Autonomous Ships (MASS): The Regulatory State

A ship with no one aboard is not a technology problem first. It is a definitions problem. The sensors that let a hull see other traffic, the software that plans a course, the satellite link that carries control to a desk ashore: those exist and run on real ships today. What does not yet exist, in settled global law, is an answer to a flat question the conventions never had to ask. When the rule says the master shall, and there is no master aboard, who is the master? This article is the hub for the autonomous-ships cluster. It sets out what a Maritime Autonomous Surface Ship is, the four degrees of autonomy the IMO uses to talk about them, the regulatory work that has and has not been finished, and the legal gaps that decide whether a given ship can actually sail uncrewed. Two calculators sit under it: the MASS time-to-collision calculator frames the core collision-avoidance metric a perception system has to act on, and the DP station-keeping footprint calculator covers the position-holding envelope that remote and autonomous offshore units depend on.

The term has a precise home. MASS, Maritime Autonomous Surface Ship, is the IMO’s working definition: a ship which, to a varying degree, can operate independent of human interaction. The phrase “to a varying degree” carries the whole subject, because there is no single thing called an autonomous ship. There is a spectrum running from a conventional ship with better decision support at one end to a ship that sails itself with no human in the loop at the other, and almost every real project sits somewhere in the middle and moves along the line on a single voyage. Holding that spectrum in mind is the first step, because a claim that “autonomous ships are legal” or “autonomous ships are banned” is meaningless until you say which degree, which ship, and which flag.

The four degrees of autonomy

The IMO Maritime Safety Committee (MSC) needed a shared vocabulary before it could analyze anything, so it set out four degrees of autonomy for the purpose of the regulatory scoping exercise. They are descriptive categories, not a certification ladder and not mutually exclusive: the MSC noted that a ship could operate at one or more degrees during a single voyage, switching as conditions and the route demand. The four degrees are the spine of every later document, including the MASS Code work, so they are worth stating exactly.

The jump that matters most is between Degree Two and Degree Three, because that is where the human leaves the hull. At Degree One and Degree Two there are still seafarers aboard who can override the automation or take the helm; the legal person of the master and crew is physically present, and the conventions that assume a crew still have someone to attach to. At Degree Three the ship is controlled from a desk ashore with nobody aboard, and at Degree Four no human is controlling it in real time at all. Every hard legal question, the lookout, the manning, the meaning of master, lives on the far side of that line. The technology to run a ship from ashore is in service; the law that lets a commercial ship cross oceans with an empty bridge is not.

The degrees are deliberately coarse. They do not say how good the automation is, only who is in control and where they sit. A Degree One ship with poor decision support and a Degree One ship with sensor fusion that out-detects any human watch are both Degree One, because in both cases a crew is aboard and responsible. That is why class societies built finer schemes on top: DNV’s Autonomous and Remotely Operated Ships (AROS) notations, available from 1 January 2025 and built on the DNV-CG-0264 guideline first issued in 2018, split autonomy by function (navigation, engineering, operational, safety), by category (remote control, decision support, supervised autonomy, full autonomy), and by where control sits (on board, off-ship, or hybrid). The IMO degrees answer “is a human in control and where”; the class notations answer “of which function, and how good.” Both are needed, and the cluster’s smart shipping and autonomy overview puts the wider digital-ship context around them.

The regulatory scoping exercise

Before writing any new rule, the IMO did the unglamorous part: it read its own rulebook against MASS. The MSC ran a regulatory scoping exercise (RSE) to work through the safety treaties and find where they help, hinder, or simply do not apply to autonomous and remote operation. The Committee completed the safety-side RSE at its 103rd session in May 2021 and issued the outcome as MSC.1/Circ.1638, with the Legal Committee and the Facilitation Committee completing their parallel exercises on liability and on facilitation of traffic. So the scoping work spanned three IMO committees, and the safety conclusions came out of MSC 103/104 in 2021.

