learning, predictive analytics, automated diagnostic tools and clinical data-processing systems.

In Morocco, these technologies have significant potential to improve healthcare delivery, particularly in:

Early diagnosis of cancer, cardiovascular diseases and genetic disorders.

Prediction of disease progression and patient complications.

Selection of appropriate treatments.

Medical imaging and laboratory interpretation.

Personalised medicine and precision biotechnology.

Hospital resource allocation and clinical risk assessment.

However, algorithmic clinical decision-making creates important legal questions concerning patient safety, medical responsibility, privacy, discrimination, transparency and professional accountability.

The central legal question is whether a Moroccan healthcare professional or institution can rely on an algorithmic recommendation without losing responsibility for the resulting medical decision.

The answer is that algorithmic assistance does not automatically transfer professional responsibility from the treating physician to the software developer or technology provider.

Morocco does not yet have a single comprehensive statute exclusively regulating all algorithmic clinical decision systems. Their regulation must therefore be understood through existing medical, pharmaceutical, data-protection, cybersecurity, consumer-protection and constitutional frameworks.

2. Legal and Regulatory Framework in Morocco

A. Constitution of Morocco 2011

The Moroccan Constitution establishes important principles relevant to AI-assisted healthcare.

Article 31 – Right to healthcare

Article 31 requires the State, public institutions and territorial authorities to mobilise available resources to facilitate equal access to healthcare and medical treatment.

Its relevance includes:

Equal access to AI-supported diagnosis.

Prevention of discriminatory algorithmic treatment.

Fair distribution of digital healthcare services.

Protection of vulnerable patients.

Avoidance of technological barriers to medical treatment.

If an algorithm systematically produces inaccurate diagnoses for a particular population, its deployment may raise constitutional concerns about equality and access to healthcare.

Article 24 – Privacy

Article 24 protects private life and the confidentiality of personal communications.

Medical algorithms frequently process sensitive information, including genetic data, medical histories, laboratory results and diagnostic images.

Consequently, algorithmic healthcare systems must operate consistently with constitutional privacy protections.

B. Law No. 09-08 on Personal Data Protection

Law No. 09-08 of 18 February 2009 is particularly important for algorithmic healthcare regulation.

It regulates the processing of personal data and establishes the role of the National Commission for the Control of Personal Data Protection (CNDP).

Its relevance includes:

Lawful processing of patient information.

Protection of sensitive medical information.

Appropriate security measures.

Restrictions on unauthorised disclosure.

Data-subject rights.

Regulatory oversight of personal-data processing.

Healthcare algorithms may process information concerning diagnoses, genetic characteristics, disabilities and treatment histories.

Such processing requires particular attention because medical information can expose patients to discrimination, reputational harm and privacy violations.

Legal implication: A hospital cannot assume that obtaining patient information for ordinary treatment automatically authorises every secondary use of that information for AI training, commercial development or unrelated predictive profiling.

C. Law No. 65-00 on Basic Medical Coverage

Law No. 65-00 establishes Morocco's basic medical coverage framework.

Its importance for algorithmic healthcare arises from the relationship between medical technologies, healthcare reimbursement and access to treatment.

Relevant questions include:

Whether AI-assisted procedures qualify for reimbursement.

Whether algorithmic diagnostic systems improve healthcare access.

Whether automated treatment recommendations affect insured patients.

Whether digital medical services are distributed equitably.

An algorithm should not become an unjustified mechanism for denying medically necessary healthcare coverage.

D. Law No. 131-13 on the Practice of Medicine

Law No. 131-13 concerning the practice of medicine is central to determining the professional responsibility of physicians using clinical algorithms.

It regulates medical practice, professional qualifications and the conditions under which medical services are provided.

Its relevance to AI includes:

The physician's independent clinical judgment.

Professional responsibility for diagnosis and treatment.

Compliance with professional standards.

Patient safety and informed medical practice.

Accountability for negligent medical decisions.

An AI system may recommend a diagnosis, but it does not independently acquire the professional status of a licensed Moroccan physician.

A physician must critically evaluate the recommendation against the patient's medical condition and available clinical evidence.

E. Law No. 17-04 – Pharmaceutical Code

Law No. 17-04, establishing the Pharmaceutical Code, is relevant where algorithmic systems are incorporated into pharmaceutical products, treatment-selection technologies or medication-related clinical decision tools.

