
The twelve questions an AI use policy has to answer
July 17, 2026
What an insurer, auditor or client reads for in an AI use policy: twelve questions that test any draft, template-started or written from scratch, before someone asks to see it.
Industries · Yacht Management
The London insurance market has published its AI questions, MCA cyber inspections reach IT-connected systems, and UK GDPR sits over every crew and owner file. What AI is already doing across the office and the fleet, the UK layer that reaches it, and one written standard that answers each desk in turn.
Ten vessels, ten owners, ten flags, and one management contract with your name on its pages. The standards you run were adopted the hard way: drafted once at the office, then walked through ten budget cycles, ten owners' reps, ten flag interpretations. Now AI has arrived the way weather arrives, quietly and then all at once.
Where this sits for you
An owner report summarised before it went out. A contract clause pasted into a chatbot for a plain-English read, and ten crews each carrying their own informal practice. You can produce any certificate for any vessel in ninety seconds; ask about AI use across the fleet and the register is empty. The instinct that built your safety system covers this too: one written standard, held by the management company, adopted vessel by vessel, with a named check before anything AI-assisted reaches an owner, a flag state or an insurer. It starts with knowing your position.
The Lloyd's Market Association has published example AI question sets for underwriters and PI insurers, and 93 percent of surveyed Lloyd's managing agents writing over 60 percent of stamp capacity run or are building formal AI governance frameworks. The questions arrive through the office's own professional indemnity, E&O and cyber covers first, and a written position is what answers them without a scramble.
MGN 669 gives the MCA discretion to inspect a vessel's cyber security management, with IT-connected operational technology in scope. For a management office running Red Ensign hulls, that discretion sits over the AI tools bundled into planned maintenance systems, remote diagnostics and vessel platforms as much as over the office's own drafting tools.
Seafarer employment agreements, medicals, payroll, next-of-kin and owner correspondence are personal data under UK GDPR, and elements of the medical and welfare file are special-category data under Article 9, with no small-office exemption. The DUAA rewrote the automated-decision rules from 5 February 2026 and asks for safeguards the office can show. The Fleet Framework and per-vessel registers are those safeguards on paper.
Nearly every hull you manage sits inside its own single-purpose owning company, with its own directors, flag, insurers and owner's rep. Your DOC is company-level and your procedures are company-authored, so fleet-wide policy gets drafted once, then sold, adapted and adopted vessel by vessel, because no fleet-wide budget line exists to carry it.
The DPA function concentrates personal, round-the-clock liability, with escalation chains auditors expect to see functioning under pressure. Paris MoU detentions rose to a 4.18 percent rate in 2025, and the top deficiency categories are exactly the files the management office owns. Cyber risk already sits inside the audited SMS under MSC.428(98), which is also the natural docking point for a written AI position.
An average yacht replaces 5.6 junior crew a year at €10,000 to €20,000 per departure, and a crew change is a management-office event: the SEA under the flag's law, STCW verification, medicals, and payroll that answers to the flag, the governing law, the vessel's location and the seafarer's nationality at once. Turnover also un-teaches whatever the last training taught.
Crew takes 30 to 40 percent of a vessel's running cost; management fees take 3 to 5. You administer the entire budget while earning the smallest visible line on it, and the family office reads the report you wrote about the money you approved. Every owner report is an invitation to challenge a line.
Certificates live on personal laptops, WhatsApp swallows tasks, spreadsheets carry core processes, and the monthly owner PDF is assembled by hand from all of it. Multiply by ten vessels, each with a stack its own captain chose, and the office's systems sit on top of ten inconsistent ones below.
Your World
Lloyd's market builds AI governance
UKAn LMA survey published April 2026 (39 firms, over 60% of Lloyd's stamp capacity) found 93% of responding firms have or are developing formal AI governance frameworks, with over 60% mandating human review of AI outputs.
The separately-owned fleet
Nearly all superyachts are held inside single-purpose SPVs, so there is no fleet-wide invoice and each vessel's spend is approved inside its own budget.
The DPA function
The DPA is the link between company and vessel for safety and pollution prevention, contactable around the clock, with escalation chains an auditor tests.
Cyber inside the SMS
Since MSC.428(98) cyber risk sits inside the audited SMS, and flags now require cybersecurity policies and drills there, which is the natural docking point for AI risk.
SEAs at a flag change
A flag change means the seafarer employment agreement is reissued to comply with the new flag state while the crew work under the cruising area's local law.
Audit evidence files
Hours of rest, non-conformity reports and class survey windows are the files the DPA closes out and an auditor expects to see functioning.
WhatsApp as ops channel
WhatsApp is the industry's unofficial operations channel, where tasks disappear into an operational black hole across a fleet of separately-run vessels.
The IYC benchmark
IYC's public claim that its AI turns 30 hours of human work into one minute is the efficiency standard the industry has set itself, named here as the bar rather than a promise.
The Opportunity
UK yacht management is where the London insurance market and the Red Ensign flag meet on one desk. The office work reads the same as anywhere: owner reports across currencies, plain-English clause reads, one standard adapted per vessel, a named check before AI-assisted material reaches an owner, a flag state or an insurer. The UK addition is that the paperwork already has readers, the LMA has published the AI questions its underwriters and PI insurers now ask, and 93 percent of surveyed Lloyd's managing agents run or are building formal AI governance frameworks. There is no UK AI Act, and none is scheduled; the UK regulates AI through existing law applied by existing regulators, and UK GDPR, the DUAA's automated-decision rules from February 2026 and the ICO's AI guidance are what reach the office today. A Fleet Framework at company level and per-vessel registers underneath it give one document the office can put in front of the flag, the insurer and the owner's rep alike.
Owner reports and reconciliation
The month-end owner report, assembled by hand from hundreds of transactions across currencies, gets drafted and summarised in a fraction of the time, with the manager checking the figures against the source before it reaches the family office.
Contract plain-English reads
A MYBA charter clause pasted for a plain-English read gets explained in minutes, with the manager confirming the reading against the contract before acting on it and keeping owner detail out of any public tool.
Per-vessel policy adaptation
A standard drafted once at the office gets adapted to each vessel's flag and owner in far less time than a manual rewrite, with the manager approving each version before it is adopted aboard.
SEA and crew admin
Seafarer employment agreements reissued at a flag change, and the crew correspondence around them, get drafted against the new flag's requirements, with a person checking the terms before issue.
Audit evidence and NCR close-out
Near-miss reports, internal audit findings and the evidence an auditor expects get drafted and organised for the DPA, with the DPA reviewing each item before it stands as a record.
Crew induction material
Induction notes that carry the AI standard to a new crew get drafted for each vessel, with the manager approving them so the standard survives the turnover.
These are the workflows the prompt library and the training days stand up, under the standard the Fleet Framework and the per-vessel register set.
Where to start
The management company reads its own position in about five minutes.
The fleet engagement: AI-use audit across vessels, risk classification, the manager-owned Fleet Framework and the adoption sequence.
The per-vessel instrument underneath it, purchased by each vessel in its own name through its own budget: the AI position, approved-tools register and review step adopted inside each vessel's system, with a prompt library that starts the vessel's first governed workflow, 90 days of crew education, a recorded briefing, a 30-minute walkthrough call and 30 days of email support. USD $690 per vessel for the founding twenty, then USD $990.
The position stays aligned between audit windows.
Crews inherit the standard through induction, with verifiable certificates.
The fleet's governance home that survives crew changes.
Documented Work

