Olympia Tsamoura · 29 January 2024. Where AI and Big Data have delivered real gains in maritime efficiency and safety, governance, trust and ethics keep intersecting at the same pressure points: data quality, accuracy, ownership and control.
Editor's note: this article was written on 29 January 2024 and reflects the regulatory and technological landscape as it stood at that date. Since then, the EU Artificial Intelligence Act has become a central instrument in European AI governance and sits alongside the GDPR discussed here. Readers should consult current official sources for its scope and implementation timetable.
This article explores the transformative impact of Artificial Intelligence (AI) and Big Data applications in the maritime industry, highlighting the gains in efficiency, safety and operational capability that these technologies have delivered. Alongside those benefits, it critically examines the governance, trust and ethical concerns that follow them. The analysis is built on several complementary lenses: the General Data Protection Regulation (GDPR) as the legal frame for data protection; the six interrogatives of the Zachman Framework for Enterprise Architecture (the 6Ws) as a governance lens; the Taxonomy for AI Hazard Analysis (TAIHA) as a method of structured hazard evaluation; and the problem of data standardisation and provenance across a fragmented industry.
Governance, trust and ethics intersect at the same pressure points — data quality, accuracy, ownership and control — and navigating them successfully demands a deliberate balance between innovation and safeguards, rather than a choice between them. Embracing sound data-protection principles is not a brake on maritime AI; it is the condition on which trust in it depends.
The maritime industry has actively embraced AI and Big Data to improve productivity and efficiency. Research indicates that AI applications in maritime research cluster around four key areas: digital transformation, the use of big data from the Automatic Identification System (AIS), energy efficiency, and predictive analytics. Digital transformation is centred on automating operations, business processes and information processing — one example being the adoption of e-navigation systems to improve data organisation and communication between ships and shore (Chin & Venkateshkumar, 2021).
The integration of AI and machine learning into traffic navigation holds real potential for streamlining operations and boosting productivity. Work in this area focuses on autonomous ships, big data utilisation, AI, cybersecurity, the Internet of Things (IoT) and virtual reality. AI and big data also play a central role in the wider digitalisation of the shipping business. The scope of this article follows that same breadth — it is concerned not with any single technology, but with what the combined adoption of these technologies means for governance, trust and ethics in an industry where the consequences of a poor decision are measured in lives, cargo and coastline.
Data and technology governance is the set of structures, responsibilities and controls that determine how data is collected, who may use it, for what purpose, to what standard of quality, and who answers for the outcome. It is distinct from management: management runs the systems, while governance decides the rules those systems must obey and holds someone accountable when they are broken.
Governance matters acutely in the maritime sector for three reasons. First, decisions taken on the basis of data — routing, loading, maintenance scheduling — carry physical safety consequences. Second, the industry is unusually fragmented: owners, operators, charterers, ports, flag states and insurers all hold pieces of the same operational picture, and no single party controls the data end to end. Third, it is heavily regulated internationally, so decisions must be defensible not only commercially but to regulators in multiple jurisdictions.
One widely used way of interrogating a process systematically is the set of six questions at the heart of the Zachman Framework for Enterprise Architecture — What, How, Where, Who, When and Why — commonly referred to as the 6Ws (Sowa & Zachman, 1992). Applied to the maritime domain, they translate into concrete inquiries: who is accountable for ship maintenance, what regulations govern ship operations, where the major ports sit in a given trade, when shipping activity peaks, why a particular safety procedure exists, and how technology can be used to improve efficiency and safety. The framework is a general-purpose instrument rather than a maritime standard, but that is arguably its usefulness here: it imposes no assumptions about how a fragmented industry should be organised, only that someone should be able to answer all six questions.
In shipping, "best practice" is not merely customary; much of it is codified. The International Safety Management (ISM) Code, mandatory under SOLAS chapter IX since 1 July 1998, provides "an international standard for the safe management and operation of ships and for pollution prevention" (IMO, 1993), requiring companies to "establish safeguards against all identified risks" and to "continuously improve safety management skills of personnel ashore and aboard ships."