The method was a sort over each instrument’s provisions. For SOLAS, COLREG, the STCW Convention, the Load Lines Convention, the Tonnage Convention, and the rest, each relevant provision was placed against four options: it can be addressed by equivalences or by developing interpretations; it needs amending; it needs a new instrument; or none of those applies after the analysis. The output was not a regulation. It was a map of where the existing conventions break, or hold, when you take the crew off the ship.

The map kept pointing at the same few places. The RSE flagged a set of high-priority issues, starting with an internationally agreed definition of MASS itself, and then the undefined terms for an uncrewed ship: master, crew, and the idea of a responsible person carry duties the conventions assume a human aboard will discharge. It flagged provisions written for manual operation and for crew response to alarms, which have no clear meaning when no one is aboard to turn a valve or answer a bell. It flagged the watchkeeping and lookout requirements, which assume eyes and ears on a bridge. And it flagged the qualification and certification of a remote operator, who is neither a conventional seafarer under STCW nor an unregulated bystander. The RSE’s recommendation was that the cleanest way to resolve all of this was a dedicated instrument rather than patching dozens of conventions piecemeal: the MASS Code.

The MASS Code pathway

The IMO chose to build a goal-based MASS Code in two stages, and it is worth being precise about where that work stands, because the dates have moved. A goal-based code sets the safety, security, and environmental outcomes a ship must achieve and leaves the means to the designer, rather than prescribing specific equipment; the IMO used the same model for the Polar Code and the IGF Code. The first stage is a non-mandatory MASS Code: guidance a flag state may choose to apply. The IMO adopted that non-mandatory Code, and it takes effect from 1 July 2026, applying to cargo ships under SOLAS. As guidance it compels no one, but it gives flag states, class societies, and developers a single agreed reference for what a remotely controlled or autonomous ship should be designed and operated to achieve.

The second stage is a mandatory MASS Code, and here the schedule is a roadmap, not a fixed law. The plan is to build the mandatory Code on the non-mandatory one plus the lessons from an experience-building phase, with the sub-committees reviewing the detail and SOLAS amended (a likely new chapter) to give the Code legal force. The current target is adoption of the mandatory Code by 1 July 2030 at the latest, for entry into force on 1 January 2032. Those dates supersede an earlier, now-superseded published target of around 1 January 2028 for mandatory-Code entry into force, which is a useful reminder that this is a developing program: the MSC revised its own roadmap as the work proved larger than first scoped, so any single date here is the plan as it stands, not a settled deadline. Anyone planning a MASS project against these dates should check the current MSC outcome rather than rely on a figure that may have shifted again.

The experience-building phase (EBP) sits between the two Codes and does real work. Its job is to gather operational data and safety lessons from actual MASS operation under the non-mandatory Code, so the mandatory Code is written against evidence rather than only against analysis. The MSC plans to develop the EBP framework after the non-mandatory Code takes effect and to begin developing the mandatory Code on the back of it. The gap between the 2026 voluntary Code and the 2032 target for the mandatory one is not idle time; it is the window in which the industry is meant to prove the concepts the mandatory Code will then require.

The dates are scattered across the IMO’s session record, so the milestones are easier to read in one place. The table below collects them, with the status of each so the superseded figure is not mistaken for a live one.

The MSC sessions that built the Code

The MASS Code was not written in one sitting; it was assembled session by session at the Maritime Safety Committee across several years, and the session numbers are worth holding because they are how the IMO records what was decided when. The scoping exercise finished at MSC 103 in May 2021. The Code-development work then ran forward through the sessions that followed, with the MSC and the joint MSC-LEG-FAL working group taking the draft Code chapter by chapter, agreeing and revising the road map more than once as the scope grew. The Committee worked the draft through the sessions across 2022 to 2025 (MSC 105 onward), using a correspondence group and the joint working group between sessions to draft the text that each MSC then reviewed.

