Resources·AI audit in Morocco: the 5-day method and deliverables
AI audit in Morocco: the 5-day method and deliverables
An AI audit quantifies, process by process, the hours your company can recover with AI, before you buy a single licence. At AI Magic Makers, in Morocco, it takes five days from the first meeting to the findings. You receive a map of your processes, the recoverable hours per team, three prioritised projects and a 90-day roadmap. Leadership then decides based on measured hours.
Key takeaways
- An AI audit quantifies hours per task; a digital audit assigns a maturity score.
- In Morocco, 4.3% of formal establishments with 5 or more employees use Big Data or AI (World Bank, 2024 survey).
- Five days: scoping, interviews, mapping, quantifying, then findings with three projects and a 90-day roadmap.
- Data protection: ask any provider for a confidentiality agreement, anonymised samples and read-only access. Law 09-08, Morocco's personal data protection law, applies as soon as AI processes personal data (CNDP release of 18 March 2025, reported by Le360).
- An audit can also conclude that a process is not worth automating, and we say so.
What is an AI audit, and how is it different from a digital audit?
An AI audit is an operational diagnostic: it looks at how your team actually works and quantifies the time it could recover. Our AI audit maps your workflows, measures the recoverable hours process by process and prioritises three projects.
A digital audit asks a different question. It reviews your website, your CRM or your search rankings, then assigns a "digital maturity" score. It does not tell you how many hours invoice reminders take, or what AI would change about them.
The difference shows in the deliverable. Hours per task turn into a decision: handle this process, simplify it first, or leave it as it is.
Why run an audit before buying AI tools?
In Morocco, basic digital tools are nearly universal and AI is rare. 98.8% of establishments have basic digital tools, according to the World Bank (2024 survey, reported by Aujourd'hui le Maroc on 7 October 2026). Only 4.3% use Big Data or AI. The sample covers formal establishments in industry and services with 5 or more employees.
The same survey finds that 31.7% of establishments have adopted advanced management technology, such as an ERP. Owning it is not the same as using it: fewer than half of them use it intensively. For this technology, significant gains only appear with intensive use. Adoption alone produces no statistically significant gain.
That finding is about management software, not AI. Applying it to AI is our working assumption: a licence returns nothing until someone gives it a specific task.
Eurostat lists the reasons why EU enterprises that considered AI in 2025 did not adopt it (data extracted in December 2025). Lack of expertise comes first, at 70.9%. Next come a lack of clarity about legal consequences (52.5%) and data protection concerns (48.8%).
These are European figures, not Moroccan ones, and they do not transfer as they stand. They do suggest that the main obstacle is not the tool. Only 20.7% of these enterprises consider AI not useful for their business. The most cited reasons concern skills and the legal framework for using AI.
If these barriers sound familiar, an audit addresses two of them: it brings the missing expertise and sets data-handling rules from day one. It also identifies the tasks where AI applies. It starts from your teams' real work, not from a sales presentation. Leadership comes away with the facts it needs to make a call.
Take a fictional scenario, for illustration. Leadership buys AI assistant licences for the whole team. Three months later, one or two people use them to rephrase emails. Nobody had defined what the tool was for, or how to tell whether it helped. The audit sets that definition before the purchase, task by task.
How does a 5-day AI audit work?
The audit follows five stages, one per day, from the first meeting to the findings. Each day produces a result you can check: a scope, interviews, a map, figures, then decisions. The audit observes and measures. Implementation comes afterwards, and only if the figures justify it. Here is what happens each day, and what you get from it.
The AI audit in five days
- 1D1 · ScopingScope, stakeholders, access
- 2D2 · Interviews4 to 6 interviews with your teams
- 3D3 · MappingThe real processes
- 4D4 · QuantifyingHours, effort, feasibility
- 5D5 · Findings3 projects, 90-day roadmap
Day 1: scoping
The first meeting lasts two hours. It sets the scope: which teams, which processes, which people to speak to. It also settles the access the auditor will need, and the access they will not get. Everyone involved knows what is expected of them, and when.
This is the moment to state your confidentiality conditions, before a single document changes hands. Scoping can also exclude processes, for example those that involve data you prefer to keep in-house.
Day 2: interviews with your teams
We run four to six interviews on site, with the people who do the work. A manager describes the process as it should run; the team describes it as it actually runs. The questions cover specific tasks: how many invoice reminders a week, how long per set of meeting minutes, where information gets lost.
The aim is to measure real time, not time estimated in a meeting room. A task that seems minor can take several hours a week once it is broken down step by step: these measured durations are the basis for the quantifying stage. Ask each interviewee to have one or two real examples of their work at hand, anonymised if needed.
Day 3: mapping
On the third day, we draw your processes as they actually run, not as the written procedure describes them. Each step appears with its owner, its tool and any data entered twice. That makes the duplicates visible: the same information typed in more than once, sometimes in two different tools. The result is a map leadership can read unaided: who does what, with which tool, and when.
Day 4: quantifying
For each process, we quantify the recoverable hours, the effort needed to set it up and its feasibility. Feasibility depends on the data involved. A process that handles HR files does not call for the same tools as one that monitors tenders. The ranking combines all three: a quick project on public data comes before a long one on sensitive data.
