hiddentokens.com/morocco-ai-law-09-08 · 27 October 2026 · info@hiddentokens.com
Hidden Tokens in Morocco: AI, Law 09-08 and professional secrecy
Your teams use ChatGPT, Claude or Copilot on contracts, payroll, tax filings and deeds. Every file given to the AI goes to a provider based outside Morocco, with the names, CIN (national ID card) numbers, ICE (company identifier) numbers and RIBs (bank account details) it contains. Hidden Tokens codes them on your computer, before the AI reads the file, and puts the real values back into the result, on your side.
Download this sheet (PDF) A4- A file sent to an AI provider abroad is a transfer of data outside Morocco, which Law 09-08 regulates (arts. 43 and 44); professional secrecy (Code pénal, art. 446) has no "AI" exception.
- Hidden Tokens codes the CIN, ICE, IF, RC, CNSS, patente and RIB numbers on your computer before the AI reads the file; the key never leaves the computer.
- It doesn't make you "compliant": it supports your compliance, and documents it. Any formalities with the CNDP, where they apply, remain yours.
- From MAD 100 a month (Solo, billed MAD 1,200 a year), excl. VAT, invoiced by Tardigrade SARL, Casablanca. 14-day trial, no account, no card. 30-day guided pilot, deducted in full from your first year.
Why the question arises
- AI providers are abroad. A file sent to the AI is a transfer of data outside Morocco, which Law 09-08 on the protection of individuals with regard to the processing of personal data regulates.
- Professional secrecy has no "AI" exception. A lawyer, notary, chartered accountant, doctor or banker who entrusts a file to a third party has entrusted it, whether that third party is a person or a piece of software.
- Banning AI doesn't work. Teams use it anyway, on their phones, with no trace. Authorised, controlled use is better.
What the texts say, and what Hidden Tokens does
| Text | What it requires | What Hidden Tokens does |
|---|---|---|
| Law 09-08, arts. 23 and 24: security and confidentiality of processing | Technical measures appropriate to the risk | Coding before the AI; key on the computer, with restricted access rights; log of what went out; containment check |
| Law 09-08, arts. 43 and 44: transfer to a foreign state | An adequate level of protection, or authorisation from the CNDP (the Moroccan data protection authority) | The AI provider receives only codes; the key never leaves the computer |
| Law 09-08, art. 3: data quality and minimisation | Process only what is necessary | Only what the task needs stays readable; sensitive financial columns (payroll, turnover, assets) protected automatically |
| Code pénal (Criminal Code), art. 446: professional secrecy | Do not disclose what was confided to you by virtue of your status or profession | The AI works on the structure of the file, never on the client's identity |
| Lawyers (Law 28-08), notaries (Law 32-09), chartered accountants (Law 15-89 and the Code des devoirs (code of professional duties), Decree 2-18-454) | Confidentiality towards third parties | Dedicated industry packs; local proof of what the AI received, which the client can verify |
What Hidden Tokens recognises for you
- Moroccan identifiers: CIN, ICE, IF (tax identifier), RC (trade register number), CNSS (social security number), patente (business tax number), Moroccan RIB (check digits verified), Moroccan phone numbers, passports.
- Moroccan industry packs: legal (law firm), notarial (notary's office), accounting, telecom (operator), plus banking and insurance, healthcare, HR and payroll.
- Documents: Word, Excel, PDF, text, scans reviewed on the computer. Deeds in French and official wording ("Royaume du Maroc", courts) stay readable so the AI can do its work.
Prices in Morocco (excl. VAT)
| Solo, 1 seat | Firm, 2 to 20 seats | Organisation, 21 to 100 seats | 101 to 500 seats |
|---|---|---|---|
| MAD 100 / month billed MAD 1,200 / year | On quote | On quote | On quote |
For the first ten customers in Morocco on the Firm or Organisation plan: one day of on-site rollout free (travel costs extra).
14-day trial, no account, no card. 30-day guided pilot, deducted in full from your first year. Invoiced by Tardigrade SARL, Casablanca.
What Hidden Tokens doesn't do
- It doesn't make you "compliant": it supports your compliance, and documents it. Any formalities with the CNDP, where they apply, remain yours.
- It protects what goes through it. Text pasted by hand into the chat isn't covered.
- Pseudonymised data remains personal data for whoever holds the key: that's you, and that's by design.
This sheet is not legal advice: the references should be confirmed by your counsel or your DPO. Hidden Tokens · hiddentokens.com · info@hiddentokens.com · WhatsApp +212 680 092 567
Next steps. 14-day trial: hiddentokens.com/#download · 15-minute leak test or pilot: WhatsApp +212 680 092 567 or info@hiddentokens.com · Shadow AI diagnostic: hiddentokens.com/shadow-ai-diagnostic · AI policy generator: hiddentokens.com/ai-charter