The Code also requires that a safety management system take into account "applicable codes, guidelines and standards recommended by the Organization, Administrations, classification societies and maritime industry organizations" — the clause by which IT and cybersecurity practice has entered maritime safety management. The ISM Code frames safety as a matter of continuous improvement rather than one-off certification, which is precisely the posture an evolving technology like AI requires; but it speaks to safety and pollution prevention only — maritime security is governed separately through the ISPS Code, and cyber risk sits awkwardly across both. That division of instruments is part of why AI governance at sea is harder than it first appears.
Where governance asks who decides, ethics asks whether the decision is defensible. The ethical considerations that consistently recur can be grouped into a small number of concerns: whether the data used is representative and free of systematic distortion; whether individuals whose data is processed retain privacy and meaningful control; whether the reasoning behind an automated decision can be explained to the people it affects; whether responsibility for that decision can be traced to an accountable party; and whether a human remains in a position to intervene when the system behaves in ways it should not.
These concerns are not abstract in shipping. A biased dataset can misdirect a maintenance programme; an opaque model can produce a routing decision no officer can justify; an unexplained automated assessment can affect a seafarer's employment.
The maritime industry is vulnerable to several forms of bias, notably the gender imbalance documented in the IMO-WISTA Women in Maritime Survey 2021: women account for only 29% of the overall workforce in the general industry, and 20% of the workforce of national maritime authorities in Member States — with sharper gaps in particular functions, such as just 10% in search and rescue teams (IMO & WISTA International, 2022).
Bias in this setting is not a single phenomenon. NIST's guidance on identifying and managing bias in AI distinguishes three dominant categories: systemic bias, which "result[s] from procedures and practices of particular institutions" that advantage some groups and disadvantage others — the category the workforce figures above fall into; statistical and computational bias, which "stem[s] from errors that result when the sample is not representative of the population"; and human bias, reflecting "systematic errors in human thought based on a limited number of heuristic principles" (NIST SP 1270, 2022). Recognising which category a given problem falls into matters, because the remedies differ: statistical bias can often be addressed by better sampling; systemic bias cannot, because the data faithfully records an unequal reality; and human bias is addressed through process and review rather than through data at all. Conflating the three is how organisations come to believe a representativeness fix has solved a structural problem.
The COVID-19 pandemic forced rapid adoption of digital technologies across maritime education and training, accelerating the use of simulator-based training and pointing toward greater use of virtual reality and cloud-based simulators (Kim, Sharma, Bustgaard et al., 2021). The industry also struggles with cybersecurity challenges that can affect critical systems including navigation, propulsion and cargo handling (Akpan, Bendiab, Shiaeles, Karamperidis & Michaloliakos, 2022).
These experiences underline the importance of developing AI and machine learning systems characterised by transparency, explainability and reliance on representative data — an approach that builds trust in these systems and helps ensure their safe and effective operation in real conditions (Androjna, Brcko, Pavic & Greidanus, 2020).
The most developed European statement of trustworthy AI is the Ethics Guidelines for Trustworthy AI, published by the European Commission's High-Level Expert Group on Artificial Intelligence, which sets out seven requirements for AI that is "lawful, ethical and robust" (HLEG, 2019). Five bear most directly on maritime operations:
Comparable principles appear in the OECD's Recommendation of the Council on Artificial Intelligence (2019) and UNESCO's Recommendation on the Ethics of Artificial Intelligence (2021), which gives the framing a reach beyond Europe — a consideration that matters for an industry whose ships change jurisdiction weekly.
In the maritime industry, data protection is integral to cybersecurity. The IMO's Guidelines on Maritime Cyber Risk Management describe information technology systems as "focusing on the use of data as information" and operational technology systems as "focusing on the use of data to control or monitor physical processes" (MSC-FAL.1/Circ.3/Rev.2, 2022). By Resolution MSC.428(98), the IMO affirmed that an approved safety management system should take cyber risk management into account under the ISM Code — so cyber risk, and the personal data AI carries with it, is part of the safety management system, not a parallel compliance track.
