Source: EJIL: Talk!

On 1 July 2026 the IMO’s non-mandatory International Code of Safety for Maritime Autonomous Surface Ships (MASS) took effect, and maritime autonomous surface ships begin to rely on streamed data to remote operations centres (ROCs). The post argues that a flag State cannot satisfy its Article 94 UNCLOS due diligence obligation solely through a private-law contract with the company holding ROC or cloud data; rather, the flag State must be able to expect access to logged data and that expectation can only be secured through public international-law agreements. MASS data crucial for monitoring and investigation includes video feeds, radar, GNSS/location data, maintenance records, and remote operator command logs—information the flag State needs to monitor compliance, investigate incidents, and enforce measures.

Article 94’s due diligence obligation is framed as an obligation of conduct requiring regulatory control, oversight, and enforcement; the MASS Code suggests linking certificate issuance to administrative access to logged data (MASS Code, para 9.10.5), but certificate revocation alone does not confer investigatory powers. The post highlights unresolved jurisdiction over server-stored data, identifying two camps: territorial data-localization rules (for example, China) and service-provider jurisdiction rules (for example, the United States’ CLOUD Act), neither of which grants third-party access to a flag State. Cross-border transfers typically rely on mutual legal assistance treaties and domestic legal processes, which can be slow and limited by laws such as the EU Data Act and GDPR; the author therefore contends that a treaty between the flag State and the State exercising jurisdiction over the servers is necessary to create a reliable expectation of access and thereby enable the flag State to meet its Article 94 due diligence obligation.