On this page
On Wednesday 28 October, before the Fort Lauderdale International Boat Show opened, the superyacht industry met at the Renaissance Fort Lauderdale Marina Hotel for MARE Forum's 7th Super Yacht Americas. The programme ran through the market, finance, flags and crew to a last session before lunch, "The yacht as a power plant and a data centre", which became a conversation about AI and who is responsible for the data it can now reach.
From the morning sessions
The market is tight at the top and slow in the middle. Ralph Dazert, Head of Intelligence at SuperYacht Times, put the fleet over 30 metres at more than 6,400, with around 600 in build and slots at the leading northern European yards now opening in 2031 and 2032. Bob Denison of Denison Yachting said brokerage sales were up, strongest at 60 to 75 metres, but the average yacht takes around 580 days to sell: "think about having a baby and then having a second baby."
The Bahamas has walked back its fee rises. The tariffs and flags panel, moderated by Joe Dargavage of the U.S. Superyacht Association, heard that the fee increases have been reversed and charter operators now pay the 4% charter fee and 10% VAT as one 14% payment. Charter licences still expire on 31 December whenever they're issued. Jennifer Malone of MYS USA described replacement crew being stopped at the airport over work permits. Donovan C. Walker of the Maritime Authority of Jamaica proposed a regional working group to align customs, immigration and compliance, and offered to host the first meeting.
AI came up early, in the fraud discussion. Michael Moore of Moore & Company, an attorney on the same panel, called wire fraud an epidemic in the industry, with one law firm losing US$17 million. He warned against confirming payments by voice alone: "AI has the ability to take a snippet of your voice and it just sounds just like you." His controls: call-back on a known number, multi-factor authentication and password-protected documents.
Crew welfare is getting harder. Gabriella Cramer of the Cayman Registry, moderating the crew panel, shared ISWAN helpline trends: mental health calls up just over half, bullying, harassment and discrimination calls up nearly 30%, and calls about finding the next job up 140%. On the new STCW training in personal safety and social responsibilities, in force since 1 January, Victoria Cinnante of Arrow Yacht asked for more than "receiving the certificate and uploading it and checking it."
The yacht as a power plant and a data centre
Kevin Frisch of Foster Garvey moderated Corey Ranslem of Dryad Global, Davide Di Biasi of RINA, Maxime Le Poupon of Bureau Veritas, Brandon Samuels of Manage My Vessel and Engel-Jan de Boer of Lloyd's Register. A superyacht, he said, is now a power plant and a data centre, with sensors on everything, "all important and all progress, but also all very, very messy."
Asked for the biggest problem of the next ten years:
- Engel-Jan de Boer: innovation, particularly AI, moving faster than the industry's ability to govern and safely operate complex systems.
- Corey Ranslem: technology capability doubling roughly every six months against an IMO moving "at a glacial pace", with business still being run over WhatsApp and Signal.
- Davide Di Biasi: AI as the main tool for managing energy as yachts move to batteries, hybrid propulsion and alternative fuels, with crew training making it work.
- Maxime Le Poupon: the IACS cyber requirements E26 and E27 as the bare minimum for a yacht's systems, even where they aren't mandatory, because segregating the network isn't enough.
Brandon Samuels described the scale of data already held: Manage My Vessel carries over 15,000 active crew and over 100,000 past ones, with certificates, non-conformities, incident reports, maintenance and payroll. He saw two risks: data left unread, and data connected to AI too loosely. Ownership, he said, usually sits with the subscribing company, and the harder part is which AI tools can reach the data. His advice was to bring AI into the system of truth first, the platform already permissioned by user roles, which he said answers around 90% of the questions. Once you use an outside AI system like Claude, ChatGPT or Grok, in his words, the data is "technically exposed".
Erik Speyer of Dryad Global said newer engines produce 150 to 200 data points a minute, which insurers, engineering firms and, as he put it, a hedge fund friend would all like to have. Kevin Frisch saw more value in uptime than in selling it: vibration data that flags a failing bearing in time to fix it in the yard period. He also showed what the data gives away: a yacht that usually cruises at eight knots and is running at nine tells an outsider the owner is on board.
Engel-Jan de Boer summed up: "Who generates the data? Who validates the data? Who owns the data? Who's liable for the data?" He had yet to see a clear accountability and governance model for any of it.
A bridge, an inbox and twenty people
An attorney working on the Dali litigation added a cautionary account. The container ship brought down Baltimore's Francis Scott Key Bridge in March 2024. As she described it, the ship had two blackouts the day before, the alerts went to an email address read by twenty or more people, and no one acted. In May 2026 the US Department of Justice indicted the managers, Synergy Marine and Synergy Maritime, and the ship's technical superintendent, on charges including failing to report a known hazardous condition. Synergy denies the charges, and the NTSB did not list the company or crew among the probable or contributing causes.
