The day your European client sends you their “AI questionnaire”

You already know the scenario. One morning, your main European client forwards you a new supplier form. Not for quality this time, not for information security — for AI. Which artificial intelligence tools do you use to produce our deliverables? Is the content you generate flagged as such? Who validates the outputs before they reach us? Can you prove it?

If this scenario feels familiar, that’s because it has happened before — with GDPR. From 2018 onward, European groups passed their data-protection obligations down through their entire subcontracting chain, Morocco included. The companies that anticipated it signed contracts. The others spent six months catching up, under pressure, in a rush, losing tenders along the way.

The EU AI Act is now producing exactly the same cascade effect. And this time, you can see the wave coming.

The AI Act, plainly, for anyone exporting to Europe

The AI Act is the first comprehensive legal framework on artificial intelligence anywhere in the world. It was adopted by the European Union and is being phased in through successive stages over several years. Its core principle: classify AI uses by risk level and impose obligations proportionate to that risk.

You are not a European company, and you may tell yourself this regulation does not concern you. That’s the classic mistake. Like GDPR, the AI Act has extraterritorial reach: it applies as soon as the outputs of an AI system are used within the European Union. If you produce a deliverable for a European client that has been touched by AI — a document, an analysis, code, a visual, a translation — you are already within scope, indirectly but genuinely.

Two articles concern you first and foremost.

Article 50 — transparency of AI-generated content

Article 50 requires that AI-generated or AI-manipulated content be identifiable as such. Synthetic text, image, audio, video: the end user must be able to know they are dealing with an AI output and not purely human work. These transparency obligations become applicable around December 2026.

For you, the exporter, this does not stay a distant obligation weighing only on Brussels. Your European client will have to prove the traceability of their content. They can only do so if you provide the information: “this section was produced with AI assistance, validated by such-and-such reviewer.” Transparency does not stop at the end client’s border.

Article 14 — human oversight

Article 14 requires that high-risk AI systems remain under effective human oversight. Not a token human clicking “OK” without looking: a human who understands the system’s limits, who can interpret its outputs, and who retains the power to decide otherwise — or even to stop the system.

Translated for your work: AI can propose, accelerate, pre-draft. But an identified person must validate before the output commits the company — and you must be able to show where, when, and by whom that validation took place.

The mechanism is simple and already battle-tested. The obligation legally weighs on the European actor. But that actor cannot meet the obligation without their suppliers’ cooperation. So they contractualize it: clauses in contracts, supplier audit questionnaires, requirements added to specifications, conditions for entering tenders.

This is exactly what happened with data protection. No Moroccan law imposed GDPR on you — your European clients did, line by line, in their contracts. For AI, the same path is forming, with one major advantage: you know it in advance.

And don’t forget that Morocco is moving in parallel. Law 09-08 and the CNDP already govern the processing of personal data — including when that processing goes through an AI tool. Running client or employee data through AI without a framework is a present legal risk, not just a future European one.

How to prepare: four concrete workstreams

Good news: preparing for the AI Act does not require reinventing your organization. It is mostly about making visible and traceable what already happens.

1. Inventory your AI uses — including the “shadow” ones

You cannot govern what you cannot see. List every AI tool used to produce your deliverables: writing assistants, image generators, translation tools, transcription, code generation. A simple internal questionnaire almost always reveals twice as many tools as management suspected. Uncomfortable in the moment, healthy afterward.

2. Set up traceability for AI-generated content

To answer Article 50, you must be able to state, for each sensitive deliverable: which part was produced or assisted by AI, with which tool, from which data. This is not bureaucracy — it is the exact information your client will demand. A lightweight system in place today beats a frantic reconstruction in December 2026.

3. Define and document your human oversight

For each significant AI use, write down in black and white: who validates the output, at what moment, on what criteria, and in which cases a human must take back control. This is the heart of Article 14. The standard does not ask the human to redo everything — it asks that the control points be defined, not improvised.

4. Anchor it all to a recognized framework: ISO 42001

This is where the previous workstreams find their backbone. ISO/IEC 42001:2023 is the first certifiable AI management standard. System inventory, AI policy, impact assessments, human oversight, AI-supplier management: its Annex A covers very precisely what the AI Act will ask you to prove.

The strategic benefit is twofold. First, ISO 42001 gives you a ready-made structure to meet the regulatory requirements. Second, a certification is an opposable answer: instead of filling out each client’s AI questionnaire one by one, you present an internationally recognized certificate. Just as ISO 27001 became the standard answer to security questionnaires, ISO 42001 will become the standard answer to AI questionnaires.

Let’s be honest: software won’t make you compliant on its own

Let’s say it plainly, because it matters. No tool — ours included — will make you compliant with the AI Act in your place. The AI policy, the risk trade-offs, the decision to validate an output or not: that remains in human hands, yours. Software is not a compliance certifier, and it does not guarantee the absence of a breach.

What a good tool does, on the other hand, is ensure that nothing gets lost and everything can be proven. And that is precisely where companies stumble on audit day: not on intent, but on evidence.

Where Betterfly comes in — and what it won’t do for you

Betterfly includes an ISO 42001 module that tracks each Annex A control, manages your Statement of Applicability (SoA), and links each control directly to its evidence. It is the skeleton that turns your four workstreams into an auditable file.

On the AI side, our BetterAssist copilot concretely illustrates the principles the AI Act puts forward. It is built compliant-by-design and stays confined to the QSE/ISO scope — it is not a general-purpose AI. The human stays in the loop: at sensitive points — publication, signature, closure — a person validates, never the AI alone. Our formula, we own it as is: “BetterAssist augments the expert, it does not replace them. The machine proposes and proves; the human decides and commits.” That is, word for word, the spirit of Article 14.

On transparency, every AI response carries a trace — an identifier, the cited sources, the model used — through a traceability module, and that coverage is continuously expanding. Finally, a point that reassures compliance leaders: Betterfly trains no AI model on your data. Inference goes through the Azure OpenAI API on already-trained models; your business data is only injected as context, in an architecture where one client’s data never leaks to another. All hosted on Microsoft Azure, France Central region.

And we apply to ourselves what we tool for others: Betterfly is published by E-Quality Engineering, certified ISO/IEC 27001:2022 and ISO/IEC 42001:2023. We live what we sell. When a client asks us about the governance of our AI, we don’t recite a brochure — we show our own file.

The AI Act is not a threat to Moroccan exporters. Like GDPR in its day, it is a filter. Those who prepare now will turn a regulatory constraint into a commercial argument — that of a partner European groups can rely on without risk.

Going further:

Read our full guide on ISO 42001 in Morocco: who is concerned, what the standard requires, and lessons from a dual 27001 + 42001 certification
Explore our Trust & Security page to see how we govern AI, traceability, and data isolation