Two critical aspects come to the fore in maritime algorithmic applications: accuracy and transparency. Accuracy plays a crucial role in accident prevention and in upholding the safety of crew and cargo — AI and machine learning are instrumental in predicting weather patterns, identifying hazards and optimising shipping routes. Transparency carries particular weight where algorithmic use influences environmental outcomes and safety: a routing decision that cannot be explained to the officer executing it is a decision no one can properly supervise.
The GDPR requires that personal data be "processed lawfully, fairly and in a transparent manner in relation to the data subject" (Article 5(1)(a)). Where a decision is based solely on automated processing and produces legal or similarly significant effects, Article 22 gives the data subject the right not to be subject to it, subject to exceptions.
It is worth being precise about what follows from this, because the point is often overstated. The GDPR does not require full algorithmic explainability. What it requires is "meaningful information about the logic involved, as well as the significance and the envisaged consequences" of automated decision-making (Articles 13(2)(f), 14(2)(g) and 15(1)(h)). The Article 29 Working Party clarified that this means an account of the categories of data used, why they are pertinent, and how a profile is built — "not necessarily a complex explanation of the algorithms used or disclosure of the full algorithm" (WP251rev.01, 2018). Article 22(3) guarantees the right to obtain human intervention, to express a point of view and to contest the decision — notably, explanation of the individual decision is not in that list.
That distinction is workable rather than weak. For a shipping company deploying AI on data that identifies seafarers or passengers, the obligation is to be able to say what data goes in, why it is relevant, what the system does with it in general terms, and who a person can turn to in order to challenge an outcome. These are answerable questions, and a system whose designers cannot answer them is not one that should be making consequential decisions about people at sea.
The accumulation of excessive data in the maritime sector has both practical and legal implications. Practically, an overwhelming volume of data creates challenges in management and analysis; legally, collecting more data than needed raises privacy and security concerns and increases vulnerability to breaches (UNCTAD, 2021).
Vessel monitoring data — AIS, VMS and VDS — is collected for safety and fisheries enforcement, and is obviously valuable for other purposes too. Reviewing the EU Fisheries Control Regulation, the European Data Protection Supervisor objected that provisions permitting reuse for "general law enforcement" were too broadly formulated (EDPS, 2011) — reasoning the GDPR later codified. Vessel data is not automatically outside data-protection law: as the EDPS noted, such monitoring involves personal data "as long as these data can be linked to identified or identifiable individuals," such as the master, owner or crew. The maritime data most clearly caught by the GDPR is not vessel position itself but the surrounding layer — crew lists, port call reporting, Port State Control records, access control and CCTV — and it is there that purpose limitation bites hardest.
A GDPR-era illustration of the compatibility test comes from Digi (Case C-77/21), where the Court of Justice held that purpose limitation does not in itself preclude further processing compatible with the original purpose — but that storage limitation precludes keeping data longer than that purpose requires. The compatibility assessment passed; a different principle failed. That is the shape most real cases take, and it is why documenting the assessment matters more than reaching a particular answer. None of this makes operational reuse of vessel data illegitimate: since 2017 the Danish Environmental Protection Agency has combined AIS identification with airborne "sniffer" sensors to measure ships' sulphur emissions and flag suspected breaches for fuel sampling (EMSA, 2019) — an effective reuse whose legitimacy is established by working through the compatibility factors, not assumed from the fact the data was already available.
The Global Maritime Issues Monitor 2019 surveyed senior maritime stakeholders from 46 countries and found the sector's digital challenge to be less a technology gap than a readiness gap (Global Maritime Forum, 2019). Readiness, in an industry this fragmented, is largely a data problem: owners, operators, charterers, ports, flag states and insurers each hold part of the operational picture in formats of their own, so a figure produced by one party frequently cannot be checked against another's records. That is a problem for AI specifically, because a model trained on data no one else can reconcile produces conclusions no one else can audit.