That session-by-session record is why dates in this field have to be read carefully. The road map the Committee published at one session was revised at a later one, which is how the mandatory Code’s entry-into-force target moved from an earlier figure to the current 1 January 2032. Each shift was a decision recorded in a session outcome, not a slippage in the abstract, so the reliable way to state the current position is to cite the latest MSC session rather than a date remembered from an earlier one. The non-mandatory Code’s adoption and its 1 July 2026 effect date, and the mandatory-Code roadmap behind it, are the output of that multi-session process, and the next sessions carry the experience-building-phase framework and the start of the mandatory-Code drafting.

What the MASS Code actually covers

The Code is not a thin set of principles. It is structured as a full code, chapter by chapter, against the same subject areas SOLAS covers for a conventional ship, with extra chapters for the things only a MASS has. The scope is set against SOLAS Chapter I and applies to cargo ships, and a MASS still has to comply with SOLAS and the other applicable mandatory instruments; the Code adds the MASS-specific layer rather than replacing the existing regime. Reading the chapter list is the fastest way to see what regulating an autonomous ship actually means, because it shows where the conventional rulebook needed a new answer.

The chapters of the draft Code run across surveys and certificates, the approval process, risk assessment, operational context, system design, software principles, management of safe operations, alert management, manning, training and watchkeeping, safety of navigation, connectivity, remote operations, structure and stability, fire protection, maritime security, search and rescue, carriage of cargoes, anchoring, towing and mooring, and machinery and electrical installations. The familiar SOLAS subjects (structure, stability, fire, machinery) are there because a MASS is still a ship and still has to float, resist fire, and carry cargo safely. The new subjects are the ones a crewed ship never needed: software principles, because the autonomy is software and the software has to be developed and verified to a standard; alert management, because there is no one aboard to hear an alarm; connectivity, because the control link is now a safety system; and remote operations, because the bridge has moved ashore. Those four chapters are where the MASS Code does work no existing convention does.

The Code is goal-based throughout, which has a practical consequence for a developer. Rather than “fit this equipment,” it says “achieve this outcome,” and the developer demonstrates the outcome through the approval process and the risk assessment chapters. That suits a field where the technology is moving and no regulator wants to freeze a specific sensor or algorithm into law, but it puts the burden on the risk assessment: the developer has to show that the chosen design meets the goal, and the flag state and class society have to be satisfied it does. The same goal-based logic underlies why the four IMO degrees stay coarse and the class notations get specific; the Code sets goals, and the AROS-style notations and the approval evidence prove a particular ship meets them.

MASS trials and MSC.1/Circ.1604

Long before any Code, developers needed a way to test autonomous and remote systems on real ships. The IMO answer is MSC.1/Circ.1604, the interim guidelines for MASS trials, approved at MSC 101 in June 2019. A trial is how a system gets validated at sea while the settled regulation is still years off, and the circular sets the conditions so a trial does not become a hole in the safety regime. The guiding principle is equivalence: a trial should be conducted to provide at least the same degree of safety, security, and protection of the environment as the relevant instruments. A trial is allowed to do something new; it is not allowed to be less safe than a conventional operation while doing it. Keep the two circulars apart: MSC.1/Circ.1604 governs trials, while MSC.1/Circ.1638, two years later, is the outcome of the scoping exercise.

The circular’s conditions are practical. A risk assessment should be carried out before the trial. Everyone involved, including any remote operators and the personnel in a remote operation center, should be appropriately qualified for the trial they are running. Cyber risk management should be in place, because a remote-controlled ship is only as safe as the link and the systems behind it. And the trial runs under the authority of the flag state, with the existing conventions still in force; the guidelines do not override SOLAS or COLREG, they sit alongside them. So a developer running a Degree Three trial today is not operating in a legal vacuum. They are operating under flag-state approval, against MSC.1/Circ.1604, with the full weight of the existing conventions still applying to the parts the trial does not change.

