AiatSea Analysis: Who Pays for the AI Your Staff Already Use?

There is a question every ship manager can answer today, without a consultant, a pilot or a steering committee, and almost nobody in this industry has been asked it: does your company buy AI tools for the people who work for you, or do they buy them for themselves? It sounds administrative. It is not. It is the single decision that determines where your commercial data physically ends up, whose name is on the contract governing it, and whether your staff are working with a tool you can see or one you cannot. And if you have not made this decision deliberately, it has already been made for you — not by your board and not by IT, but by a superintendent who was three hours behind on a defect report and found something that helped. Every maritime organisation is currently in one of four positions, and only two of them were chosen on purpose. Prohibited and enforced: a written ban with technical controls that actually block access. Legitimate, defensible, and requiring review every six months or it quietly becomes the next position. Undeclared and personal: no policy exists, so staff use whatever they like on accounts they pay for themselves, and the company holds no list of tools, no logs and no idea what has been entered. Tolerated but unfunded: management knows and does not object, but will not pay, so people stay on free and consumer tiers. Provisioned and governed: the company buys business accounts, assigns them to named staff, sets retention and access centrally, and states in writing what may and may not be entered. The two middle positions are not compromises between prohibition and adoption. They are the worst available, because they carry the full data exposure of adoption while capturing none of the organisational benefit — and refusing to spend twenty or thirty dollars a month per head is precisely what pushes your people onto the tier with the weakest data commitments. When the employee leaves, the workflow leaves with them. What actually leaves the building depends entirely on which tier the account sits on. Four questions decide it, and they have different answers on a consumer account than a business one: is the content used to improve the provider's models, historically most likely on free and consumer tiers and generally excluded by contract on business and enterprise ones; how long is it retained and who can see it, noting that a personal account is somewhere your company has no right of access to, and neither does your lawyer; which jurisdiction processes it, which for a European operator handling seafarer personal data is not a technical footnote but the difference between compliance and a notifiable problem; and who signed the agreement, because on a personal account the contract is between the provider and your employee, and your company is not a party to it. Provider terms change several times a year and differ between vendors and between tiers of the same vendor, so none of that should be taken as a statement about a specific product today. The correct action is to open the terms for the exact tier your staff are actually logged into and read the sections on training, retention and processing location. If nobody in your company has done that, that is itself the finding. And then there is the half of the industry nobody is discussing. Almost every conversation about workplace AI in shipping is a conversation about shore staff. Connectivity onboard has changed faster than policy has: a ship with modern satellite broadband reaches the same assistants a Copenhagen office does. So does a chief engineer diagnosing an unfamiliar fault, a master drafting a note of protest, a cadet studying for an exam. All of them have a use case. Almost none of them have a company account. The predictable result is seafarers using personal accounts on personal devices over welfare bandwidth to do company work — shadow AI with a maritime accent, and carrying the additional problem that the data involved is often crew personal data. Why this matters more than the adoption statistics: telling staff to be careful with confidential information is not a policy. It transfers a judgement the company should have made onto an individual who has neither the information nor the authority to make it. Expecting a superintendent to correctly assess data residency law, provider training terms and client confidentiality obligations before pasting a paragraph is not a reasonable expectation. A usable rule fits on one page and names categories rather than principles: what is generally fine, such as published regulation and general technical questions with no vessel identified; what belongs on a company account only, such as internal correspondence, vessel performance data and anything naming a client or a specific ship; and what goes nowhere at all, such as crew medical and passport details, signed charterparties and negotiated rates, and anything touching a live casualty, dispute or claim. What to do now: answer five questions in writing this month. Do we provide AI tools to shore staff, and to whom exactly? Do we provide them to crew, and if not, is that a decision or an oversight? If people use personal accounts, do we know and have we actually accepted it? Has anyone read the terms of the tier our people are on, rather than the enterprise page on the vendor's website? And could a new joiner find our policy in under a minute — tested with a real new joiner? So we are going to find out what the answers look like across the industry. We are running a short survey of AiatSea readers, ashore and at sea, on who holds the account, who pays, whether anyone told you what is safe to share, and what you have actually pasted into a chat window in the last month. Six questions, two minutes, fully anonymous, and you can take it at aiatsea.com/survey. We will publish the aggregate free and ungated. The honest caveat, applied to ourselves: a self-selecting survey of a maritime AI newsletter's readership will over-represent people already interested in AI, and we will say so plainly when we publish. It will not be representative of the industry. It will, however, be more than currently exists — because every published figure counts organisations, and not one of them tells you who is holding the account. [AiatSea, 26 July · AiatSea, 12 July · AiatSea, 25 January]

This story is part of the Maritime AI Digest of 9 August 2026.

More on: Crew and new systems · EU AI Act and liability