What I said
I wasn't on the panel, but I spoke twice. Some of the gentlemen speaking were doing my marketing for me.
Governance is a process for what data goes into an AI system, what stays out, who is looking at it, and which decisions your team makes and which the AI can make for them. The opportunity and the risk are equally heavy, and the opportunity is the exciting part: supercharging what you do and enabling the people who work for you. It feels like the internet arriving all over again, and the tools already on your laptop can do far more than many people realise.
The biggest gap is leadership. Without a lead from you, your staff will use personal ChatGPT accounts under the table, because they can't not use it. Abstinence doesn't work. Encourage the use, capture it and put a structure around it.
Your cyber habits count for more now. The week before the forum, the PHP2Shell vulnerability made the news: a flaw that sat in the software under most of the world's websites for about 14 years and took government sites offline in several countries. Researchers using AI found it, and AI helped build and check the fix within weeks. Attackers have the same tools, so start with the small habits, like not using your pet's name as a password for twenty years.
The panel said there's no good governance model for this yet. There is one: ISO/IEC 42001, the international standard for AI management systems. It can sit alongside the safety management systems you already run and the ISO 9001 quality systems many shipbuilders use.
Full report: ISO/IEC 42001 AI Management System Certification for Maritime Organisations. What the standard requires, how certification works, and where maritime stands.
Read the full ISO/IEC 42001 report →
The Panel's Recommendations
Kevin Frisch asked each panellist for one action:
- Get a vulnerability assessment for the business and the vessel, whatever the size (Corey Ranslem). He called them inexpensive, and the findings give your IT provider a work list.
- Read IACS E26 and E27 as the minimum for onboard systems, even where they aren't required (Maxime Le Poupon).
- Keep data internal and bring AI into your existing platforms first (Brandon Samuels).
- Work on it together (Engel-Jan de Boer and Maxime Le Poupon). The industry is too fragmented to solve this company by company, and shared experience, particularly of cyber incidents, is how others learn to respond.
Peter Southgate of the Cayman Registry, who chaired the day, closed by calling for a representative body for the whole industry, because without one the same problems return to these forums every year. Every seminar he had attended this year, he said, had AI on the programme.
Technically exposed, within parameters
Brandon Samuels is right that the data is "technically exposed", if you get technical about the words. Whichever provider you use, the company running the model can see what you send it, whether you use the provider directly or through an application with AI under the hood, because the same few models sit behind most of it. The exception is an open-source model you run yourself, which is technically heavy. What matters is the parameters around the exposure.
Privacy comes down to three parts:
- Model training: whether your data is used to train the model.
- Access and retention: who can see your data, and how long they keep it.
- Data residency: where your data is stored and processed.
The terms you're under set those parameters. The business and enterprise plans from OpenAI and Anthropic, and their APIs, don't train on your data by default and come with admin controls and data processing terms. Personal accounts run on the user's own settings: personal ChatGPT accounts share conversations for training by default until the user switches it off, and personal Claude accounts use them if the user has allowed it. That makes the personal account used under the table the weak point.
The same applies to every platform we already use. Some of the businesses I work with are wary of a business plan with an AI provider while using Dropbox's AI features, Microsoft email with Copilot built in, and crew management platforms holding certificates and passports that have added AI of their own. Those features commonly run on models from the same few providers, through the vendor's account. Look at Microsoft and where our information already lives: we're all exposing our data already, within parameters we're comfortable with. When AI comes inside a platform you already run, the vendor sets those terms, often without the business asking.
The governance questions are the same wherever the AI runs: what goes in, what stays out, who checks the output, and which decisions stay with a person. For built-in AI, put the three privacy questions to the vendor. An AI agent connected to your systems sees whatever its permissions allow, wherever it runs.
Final Thoughts
The data on board has always been there, in logs, reports, emails and sensors. AI makes it readable at speed, by the business and by anyone else who can reach it. The Dali inbox shows what happens when data exists and nobody is responsible for reading it. Whatever the court decides, that failure had no AI in it, and AI makes both the volume of data and the question of who reads it much larger.
Where I'd start:
- Find out where your data already goes. Ask each vendor which models their built-in AI uses, whether your data trains it, who can see it and for how long, and where it's processed.
- Write down your rules for AI use: what goes in, what stays out, who reviews the output and which decisions a person makes.
- Give your team approved tools on business terms, so under-the-table use comes into the open.
- Name the person responsible for reading the data, so an alert doesn't sit unread in an inbox shared by twenty people.
The answer to Engel-Jan de Boer's four questions starts inside each business, with a named person, a written process and the tools the team uses every day. The yachts and companies that put that in place now will be ready when the industry's rules catch up.
Kristina Agustin is the founder of Southern Sky AI, an AI strategy and deployment company for the superyacht and marine industry.
