On 1 July 2026, the IMO’s non-mandatory International Code of Safety for Maritime Autonomous Surface Ships took effect. The Code provides guidelines for maritime autonomous surface ships (MASS), or ships that, to various extents, operate independently of direct human control and are overseen or remotely controlled by humans in remote operations centres (ROCs), where the data, such as video feeds, radar, and GNSS, is projected on a screen, much like in a video game. In its wake, one of the larger questions left looming has to do with jurisdiction over that data, so vital to MASS, and to what extent the flag State must control it to meet its international legal obligations. This post argues that a flag State cannot fulfill its Article 94 UNCLOS due diligence obligation through only a private law contract with the company holding the data. Instead, it must be able to expect access to the data, which can only be achieved using public international law agreements.
Due Diligence under Article 94 UNCLOS
Under Article 94 of UNCLOS every State must “effectively exercise its jurisdiction and control in administrative, technical and social matters” over ships flying its flag. According to the SRFC Advisory Opinion, this is a due diligence obligation, meaning it is an obligation of conduct, not result. A flag State must “do its utmost” to maintain its effective jurisdiction and control over its ship (Area Advisory Opinion, para 110; as applied to flag States specifically in SRFC Advisory Opinion, para 128). Maintaining due diligence in ensuring effective control and jurisdiction over the ship, according to the Pulp Mills Case (para 197), and as referred to in the SRFC Advisory Opinion (para 131), “entails not only the adoption of appropriate rules and measures, but also a certain level of vigilance in their enforcement and the exercise of administrative control applicable to public and private operators, such as the monitoring of activities undertaken by such operators, to safeguard the rights of the other party.” To simplify for the purposes of this argument, it could be said Article 94 includes three parts within this due diligence obligation: the flag State must establish regulatory control, maintain oversight, and exercise enforcement measures. A flag State must do its utmost to fulfill all three parts to satisfy the Article 94 obligation.
Since data will be streamed from the physical ship to the remote operations centre, it must necessarily traverse cyberspace, often via satellite, but with the data saved in the cloud for future reference. In reality, of course, “the cloud” is actually physical servers that store the data for access by the remote operators. The monitoring of compliance and purposeful exercising of enforcement can only occur if the flag State has access to the data located on the servers. Monitoring compliance requires the flag State to ensure the ship is following the laws it has set out. It can only do so if it is able to access the ship’s information, including, for example, location data, maintenance information, and remote operator command logs. No inspection or audit would be complete without such information. Should there be an error or an accident, the flag State would further require the data for investigation and enforcement. In essence, if the flag State does not have access to a ship’s data, including video feeds, ship location, audit logs, and the like, it cannot effectively monitor compliance and exact enforcement.
The MASS Code
The MASS Code suggests fulfilling this obligation by hinging the issuance of MASS certificates by the flag State “Administration” on the ability of the Administration to have access to any logged data (MASS Code, para 9.10.5). Enforcement of this would be based on the revocation of the certificate. While this revocation is an option for the flag State, it is an unnuanced one. It does not confer any monitoring or investigation powers. In the case of an incident, the flag State must investigate (as required by, for example, UNCLOS art 94(7)) and it cannot do so without the fundamental data, such as the ship’s location or remote operator data.
Moreover, the data required for MASS is large and therefore requires large-scale server infrastructure. Such infrastructure is neither present in each State nor available cheaply. It is therefore unlikely that the ROC-company will be responsible for its servers and instead will farm that responsibility out to yet another company, in yet another State, with its own laws. Problematically, however, the flag State cannot expect access to the data located on servers, outside the flag State’s territory. In fact, there may even be some national legal obstacles that make this particularly difficult.
Cross-Border Data Sharing
Who has jurisdiction over data on servers is not internationally agreed; however, there are two overarching camps. On the one hand, some States use their territorial jurisdiction to exercise jurisdiction over servers. For example, China requires certain categories of data to be stored exclusively in China, so that it may easily access the data (Cybersecurity Law, art 39). Other States determine jurisdiction based on the jurisdiction over the service provider, irrespective of the physical location of the data. The best example of this is the United States, which, through its CLOUD Act, can request data from companies over which it has jurisdiction, even if that data is located on a server in a different State. For example, Microsoft may be required to hand over data, even if it is on a server in Ireland. Neither camp provides any jurisdiction for a third party, such as a flag State. Instead, under the current system, a flag State would need to request the data from the State claiming jurisdiction.
The transfer of data is usually done through international agreements, such as mutual legal assistance treaties. States can request the data from another, which then must go through its internal legal process, after which it can be sent to the requesting State. Therefore, this process can take a long time. Currently, national laws may disallow the sharing of data or hamper the transfer. For example, China does not allow data stored in China to be shared with a foreign authority without its explicit prior approval. Other jurisdictions, such as the EU, have strict regulations about the sharing of data with another State, that require prior agreements between the States or that may allow ad hoc one-time transfers, in certain circumstances, subject to extensive limitations, especially in the case of personal data (Data Act, art 32(1, 2, 4) and GDPR, art 48).
To fulfill its Article 94 obligation, a flag State must be able to effectively monitor compliance and exact enforcement measures over its ship. Even the most lenient interpretation of monitoring compliance requires a periodic review of the ship’s performance, requiring flag State access to its ship’s data. If it cannot expect such access, it cannot have fulfilled the due diligence requirement. In order to fulfill the obligation, the flag State must do its utmost to ensure that, after the registration of MASS, it has the ability to ensure compliance and enact enforcement measures over the ship. To achieve this, the flag State does not necessarily need jurisdiction over the server. It can fulfill its obligation with access to the data; however, the flag State must be seen to have worked vigilantly and do its utmost to expect access, through a predetermined agreement, which allows its simple and efficient transfer of the data.
Expecting access means that there is a framework through which a flag State can obtain the required data. Such a framework must be based in public law, between States, rather than a private law contract. A contractual relationship alone between the flag State and the company holding the data does not remove the national legal obstacles that a flag State would face when it requests access to the data. Indeed, the aforementioned national data laws will remain burdensome and would slow the transfer of data. As mentioned before, a State should be able to access the data to ensure compliance and exact enforcement. In the past, this could be done by boarding a ship and investigating. With data, boarding would no longer yield the same result. What is instead necessary to ensure such a flag State can have the expectation of access to the data it needs to maintain a vigilant eye over its ship is a treaty between the flag State and the State with jurisdiction over the servers to allow for the transfer of the data. Such a treaty would make it likely that the flag State is able to access the necessary data. Importantly, because Article 94 is an obligation of conduct, it is not necessary that the flag State will, in the end, access the data but it should, after the point of registration, be able to assume, with a great degree of certainty, this ability.