5-month prototype · 85% extraction precision · Unexpected findings in source documents · Global vessel operator platform
Built and tested across a five-month prototype period, the system achieved 85% extraction precision on unstructured OEM documents with no standard format, and consistently surfaced critical information that experienced human reviewers had not found in the same source material.
Read full engagement
Small team · Multiple organisations · 7 recurring operational themes · 10 strategic goals mapped · Foundational recommendations implemented
Seven recurring operational themes identified consistently across every organisation in a multi-organisation maritime portfolio, addressed through a phased roadmap covering 10 strategic goals across two solution streams: workflow automation and AI-powered support.
Read full engagementReading

June 2026
What the frameworks say, how far they reach, and what organisations can do now.

2026
The AI management system standard, read for maritime operators.

July 17, 2026
What an insurer, auditor or client reads for in an AI use policy: twelve questions that test any draft, template-started or written from scratch, before someone asks to see it.

Written from inside your world
Kristina Agustin
Founder & Principal Digital Navigator, Southern Sky AI
20+ years in international superyacht and maritime operations. Legally trained (LLB, Graduate Diploma of Legal Practice). AI educator and consultant. ATSE Elevate Scholar 2026.
Start Here
Read your position in about five minutes. Twenty plain questions in, four readings back: the AI risks as they reach your fleet, the regulations that already apply, the cost of leaving use unmanaged, and the moves that matter most, ranked from the top.
Get your baselineQuestions
The AI Baseline Report reads your position in about five minutes, and your answers pre-fill everything that follows.
Run the Baseline