Two measures address this directly: a standardised data format for industry-generated data, so records from different parties can be compared without bespoke reconciliation; and consolidated, access-controlled storage with verifiable provenance — a record not only of what a figure is, but of where it came from and what was done to it. Neither is exotic; both are ordinary data engineering. Their absence is what makes more advanced ambitions unrealistic, because machine learning applied to data that cannot be traced or compared inherits every weakness of its inputs while making them harder to see.
Maritime safety culture already has a well-established way of thinking about accidents: Reason's Swiss Cheese model, in which an accident occurs when weaknesses in successive defensive layers happen to line up. Its limitation is that those layers describe human activity, and the model cannot address accidents in which AI is a possible causal factor — precisely the situation the industry is moving towards as autonomy and decision support spread across navigation, engineering and cargo operations.
The Taxonomy for AI Hazard Analysis (TAIHA) answers that gap by adding four layers specific to AI, used alongside the Swiss Cheese model wherever a joint human–AI system exists (Cummings, 2024):
Framed this way, AI risk stops being a separate compliance exercise and becomes continuous with the accident analysis the industry already knows how to do — questions an owner can put to a vendor before purchase, and a casualty investigation can put to an operator afterwards.
A comprehensive literature review by Nguyen et al. found that previous studies focused mainly on mathematical models, management frameworks and technical support systems used to assess risk, leaving a gap in empirically examining how those measures contribute to organisational resilience. In response, the authors propose the Digitally Embedded and Technically Supported Maritime Disruption Management (DEST-MDM) model — a holistic approach incorporating multiple management principles and levels of analysis to address maritime disruptions collectively (Nguyen, Tran, Duc & Thai, 2023).
The assessment of AI and Big Data applications in the maritime industry reveals a complex web of critical challenges. Governance, trust and ethics intersect at the same points: data quality, accuracy, ownership and control.
The starting problem is the data itself. Systemic imbalance in the workforce, statistical unrepresentativeness in the data, and the human biases of the people interpreting the output together mean that neither the data nor the conclusions drawn from it can be assumed neutral — compounded by a provenance problem: without standardised formats, consolidated data and a traceable record of where figures came from, results cannot reliably be checked by anyone other than the party that produced them.
Legally, the GDPR provides a robust framework for the personal-data dimension of these questions, but it governs one dimension, not all of them: it does not resolve bias in operational datasets, does not make one party's data comparable with another's, and does not tell an operator how hazardous a given AI deployment is. For those questions, the industry needs governance and risk instruments of its own — the 6Ws to interrogate accountability, timing and purpose; a hazard taxonomy such as TAIHA to extend accident-analysis habits to AI itself; and disruption-management models such as DEST-MDM to extend the same logic to resilience. None of these replaces regulation; each addresses something regulation does not reach.
The practical recommendations are consistent across all of them: adopt standardised data formats and consolidated data with verifiable provenance; apply a hazard taxonomy such as TAIHA to AI in safety-critical operations, before deployment and after incidents; embed governance frameworks at every phase of the delivery lifecycle rather than treating them as a compliance exercise; communicate algorithmic decision-making transparently to the stakeholders it affects; invest in AI ethics education; and collaborate across the industry to establish shared best practice, since no single operator holds the whole data picture.
The ethical trajectory of maritime AI and Big Data therefore centres on balance. Innovation and safeguards are not competing priorities in this sector — an algorithm no one can explain and no one is accountable for is not an asset, whatever its accuracy. Treating data protection, structured risk evaluation and transparent governance as conditions of deployment rather than constraints on it is what allows the industry to build trust, operate lawfully and contribute to a sustainable future.
Follow-up: this article argues that AIS data can be personal data when a vessel is small enough that the boat is effectively its owner. A later analysis puts a number on it, using 170 million AIS messages from Danish waters. How much of AIS is personal data? →