
The twelve questions an AI use policy has to answer
July 17, 2026
What an insurer, auditor or client reads for in an AI use policy: twelve questions that test any draft, template-started or written from scratch, before someone asks to see it.
Industries · Owners' Representatives
The office sits in Raffles Place or Central, the vessel reports from the Mediterranean a month behind, and the AI questions arrive through the institutions around you: the banks and managers answering to their supervisor, the privacy checklist for the office, the diligence pack for the next allocation. One written position answers them across the programme.
The monthly pack arrives from the management company and you read it the way you read everything: actuals against budget, variances flagged, receipts on request. The portfolio side of your desk reports through a platform that reconciles overnight. The vessel reports through a PDF, a month behind, compiled by people you trust and cannot see.
Where are you based?
Where this sits for you
Somewhere between those two documents, AI arrived. The office uses it for research and reporting now, the crew polish owner letters with it, the charter side builds guest profiles from preference sheets that hold allergies, medications and children's names. Each use made sense to the person who started it. None of it was written down, and you are the person the next question reaches: the insurer's proposal form, the principal's quiet "are we exposed here", the family council's agenda item. A written position exists for exactly this. It starts with a five-minute reading.
On 13 November 2025 MAS issued a consultation on Guidelines on AI Risk Management, the AIRG, for all financial institutions: a comprehensive AI inventory, risk materiality assessments, life-cycle controls covering generative AI and AI agents, and explicit board and senior-management responsibility including sufficient AI literacy. An exempt family office is not the addressee; its banks, administrators and external managers are.
The Privacy Commissioner for Personal Data, Hong Kong's privacy regulator, published its checklist on staff use of generative AI on 31 March 2025: permissible use defined, authorised staff and devices, human review of outputs, incident reporting. An office holding crew records, guest preference sheets and principal data is the organisation it describes.
530 unique superyachts were active in Asia-Pacific across 2024, up from 372 in 2022, and 343 of them are owned by Asia-Pacific nationals, with more than 20 percent of the regional fleet over 50 metres against 16 percent worldwide. The asset base moved faster than the governance layer around it.
The broker's incentive ends at the sale, the yard's at delivery, the management company's at contract renewal. When a loss crosses one of those seams, each party's file shows their piece done, and the shortfall reaches the owner you answer to. Stitching the seams between those parties is the daily craft of the role.
Across the industry, refit projects routinely run 30 to 50 percent over first scope, milestone payments proceed against progress the owner cannot independently verify, and a competent rep's fee on a mid-size refit earns itself back through scope discipline alone. The fee stays defensible exactly as long as the variance stays contained.
A crewed 50-metre runs a dozen-plus employees, a seven-figure operating budget and regulatory exposure across flag, class and port states. A private company of that shape carries an auditor, delegated authorities and minuted decisions; the portfolio side of your desk reconciles overnight while the vessel reports by PDF, a month behind.
Forty-three percent of family offices experienced a cyberattack in the preceding one to two years surveyed, and class rules now require cyber security to be evidenced on new builds, which covers the hull and leaves the office, the crew's phones and the guest data where they were. The sector's own press now pairs cyber and AI governance as a single fiduciary agenda.
Reps are routinely engaged after the build contract is signed, inheriting terms they would have fought, and the role carries no protected title. You hold fiduciary-grade responsibility on a consultant's tenure, terminable at will, which is why the written record you build around the asset is also the record that protects you.
The Opportunity
The BNP Paribas and Campden Wealth Asia-Pacific Family Office Report 2025, covering 76 offices with an average of US$1.3 billion under management, finds offices already using AI for risk management and investment reporting and expecting adoption to accelerate, with spreadsheet over-reliance and manual processes now named as a top operational concern, ahead of cybersecurity. The tools are in the office already, and the junction between institutional portfolio reporting and PDF vessel reporting is where the programme's AI exposure sits unread.
Under a written position, governed AI does defined work across the programme you oversee and inside your own office, each task with a named human check. The same position answers the bank's diligence, the manager's questionnaire and the privacy checklist, in your terms rather than theirs, and files beside the documents the office already keeps.
Yard-invoice variance analysis
Across the program, AI reads a yard's variation orders and invoices against the build specification and flags the priced changes, which surfaces scope creep while it can still be challenged, and the rep confirms each flag before it goes to the yard.
Monthly pack consolidation
AI consolidates the management company's monthly statement into the format the office reads, actuals against budget with variances surfaced, which closes the gap with the overnight-reconciled portfolio side, and the director checks the figures against the source pack before filing.
Office research and reporting
In the office, AI drafts research notes and reporting narratives the way the family-office platforms already ship it, which speeds the desk work, and a named person reviews the output before it reaches the principal.