For example, an AI system that recommends medication dosages or predicts drug interactions can create pharmaceutical safety concerns.

Regulatory assessment should consider:

Accuracy of medication recommendations.

Patient-specific contraindications.

Adverse drug reactions.

Clinical validation.

Traceability of algorithmic recommendations.

The legal classification of particular AI-enabled medical software must be examined according to its intended medical purpose and the applicable regulatory requirements.

F. Law No. 84-12 on Medical Devices

Law No. 84-12 regulates medical devices in Morocco.

This legislation is particularly relevant when AI software performs a medical function, such as:

Detecting abnormalities in radiological images.

Identifying cancerous lesions.

Monitoring cardiac abnormalities.

Predicting neurological disorders.

Supporting surgical planning.

Where software falls within the legal definition of a medical device, the applicable registration, conformity, safety and regulatory requirements must be considered.

The important distinction is between ordinary administrative software and software intended to perform a medical function.

G. Law No. 11-08 on In Vitro Diagnostic Reagents

This law is relevant when algorithms interpret laboratory and diagnostic information.

For example, an algorithm may analyse:

Blood-test results.

Molecular diagnostic findings.

Genetic testing information.

Biomarker measurements.

Pathological laboratory results.

AI-generated interpretations must not undermine the reliability and legal requirements applicable to diagnostic testing.

The Moroccan Ministry of Health identifies Laws 84-12, 11-08 and 17-04 among the principal legal instruments governing health products.

sante.gov.ma+1

3. Legal Regulation of Algorithmic Clinical Decision-Making

A. Algorithmic Diagnostic Accountability

Algorithmic diagnostic systems analyse medical information and generate possible diagnoses.

For example, an AI system may examine a patient's CT scan and identify a possible malignant tumour.

The legal issue arises when the algorithm produces an incorrect result.

Three possible situations must be distinguished:

Algorithmic error: The software produces an inaccurate diagnosis because of defective programming or inadequate training data.

Professional negligence: The physician accepts an obviously unreliable recommendation without appropriate clinical examination.

Institutional negligence: The hospital deploys an inadequately tested system without appropriate monitoring or staff training.

Depending on the circumstances, responsibility may arise under professional, contractual, civil or other applicable legal rules.

A physician should not treat an algorithmic prediction as an unquestionable medical fact.

B. Regulation of Algorithmic Treatment Recommendations

Clinical decision systems increasingly recommend medicines, dosages and treatment plans.

For example, an AI system may recommend chemotherapy based on tumour characteristics, genetic information and patient history.

Legal concerns include:

Incorrect dosage recommendations.

Failure to identify contraindications.

Inadequate consideration of allergies.

Unreliable predictions of drug interactions.

Inappropriate treatment recommendations.

Failure to consider individual patient circumstances.

A physician must retain appropriate professional oversight.

The use of an algorithm does not automatically excuse a physician from examining whether the recommended treatment is clinically appropriate.

C. Transparency and Explainability

Algorithmic systems sometimes use complex machine-learning models that cannot easily explain how they reach particular conclusions.

This creates a problem when a patient asks why a particular treatment was recommended.

Moroccan law should be interpreted alongside the following principles:

Patients should receive meaningful information about significant medical decisions.

Physicians should be able to understand the clinical basis of algorithmic recommendations sufficiently to assess them.

Hospitals should maintain relevant technical and clinical documentation.

Important decisions should be traceable.

Patients should have access to appropriate human medical review.

Law No. 09-08 establishes requirements concerning lawful processing, data quality, confidentiality and security. However, it should not be incorrectly interpreted as establishing a comprehensive, standalone right to an explanation of every AI-generated clinical recommendation.

D. Algorithmic Discrimination in Healthcare

An algorithm may produce systematically different results for different population groups.

For example, a predictive diagnostic model trained mainly on data from one population may perform poorly when applied to Moroccan patients.

Potential discriminatory outcomes include:

Underdiagnosis among particular demographic groups.

Inaccurate risk predictions.

Unequal treatment recommendations.

Reduced access to specialist healthcare.

Discrimination based on disability or genetic characteristics.

Article 31 of the Moroccan Constitution provides an important foundation for addressing unequal healthcare access.

Healthcare institutions should therefore evaluate algorithmic performance across relevant patient populations before and after deployment.

