Artificial intelligence

Generative AI for business in Morocco: use cases, risks and a method

By Yasser MsahalPublished 12 October 20269 min read

Generative AI pays off for a B2B company in Morocco when it is aimed at one specific process: handling documents, drafting support replies, finding information in internal documents or producing a first draft of a report. It disappoints when it is rolled out everywhere with no rules. Three things make the difference: classifying data before it is sent to a model, keeping a person accountable for the output, and starting with a measured pilot.

What can generative AI do for a B2B company in Morocco?

A large language model (LLM) reads, summarises, classifies and writes text. In B2B it earns its keep on repetitive tasks where most of the time goes into reading, searching and copying. Four families of use cases are both within reach and easy to keep under control.

• Document processing: invoices, purchase orders, contracts or complaints. The model extracts the relevant fields, classifies the document and flags anything missing. In Morocco these documents often arrive in French, in Arabic or in a mix of both, sometimes as scans: test the model on your own samples, in every language you receive, before drawing any conclusions.
• Draft support replies: the model reads the ticket, pulls the relevant points from your procedures and suggests a reply that the agent reviews, corrects and sends. The time saved is in searching and writing, not in deciding. If your customers also write in Darija (Moroccan Arabic), include those messages in your tests.
• Search across the internal knowledge base: quality procedures, HR policies, technical documentation. Employees ask their question in plain language and get an answer together with the source passages.
• Report generation: meeting minutes, monthly summaries, scoping notes. The model assembles a first draft that the manager completes and approves; the figures come from your systems, never from the model's memory.

What these four uses have in common: the model prepares, a person decides. That is what makes them deployable without waiting for a perfect model.

RAG: querying company documents without training a model

RAG (Retrieval-Augmented Generation) does not ask the model what it "knows": with every question, it hands the model the relevant extracts from your documents. No training on your data is required, and an updated procedure is taken into account as soon as it is re-indexed.

1. Approved documents are split into passages and indexed.
2. For each question, the system retrieves the closest passages.
3. The model receives those passages with the instruction to answer from them alone.
4. The answer is displayed with its sources so it can be checked.

Three things determine quality. The documents themselves: outdated or contradictory procedures produce outdated or contradictory answers. Access rights: search must respect the permissions in your document management system, or an intern could get an answer drawn from a finance department document. And evaluation: before launch, build a list of real questions with the correct answer and the correct source document, then re-run it every time you change the model, the prompt or the way documents are split.

The limits of LLMs in business: hallucinations, data leaks, costs

Hallucinations

An LLM produces the most plausible text, not the most accurate. It can quote a clause that does not exist or an invented amount with the same confidence as a correct answer. Countermeasures: require sources, allow the model to answer "I don't know", automatically check extracted fields (formats, totals, references) and have a person review anything that leaves the company.

Data leaks

Pasting a client contract into a consumer tool means handing it to a third party whose servers, retention period and, often, use of the data are outside your control. Internally, a poorly segregated assistant can also show information to someone who is not entitled to see it. A final, less well-known trap: a document or email processed by the model can contain hidden instructions that hijack its answer. So never give an assistant more access or more power to act than the person using it.

Runaway costs

Models accessed through an API are generally billed on usage, according to the volume of text sent and generated. A cheap prototype can become expensive once rolled out widely, especially if every request carries long documents. Measure the cost per task during the pilot and set caps before opening up access.

Law 09-08 and the CNDP: what are the rules for sending data to an LLM?

The first governance rule: classify data before sending it to a model. Three sensitivity levels plus one cross-cutting marker are enough to get started:

• Public: catalogue, website pages, published sales material.
• Internal: procedures, document templates, organisational notes.
• Confidential: contracts, price quotes, financial data, source code.
• Personal, whatever the level: anything that identifies a person (customer, employee, job applicant), including within an email, a ticket or a CV.