The technology stack a MASS depends on

The autonomy lives in a chain, and the chain is only as strong as its weakest link. It starts with situational awareness: the ship has to build a picture of what is around it from radar, AIS, cameras (visible and infrared), and sometimes lidar, then fuse those feeds into one consistent model of nearby traffic and hazards. Sensor fusion is the hard part, because each sensor lies in a different way, radar clutters in rain, cameras blind in glare, AIS misses targets that are not transmitting, and the system has to reconcile them into a single trustworthy track picture good enough to act on. A human lookout does this reconciliation without thinking; a machine has to be engineered to do it and validated to prove it does.

From the picture comes the decision: collision avoidance. The system has to detect a developing close-quarters situation and act in time, and the metric it acts on is time and distance to the nearest approach. The MASS time-to-collision calculator works the core figure, the time to closest point of approach, that a perception-and-planning stack has to compute continuously for every target. The harder layer is that the action has to comply with the International Regulations for Preventing Collisions at Sea (COLREG). COLREG is written in judgment-laden language: a give-way vessel shall, so far as possible, take early and substantial action to keep well clear; action shall be positive, made in ample time, and with due regard to good seamanship. Encoding “good seamanship” and “ample time” into deterministic software, in a way that other ships’ human watchkeepers can read and predict, is one of the open technical problems of MASS, and it is why COLREG interpretation appears in every regulatory list of gaps.

The control side adds the remote operation center and the remote operator. For a Degree Two or Degree Three ship, a person ashore monitors and can take control, working from a desk that recreates the bridge through screens and a control link. That desk depends entirely on connectivity: a satellite link with enough bandwidth and low enough latency to carry sensor feeds out and control commands back, with no gap that leaves the ship blind or the operator’s commands stale. Connectivity dependence is structural, not incidental; if the link drops, a Degree Three ship needs a safe fallback (hold position, slow down, or run a pre-planned safe action) because there is no one aboard to take over. The cluster’s satellite communication and vessel tracking hub covers the link itself, the satellite constellations and the tracking that a remote operation depends on.

That same link is the attack surface. A ship controlled from ashore over a network is exposed to cyber attack in a way a ship steered by a hand on a wheel is not: spoof the position feed, jam the control link, or compromise the shore center, and you have compromised the ship. The IMO’s own trial guidance calls out cyber risk management for exactly this reason, and the broader treatment of the threat lives in the maritime cyber security article. The honest summary of the stack is that the technology mostly exists, in pieces, in service; what is hard is making the whole chain dependable enough, and provable enough, that a regulator will let it carry cargo across an ocean with no one aboard.

The remote operation center

The bridge does not vanish when a ship goes uncrewed; it moves ashore, and the place it moves to is the remote operation center, written ROC in the IMO drafting. The MASS Code gives the ROC its own treatment because it is now a safety-critical part of the ship system, not a back office. A ROC houses the remote operators and, on the Code’s current thinking, the human master who is responsible for the ship, working from consoles that reconstruct the conning, navigation, and machinery picture from the live sensor and system feeds. The design questions are exactly the human-factors questions a real bridge has, moved to a desk: how the operator keeps situational awareness off a screen, how an alarm reaches the right person, how control hands over cleanly between automation and operator, and how the operator picks the right ship when one center oversees several hulls.

The certification of the people in the ROC is an open structural problem, and the Code has to solve it because nothing else does. STCW certificates seafarers for watches on board; when the master and operators sit in a ROC and not on a ship, STCW as written does not reach them, so the MASS Code’s manning, training and watchkeeping chapter has to set the training, certification, and competency requirements for remote operators itself. That is a genuine change: the qualification of the person controlling the ship moves out of the seafarer-certification convention and into the Code, which is why the remote-operator definition was one of the recurring items the joint working group put on its living-document table of issues to resolve.

The ROC also concentrates risk that a conventional ship spreads across a crew. One center overseeing several ships is efficient, but it means a single operator’s attention, a single console fault, or a single link outage can touch more than one hull at once. The Code’s emphasis on risk assessment, system design, and alert management is aimed squarely at this: the shore center has to be engineered so that one failure does not cascade across the ships it controls, and so that an operator who is monitoring rather than actively steering can still take control in time when a situation develops on any of them. The same connectivity dependence from the technology stack applies with more force here, because the ROC is where the consequence of a dropped link is felt.

