Checking the compliance of AI uses

What the checklist on the compliance of AI uses contains

• Characterisation of the use: function, task, tool, provider, plan, data on identifiable persons, outputs intended for the European Union.
• Law No. 09-08: purpose and necessary data, legal basis, information, rights, automated decision, formality, contract with the provider, transfer.
• GDPR: territorial scope, representative in the Union, legal basis and information, processing agreement, transfers outside the Union.
• EU AI Act: role of the organisation, prohibited practices, transparency, AI literacy of staff, high-risk classification.
• The high-risk timetable: 2 December 2027 for Annex III, 2 August 2028 for Annex I.
• Finally, follow-up: dated checks, designated author, re-examination at each change of tool, provider or terms.

When to use the checklist

The list applies to each AI use, from its entry in the register of uses. It is then repeated at each change of tool, provider or terms. It concerns first of all data controllers established in Morocco or using means located in Morocco. It also covers organisations dealing with the European Union, under the GDPR or the AI Act.

Instructions for use

First, the characterisation describes the use and determines whether it involves data on identifiable persons. Next, the Law No. 09-08 checks are carried out article by article, from purpose to transfer. Then the GDPR and EU AI Act sections are opened only if the organisation falls within their scope. Finally, each check receives a date and an author. Follow-up on the compliance of AI uses then incorporates the deliberation announced by the National Commission for the Control of Personal Data Protection (CNDP) on such processing.

Expected outcome

The result is a dated list of checks on the compliance of AI uses, framework by framework. It thus brings out the open points: legal basis, formality with the CNDP, contract, transfers. Each check also refers to the relevant article of the text concerned.

Key facts

Limitations

The list records checks; it does not amount to a certificate of compliance. Moreover, references to legal texts must be checked against the wording in force on the date of use. In addition, the formality, the basis for a transfer and high-risk classification depend on each use.

Further reading: Information Systems & Digital Transformation; Law No. 09-08 on the protection of individuals with regard to the processing of personal data.