Day 5: findings
The findings session presents three prioritised projects and a 90-day roadmap. It can also conclude that a process is not worth automating. Saying so is part of the job. For each project, leadership leaves with a decision to make: launch it, prepare it or drop it.
Not sure whether you need an audit or team training? Ask us on WhatsApp and we'll reply with a yes, a no or a question.
What does the audit report contain?
The report is designed as "a document your leadership can read alone, and a technical team can execute." It brings together five deliverables:
- a map of your current processes, as observed on site;
- the recoverable hours per team, process by process;
- three prioritised, quantified projects;
- the recommended architecture: tools and connectors;
- a 90-day roadmap, reviewed at 30, 60 and 90 days.
Our AI audit offer publishes a sample findings report to show what the document looks like. It covers a fictional company of 45 people, audited in 5 days: it is an illustration, not a client result. The sample totals 312 recoverable hours a year, 9 processes mapped and 3 prioritised projects.
In this fictional example, invoice reminders account for 96 hours a year and meeting minutes for 84 hours, both at high priority. Replies to inbound requests (72 hours) and weekly reporting (60 hours) are rated medium priority.
What matters is the order: where to start, and what can wait.
How do you protect your data during an AI audit?
A well-run AI audit sets out how your data is protected from day one. The auditor works on your processes, on sample documents and sometimes with access to your tools. Invoices, customer letters and HR files contain personal data, so access rules are set during scoping, before any document is shared.
On 26 March 2026, Le360, a Moroccan news site, reported on a press release issued on 18 March 2025 by the CNDP, Morocco's data protection authority. Le360's report, part of a press review of Les Inspirations Éco, states that AI systems "are not a lawless zone" (our translation). Once they rely on personal data, they fall under Law 09-08.
According to Le360, the CNDP restates the principles of transparency, fairness, specified purpose, proportionality and security.
Law 09-08 itself requires the processing of personal data, subject to the exemptions in the text, to be declared to the CNDP beforehand or authorised by it. This section is general information, not legal advice.
Good practice to expect from any provider
- A confidentiality agreement, signed before scoping.
- Anonymised documents or samples, rather than complete files.
- Read-only access to your tools.
- No customer document in a consumer tool, even to save time.
- Interview notes stored in a controlled space, where you know who has access.
The table gives example processes, not client cases.
| Process | Data involved | What to check |
|---|---|---|
| Invoice reminders | Customer names and contact details, invoice amounts | Anonymised sample, read-only access to the software |
| Customer letters | Personal data, sometimes confidential | Redacted examples, nothing sent to a consumer tool |
| HR files | Employee data, sometimes sensitive | Interview without copying files, or fictional documents |
| Meeting minutes | Internal decisions, participants' names | Notes stored in a controlled space, limited access |
| Replies to inbound requests | Prospects' messages and contact details | Anonymised extracts, written agreement on how examples are used |
When some data must stay inside the company, a local AI integration runs open-source models on your own infrastructure. The documents stay on your machines.
What does leadership know after an AI audit?
After five days, leadership knows where its teams' time goes, process by process, in measured hours. It decides based on figures drawn from interviews with its own teams, not on vendor promises.
- Priorities are clear. Three projects are ranked, with the reason for each rank: recoverable hours, feasibility, data involved.
- The tools are identified. The recommended architecture names the tools and connectors that suit your processes.
- The data rules are set. You know which data can go into which tool, and which data stays with you.
- The plan can be executed. The 90-day roadmap is written so that a technical team can implement it.
Training and an audit answer different questions. Our team training lasts two days and makes a team self-sufficient on its own files. An audit lasts five days, measures the hours lost per task and quantifies three projects before any decision is made.
When is an AI audit not necessary?
An audit is not necessary when the question has already been settled. In those cases, a shorter format gets you further, faster.
- You have identified a single task. A half-day decision-makers' workshop is enough to make the call; team training then handles the task.
- The team has three people, or no repetitive process. Training the team on its own files gives you more than a diagnostic would.
- Your processes change every month. Stabilise them first: the audit will be more useful afterwards.
What happens after the audit?
You leave with a 90-day roadmap, which we review with you at 30, 60 and 90 days.
What comes next depends on the projects you select. When people need to learn how to apply AI, that means team training on your own files. To run the projects, AI consulting works on a monthly basis or a fixed scope. When the data has to stay on your machines, a local AI integration keeps it there.
Automations, built with Make or n8n for example, are the outcome of this work, not a separate offer. All our formats for teams are on the AI for companies page.
Frequently asked questions
What is an AI audit, in one sentence?
A diagnostic of your processes: the time spent on each repetitive task, and what AI can recover from it, with a priority for each project.
How long does an AI audit take?
Five days, from the first meeting to the presentation of the three prioritised projects.
Is an AI audit suitable for an SME?
Yes, if it has repetitive processes shared between several people. The scope adjusts to the company's size and to the processes selected during scoping.
Does an AI audit expose our data?
The risk stays low when the audit is properly scoped: a confidentiality agreement, anonymised samples, read-only access and no documents in consumer tools. If your data must not leave the company, local AI keeps it in-house.
To see how the audit applies to your company, book a scoping call.