E. Medical Data Confidentiality and Cybersecurity

Clinical decision systems often depend on extensive patient datasets.

These datasets may include genetic information, medical histories, imaging records and laboratory results.

Under Law No. 09-08:

Article 1 recognises health and genetic information as sensitive personal data.

Article 4 establishes conditions for lawful processing.

Article 22 addresses certain health-data processing activities and the applicable CNDP declaration framework.

Articles 23 and 24 establish security and confidentiality requirements.

Article 26 addresses professional secrecy.

These provisions are especially important when hospitals use external AI service providers.

A hospital must consider whether the service provider has adequate security safeguards and whether patient information is being processed for authorised purposes.

bdj.mmsp.gov.ma+2

4. Civil, Professional and Institutional Liability

The liability framework should distinguish among the following parties.

A. Physician Liability

A physician may face professional or civil consequences if they:

Follow an algorithm despite contradictory clinical evidence.

Ignore obvious diagnostic errors.

Fail to investigate abnormal findings.

Neglect appropriate patient monitoring.

Fail to obtain relevant patient consent.

Disregard applicable professional standards.

B. Hospital Liability

A hospital may face responsibility where it deploys AI without adequate clinical validation, technical safeguards or staff training.

For example, a hospital introduces an automated sepsis-prediction system. The system repeatedly fails to identify patients at high risk, but the hospital continues using it without investigating the problem.

This may raise questions concerning institutional negligence, depending on the applicable legal duties and evidence.

C. Software Developer Liability

A developer may face liability where a software defect contributes to patient injury.

Relevant circumstances include:

Defective algorithm design.

Inadequate testing.

Failure to correct known defects.

Misleading safety claims.

Insufficient cybersecurity.

Failure to communicate significant limitations.

The precise legal basis will depend on the contractual relationship, applicable civil-liability rules and whether the software qualifies as a regulated medical device.

5. Important Case Laws and Judicial Principles

Important legal distinction

There is an important limitation in researching this subject: I cannot identify a verified, reported Moroccan judgment directly deciding liability for an AI-based clinical decision system. It would therefore be misleading to invent Moroccan case names or claim that foreign judgments are binding in Morocco.

The following judgments provide comparative principles that can help interpret medical negligence, patient information, automated decision-making and algorithmic accountability.

Case 1: Bolam v Friern Hospital Management Committee (1957)

Citation: [1957] 1 WLR 582.

Facts:

A psychiatric patient suffered injuries during electroconvulsive therapy. The dispute concerned whether the medical treatment complied with accepted professional standards.

Judgment:

The English court developed the Bolam principle: a doctor is generally not negligent if acting in accordance with a practice accepted as proper by a responsible body of medical professionals skilled in that particular field.

Relevance to Moroccan algorithmic healthcare:

The principle provides a useful comparative framework for examining whether a physician's reliance on an AI recommendation was consistent with responsible medical practice.

However, the mere fact that other physicians use the same AI product does not establish that its use is medically appropriate.

Case 2: Bolitho v City and Hackney Health Authority (1997)

Citation: [1998] AC 232.

Facts:

A child experienced serious medical complications after a doctor failed to attend when requested.

Judgment:

The House of Lords clarified that professional medical opinion must withstand logical analysis. A court is not required to accept a medical practice merely because some professionals support it.

Relevance:

This is particularly significant for algorithmic clinical decision systems.

A physician cannot automatically defend an incorrect treatment by arguing that the AI software was widely used.

The underlying recommendation must have a defensible clinical basis.

Case 3: Montgomery v Lanarkshire Health Board (2015)

Citation: [2015] UKSC 11.

Facts:

A pregnant patient was not adequately informed about the risks associated with vaginal delivery and alternative treatment options.

Judgment:

The UK Supreme Court emphasised the physician's duty to inform patients of material risks and reasonable alternatives.

Relevance:

Where AI materially influences treatment selection, the physician should explain relevant treatment options and material risks.

For example, a patient should not be denied an appropriate alternative treatment merely because an algorithm recommends a different option.

The case provides an important comparative foundation for patient autonomy and informed consent.

Case 4: Rogers v Whitaker (1992)

Citation: [1992] HCA 58; (1992) 175 CLR 479.

Facts:

A patient underwent eye surgery and suffered a serious complication that had not been adequately disclosed.