Insurer question sets
AI assembles the first draft of the written AI answers a PI or cyber renewal now asks for, which turns the proposal form into a starting point, and the rep confirms each answer reflects the program before submission.
Build correspondence
AI drafts routine correspondence in the information flow with the yard and the designer, which keeps the build paperwork moving, and the rep checks it against the delegated authority before it is sent.
These are the workflows the prompt library and the training stand up, under the standard the documents set.
Your World
Singapore's family-office surge
SGIndustry guides tracking disclosures by MAS, Singapore's financial regulator, put Singapore's single family offices at more than 2,000 awarded tax incentives as of 2024, up from fewer than 50 in 2018.
Mandatory screening since October 2024
SGFrom 1 October 2024 MAS requires every new 13O or 13U family-office incentive application to carry a screening report from an approved Screening Service Provider.
Hong Kong's family-office base
HKHong Kong's July 2025 Legislative Council reply cites around 2,700 single family offices operating as of end-2023, with family-owned investment holding vehicles managed by a single family office paying a 0% concessionary profits tax rate on qualifying transactions.
Refit overrun and the represented band
Refit projects routinely run 30 to 50 percent over original quoted scope, while well-represented projects land within 10 to 20 percent.
The 10 percent rule, and the real figure
The 10 percent of purchase price a year shorthand is obsolete at the top end, and practitioner benchmarks for a privately run 40 to 60 metre motor yacht cluster at 12 to 15 percent annually.
The YORP register and grandfathering
The Yacht Owner's Representative Register requires the full YORP or three-plus new-build projects over 30 metres, with grandfathering for experienced reps closing 30 June 2027.
Variation orders and milestone payments
In build or refit the week anchors on the variation-order queue, where each owner request and each yard discovery becomes a priced change to be challenged, negotiated or approved within delegated authority.
The monthly owner statement
The management company's monthly owner statement lands with actuals against budget, crew payroll, insurance, berthing and maintenance, with receipts available on request.
SPV ownership and the CSP
The vessel usually sits in a special purpose vehicle in an offshore registry such as Cayman, the Isle of Man, Jersey or Guernsey, with a corporate service provider administering the owning company and the family office holding the purse.
Family offices as cyber targets
Deloitte found 43 percent of family offices experienced a cyberattack in the preceding 12 to 24 months, rising to 62 percent above US$1 billion in assets.
Preference sheets and their data
Preference sheets hold allergies, medications and children's names, which makes them the most sensitive document afloat.
The seam problem
Governance of the asset is fragmented across broker, yard, manager and captain, and when a loss crosses a seam each file shows its piece done while the shortfall reaches the owner.
The global family-office map
Deloitte counts roughly 8,030 single family offices worldwide, 3,180 in North America and 2,020 in Europe, and the governance-gap conversation now runs through Family Wealth Report and Campden.
The back-door problem
Citi's 2026 paper puts family-office operational AI use at 22 percent and names the back-door problem, where AI arrives through the SaaS tools the office already runs.
Generative AI use tripling
USGenerative AI implementation in North American family offices roughly tripled year on year, reaching 29 percent using it for investment reporting and 30 percent for research.
SEC's 2026 AI exam priorities
USThe Division of Examinations of the US Securities and Exchange Commission, the federal markets regulator, released its FY2026 priorities on 17 November 2025: assessing whether firms hold adequate policies to supervise their use of AI, and reviewing registrants' representations about their AI capabilities.
Cyber cover tests AI answers
USTrade reporting from the June 2026 New York Family Office Cybersecurity Forum holds that over 40% of cyber claims are denied, with post-breach material misrepresentation the top projected denial reason for 2026.
Where to start
The AI position of the yacht you fund, read in about five minutes, filed as due diligence.
The written governance position across office, manager, vessel and project, built with you, adopted in your structures.
The standing instrument, one place the position lives and stays current, shown on request to principals, insurers and counsel.
The instrument commissioned for a management company or vessel underneath the program.
Documented Work
Reading

June 2026
What the frameworks say, how far they reach, and what organisations can do now.

2026
The AI management system standard, read for maritime operators.

July 17, 2026
What an insurer, auditor or client reads for in an AI use policy: twelve questions that test any draft, template-started or written from scratch, before someone asks to see it.

Written from inside your world
Kristina Agustin
Founder & Principal Digital Navigator, Southern Sky AI
20+ years in international superyacht and maritime operations. Legally trained (LLB, Graduate Diploma of Legal Practice). AI educator and consultant. ATSE Elevate Scholar 2026.
Start Here
Run the reading you would commission on any asset this size. Twenty plain questions, about five minutes, and the program's AI position comes back in four parts: the risks as they reach you, the regulations already in play, the cost of leaving use unmanaged, and the moves that matter most, ranked. The result files cleanly beside the budgets.
Get your baselineQuestions
The AI Baseline Report reads your position in about five minutes, and your answers pre-fill everything that follows.
Run the Baseline