The legal gaps the conventions leave

The deepest gaps are not technical. They are in words. The conventions were drafted around a ship with people on it, and several load-bearing terms simply do not resolve when the people are ashore or absent. The starting point is the master. SOLAS and the wider regime give the master duties and an overriding authority over the safety of the ship; when no master is aboard, the law has to decide whether the remote operator is the master, whether the company is, or whether the role splits, and what happens to the master’s overriding authority. The RSE flagged this as a primary gap, and the MASS Code work has to answer it before a Degree Three ship can sail under settled rules.

The crew and manning gap follows. The Convention on Standards of Training, Certification and Watchkeeping for Seafarers (STCW) certificates people to stand shipboard watches; it was not written to certificate a shore-based remote operator running several ships from a desk, so the qualification of that operator is undefined in the current text. The Maritime Labour Convention (MLC) sets seafarers’ living and working conditions aboard ship, hours of rest, accommodation, repatriation, and most of it has no object on a ship with no one aboard, while raising the open question of whether a remote operator is a seafarer at all. Safe-manning documents, which specify the minimum crew a ship must carry, assume the answer is a positive number. None of these break in a way that stops the ship physically; they break in that the legal category the rule needs does not exist for an uncrewed hull.

COLREG Rule 5 is the sharpest single gap, and it is worth quoting because the wording is the whole difficulty. The rule requires that “every vessel shall at all times maintain a proper look-out by sight and hearing as well as by all available means appropriate in the prevailing circumstances and conditions so as to make a full appraisal of the situation and of the risk of collision.” A machine has no sight and no hearing in the human sense, so the question is whether a sensor suite plus software can satisfy a rule written around human senses, and whether “all available means appropriate” already covers it. There is real argument that good sensor fusion exceeds a tired human watch at three in the morning; there is equally real argument that the rule as written assumes a person. That argument is exactly the kind of thing the MASS Code and any COLREG amendment have to settle, and until they do, it sits in the gap.

Liability and the human master

The liability question runs on a separate track from the safety Code, and it is the IMO Legal Committee that owns it. The Legal Committee ran its own regulatory scoping exercise over the conventions it administers (the liability and compensation regime), to find where an uncrewed or remotely controlled ship breaks the assumptions those conventions make. The work matters because the safety Code can say how a MASS must be built and operated, but it does not by itself say who pays when an autonomous ship causes a loss, and the liability conventions assume a chain of human responsibility that runs through the master and the shipowner.

The working position the IMO bodies have reached is firm on one point: there should be a human master responsible for a MASS, regardless of the mode of operation or the degree of autonomy. The master may not need to be on board, depending on the technology and on whether anyone is aboard at all, and a master may be responsible for more than one MASS at the same time under conditions the committees were asked to work out in detail. So the answer to “who is the master of an uncrewed ship” is not “no one” and not “the software”; it is a human, sitting in a remote operation center, who carries the master’s responsibility for ships that may have no one aboard. Pinning that down is what closes the worst of the liability gap, because it gives the conventions a person to attach the duty to.

The insurance and financial-security side follows the same logic. The liability conventions require certificates of insurance and financial security backed by the International Group of Protection and Indemnity Associations and other providers, and the Legal Committee has worked on keeping the guidelines for accepting those certificates current as MASS develops. The practical question for an owner is whether a Degree Three or Degree Four ship can get the same cover a conventional ship gets, on terms a charterer and a port will accept, and that depends on the insurer being satisfied the autonomy and the remote operation are safe enough to underwrite. The joint working group’s living-document approach (listing the role and responsibilities of the MASS master and crew, the competencies they need, and the meaning of the term remote operator, then settling each) is the mechanism by which the safety side and the liability side are kept in step, so the Code and the conventions do not define the same people differently.