Judgment:

The High Court of Australia recognised the importance of informing patients about material risks, assessed from the perspective of a reasonable person in the patient's position.

Relevance:

A physician using AI-assisted surgical or diagnostic recommendations should not conceal material uncertainties or risks merely because the technology is sophisticated.

The case is persuasive comparative authority, not binding Moroccan precedent.

Case 5: Darnley v Croydon Health Services NHS Trust (2018)

Citation: [2018] UKSC 50.

Facts:

A patient attending a hospital emergency department received misleading information about waiting times and subsequently left without receiving appropriate medical attention.

Judgment:

The UK Supreme Court recognised that hospitals may owe duties concerning information provided to patients through their staff.

Relevance:

This principle is useful when considering algorithmically generated triage information.

A hospital should not assume that inaccurate automated triage communications are legally irrelevant simply because they were generated by software.

Case 6: State v Loomis (2016)

Citation: 881 N.W.2d 749 (Wis. 2016).

Facts:

The defendant challenged the use of the COMPAS algorithm in criminal sentencing because of concerns about proprietary algorithms and their potential lack of transparency.

Judgment:

The Wisconsin Supreme Court permitted the limited use of the algorithm subject to cautions and restrictions.

Relevance:

Although this was a criminal justice case rather than a medical case, it illustrates important questions concerning:

Proprietary algorithms.

Transparency.

Bias.

Human decision-making.

Limitations on automated recommendations.

In healthcare, similar concerns arise when a physician cannot properly assess the basis of an algorithmic recommendation.

Case 7: SCHUFA Holding (Scoring) – Court of Justice of the European Union (2023)

Citation: Case C-634/21, judgment of 7 December 2023, ECLI:EU:C:2023:957.

Facts:

The dispute concerned automated credit scoring and the circumstances in which a generated score could constitute automated decision-making under European data-protection law.

Judgment:

The CJEU interpreted Article 22 of the GDPR in relation to scoring that plays a determining role in a third party's decision.

Relevance:

The judgment provides a comparative framework for understanding the legal significance of algorithmic scores.

In healthcare, an algorithmic risk score may similarly have a decisive influence on access to treatment, triage or clinical intervention.

However, the GDPR is not Moroccan law, and this judgment does not automatically establish an equivalent right under Law No. 09-08.

6. Regulatory Challenges in Moroccan Healthcare

A. Lack of AI-Specific Clinical Legislation

One of the major regulatory challenges is the absence of a single comprehensive Moroccan statute specifically addressing algorithmic clinical decision-making.

Existing legislation regulates different parts of the problem, but does not necessarily provide a complete framework for:

Approval of clinical AI algorithms.

Mandatory algorithmic impact assessments.

Continuous monitoring of machine-learning systems.

Independent algorithmic audits.

Clinical explainability standards.

Allocation of liability between physicians and developers.

Regulation of continuously learning medical algorithms.

This creates uncertainty when hospitals introduce advanced AI technologies.

B. Cross-Border Medical Data Processing

Moroccan hospitals may use international cloud-computing platforms and foreign AI developers.

This creates questions concerning:

International transfers of medical data.

Foreign access to genetic information.

Data-storage locations.

Contractual confidentiality.

Overseas processing of patient records.

Regulatory requirements under Law No. 09-08.

International transfers must be examined under the applicable provisions of Law No. 09-08, including its transfer restrictions and CNDP procedures.

C. Continuous Learning Algorithms

Traditional medical software may operate according to a relatively fixed set of instructions.

Machine-learning systems, however, can change their performance as they receive additional information or undergo updates.

For example, an algorithm initially validated for cancer detection may perform differently after its training dataset is modified.

This creates several regulatory questions:

Does the modified system require renewed validation?

Who is responsible for monitoring changes?

Must patients be informed about significant changes?

Who bears responsibility when an update causes an incorrect diagnosis?

How should hospitals document different algorithm versions?

Moroccan healthcare institutions should maintain version histories, validation records and change-management procedures.

D. Algorithmic Errors in Emergency Medicine

AI systems are increasingly used for emergency triage.

For example, an algorithm may classify a patient with chest pain as low-risk, although the patient is experiencing a serious cardiac condition.

Incorrect triage may result in delayed treatment.

The legal assessment should examine:

Whether the system was appropriately validated.