In Morocco, personal data is governed by Law 09-08 (loi 09-08) on the protection of individuals with regard to the processing of personal data, and compliance is overseen by the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel), the national data protection authority. Processing by AI is still processing: a defined purpose, data limited to what is necessary, informing the people concerned and, depending on the case, a declaration or an authorisation request to the CNDP. Certain so-called sensitive categories (health, opinions, religious beliefs, origin and so on) are subject to stricter rules. Transferring personal data abroad, which is common with online AI services, is regulated too. Check your situation with the CNDP or your legal adviser before going into production.

In practice, each level gets a usage rule: public data allowed everywhere; internal data only through a service approved by the IT department; confidential and personal data only after anonymisation, or through a solution whose hosting and contract have been reviewed.

Generative AI governance: human in the loop and logging

• One owner per use case, on the business side, who approves the scope and the results.
• Human in the loop: any output that commits the company (customer reply, HR decision, contractual document) is approved before it is sent.
• Logging: the prompt, the sources used, the model and prompt versions, the answer and the approval are kept so that a result can be explained after the fact. These logs contain data themselves: protect them and set a retention period.
• Access rights: the tool inherits existing permissions; it does not create new ones.
• An acceptable use policy: what employees may and may not submit to AI tools, including consumer ones.

If a vendor is involved, its practices matter as much as yours: see ISO 27001 and data security at a service provider.

How to integrate generative AI into a business process, step by step

1. Pick a single process: high-volume, repetitive, text-based, where a mistake is visible and can be put right. Sorting complaints is a good fit; a credit decision is not the place to start.
2. Measure the current state: processing time, response time, rework rate. Without a baseline, no gain can be demonstrated.
3. Run a controlled pilot: one team, real documents, classified data, systematic human review, logging switched on.
4. Compare: the same indicators, plus the cost per task and the share of answers corrected by users.
5. Decide: scale up, adjust or stop. Stopping a pilot that does not deliver is a result, not a failure.
6. Industrialise: integration with your information system, monitoring, budget, user support.

Write down the scope before you approach vendors: writing a software requirements specification applies to AI too. Once the first use case is stable, the next step is often to chain several actions together: that is the subject of AI agents in business. For the bigger picture, see digital transformation for SMEs in Morocco.

Enterprise LLMs in Casablanca: what guarantees should you ask a provider for?

Before signing, ask precise questions:

• Where are the models, indexes and logs hosted, and which data passes through third-party services?
• Do the model provider's terms allow your data to be reused, for example for training?
• How is access segregated, and what is logged?
• How is cost tracked and capped?
• Who owns the code, prompts and configurations delivered, and can you switch model or provider without rebuilding everything?

Codevista Innovations, based in Casablanca and certified to ISO/IEC 27001:2022, integrates generative AI and LLMs into existing business processes with a stated commitment: never compromising on security. To scope a first use case, get in touch.

Frequently asked questions

Can a consumer AI tool be used with customer data in Morocco?

Not without a framework. Customer data is often personal data within the meaning of Law 09-08, and consumer tools frequently process it on servers outside Morocco, under their own terms. Classify the data first, check the service's hosting and contract, favour anonymisation and consult the CNDP or your legal adviser about the formalities that apply.

Do you need to train your own AI model to use it on company documents?

In most cases, no. The RAG approach supplies the model, with each question, with the relevant passages from your documents, without any training on your data. It is quicker to set up, keeps pace with updates to your documents and lets you show the sources behind every answer. Dedicated training is mainly justified for very particular formats or vocabulary.

How can you limit LLM hallucinations in a business process?

You cannot eliminate them, but you can contain them. Give the model sources and require it to stick to them, allow it to say it does not know, automatically check extracted amounts, dates and references, and have a person approve any output that commits the company. Log the answers so that recurring errors can be spotted.

Which use case should you start with when adopting generative AI in a company?

Choose a high-volume, repetitive, text-based process where a mistake is easy to see and correct: sorting complaints, extracting invoice data, drafting support replies or searching internal procedures. Measure current time and quality, run a pilot limited to one team, then compare the results before deciding whether to scale up.