Whether the clinical staff followed appropriate procedures.

Whether warning signs were ignored.

Whether the hospital had adequate escalation procedures.

Whether the error caused legally recognisable injury.

Human review is especially important when the algorithm produces a high-risk or uncertain result.

7. Practical Examples of Algorithmic Clinical Regulation

8. Role of Moroccan Regulatory Authorities

Several institutions have important responsibilities in this area.

1. Ministry of Health and Social Protection of Morocco

Its responsibilities include healthcare policy, regulation of health institutions and oversight of relevant health-product frameworks.

2. National Commission for the Control of Personal Data Protection (CNDP)

The CNDP supervises compliance with Law No. 09-08 and plays an important role in protecting patient information.

3. National Council of the Order of Physicians of Morocco

The medical professional order is relevant to professional ethics, medical conduct and the responsibilities of registered physicians.

4. Moroccan health-product regulatory authorities

The relevant competent authorities oversee applicable pharmaceutical and medical-device requirements.

Their responsibilities become important when AI software is incorporated into regulated medical products.

The Ministry of Health and the medical professional bodies publish the relevant professional and regulatory texts.

sante.gov.ma+2

9. Recommendations for Strengthening Moroccan Algorithmic Healthcare Regulation

Morocco could develop a more comprehensive governance framework through the following measures.

1. Specific AI healthcare legislation

Introduce dedicated rules governing the development, approval, deployment and monitoring of clinical AI systems.

2. Mandatory clinical validation

Require appropriate clinical evidence before high-risk diagnostic and treatment algorithms are deployed.

3. Human oversight

Ensure that qualified medical professionals retain meaningful authority over consequential clinical decisions.

4. Algorithmic transparency

Require documentation explaining the intended purpose, limitations, validation methodology and known risks of clinical algorithms.

5. Independent algorithmic audits

Establish periodic reviews to identify discriminatory outcomes, technical defects and declining clinical performance.

6. Stronger patient rights

Provide understandable information about significant AI involvement in medical decisions and accessible procedures for human review.

7. Clear liability allocation

Clarify the respective responsibilities of hospitals, physicians, developers, medical-device manufacturers and data processors.

8. Cybersecurity requirements

Introduce risk-based technical safeguards, access controls, incident reporting and protection against unauthorised access to medical information.

9. Special protection for genetic information

Strengthen safeguards concerning genetic prediction, inherited conditions and algorithmic risk profiling.

10. Regulatory coordination

Promote cooperation between the Ministry of Health, CNDP, medical professional bodies and relevant medical-device authorities.

10. Conclusion

The regulation of algorithmic clinical decision systems in Moroccan healthcare requires balancing technological innovation with patient safety, professional responsibility and fundamental rights.

Morocco already has important legal foundations, particularly:

Constitution of 2011, Articles 24 and 31.

Law No. 09-08 on personal data protection.

Law No. 131-13 on the practice of medicine.

Law No. 84-12 on medical devices.

Law No. 11-08 on in vitro diagnostic reagents.

Law No. 17-04 on medicines and pharmacy.

These laws provide important safeguards, but they do not collectively amount to a complete AI-specific clinical governance code.

The comparative decisions in Bolam, Bolitho, Montgomery, Rogers v Whitaker, Darnley, State v Loomis and SCHUFA demonstrate important principles concerning professional negligence, patient autonomy, algorithmic transparency and accountability.

Ultimately, the physician must retain meaningful clinical judgment, the hospital must ensure safe deployment, and technology developers must be accountable for defects attributable to their products under applicable law. Algorithmic intelligence should support medical professionals rather than replace the legal and ethical responsibilities of healthcare institutions.

11. Important Legal References and Research Sources

For further academic and legal research:

Moroccan CNDP – Personal Data Protection Laws.

Official text of Law No. 09-08.

Moroccan Ministry of Health – Medical Profession Regulations.

Moroccan health-product legislation.

Moroccan Medical Order – Regulatory Texts.

Moroccan General Secretariat of Government – Regulated Professions.

Academic research note: The foreign judgments discussed above are comparative authorities, not binding Moroccan judgments. A complete Moroccan case-law analysis would require examination of published Moroccan Court of Cassation and administrative-court decisions concerning medical negligence, professional responsibility, patient confidentiality and defective medical products.