Yara Birkeland: a documented case

Most autonomous-ship coverage is concept art. The Yara Birkeland is an exception: a real ship, in service, that makes the gap between technically autonomous and legally uncrewed concrete. It is a fully electric container ship built for the Norwegian fertilizer producer Yara, with the navigation, sensor, and control technology supplied by Kongsberg Maritime, designed to take container truck journeys off the road on a short coastal route. The hull is about 80 meters long with a beam near 15 meters, it carries roughly 120 TEU, and it runs on a 6.8 MWh battery rather than any fuel, driving azimuth pods and tunnel thrusters to a service speed in the low teens of knots. It carries fertilizer between Heroya and Brevik in Norway, where Heroya is the loading terminal within Porsgrunn municipality, replacing tens of thousands of diesel truck loads a year.

The timeline shows the staged reality. The ship made its first voyage in the Oslo Fjord in November 2021 and entered commercial operation in 2022. It did not, on day one, sail with an empty bridge across open water; it operated with crew aboard and a shore control function during a build-up period, moving toward more autonomous operation as the systems and the approvals matured. That staging is the point worth taking from the case: even the ship most often named as the first autonomous container ship reached service as a crewed, electric ship with autonomy being phased in under Norwegian flag-state oversight, not as a Degree Four hull sailing itself on adoption. The technology was ready before the regulatory and operational confidence to remove the crew was, which is the same gap the MASS Code is meant to close at the level of the whole industry.

The narrower lesson is about claims. “Autonomous” on a press release and “operating uncrewed under settled law” are different statements, and the Yara Birkeland sits between them. It is genuinely an autonomous-capable, zero-emission ship and a documented in-service project; it is also a ship whose path to crew-free operation runs through the same trial guidance, flag-state approval, and convention gaps that govern every other MASS. A reader assessing any autonomous-ship claim should ask the same questions the IMO degrees force: which degree, with whom in control, under whose approval, and against which conventions.

How the pieces connect

The cluster has a shape, and it is the same shape as the subject. At the top is the spectrum of autonomy, fixed by the four IMO degrees, which decide who is in control and where. Below that sits the regulatory state: the scoping exercise that mapped the gaps, the non-mandatory Code that takes effect in 2026, the mandatory Code targeted for 2032, and the trial guidelines that govern testing in the meantime. Below that sits the technology that has to be dependable enough to satisfy the rules, situational awareness, COLREG-compliant collision avoidance, the remote operation center, the connectivity it rides on, and the cyber exposure that comes with it. And cutting across all of it are the legal gaps in the words master, crew, lookout, and watch that the conventions never had to resolve for an empty hull.

Two calculations anchor the technical end. The MASS time-to-collision calculator works the time-to-closest-approach figure that any collision-avoidance system, human or machine, ultimately acts on, and it is the quantitative core of the COLREG-interpretation problem. The DP station-keeping footprint calculator covers dynamic positioning, the position-holding that remote and autonomous offshore and terminal operations depend on, where the ship must hold a station against wind and current with no helmsman to nudge it. The wider digital-ship context, the satellite links, and the security threat are carried by the smart shipping and autonomy, satellite communication and vessel tracking, and maritime cyber security articles.

The reason the subject reads as confusing from the outside is that the four parts move at different speeds. The technology is the fastest: sensor fusion, autonomy software, and shore-control links are in service on real ships now. The legal terms move slowest, because changing what master and crew mean in a convention is a multi-year IMO process. The Code sits between them, turning the analysis into goals, and the projects like the Yara Birkeland prove the concepts one short route at a time. A reader who keeps those four speeds apart, the technology ahead, the law behind, the Code bridging, and the projects testing, will read any autonomous-ship news without mistaking a capable prototype for a settled legal reality.

Limitations

This article is a regulatory and conceptual hub, not legal or flag-state advice, and the regulatory picture it describes is moving. The MASS Code program is live: the non-mandatory Code’s effect date and the mandatory Code’s adoption and entry-into-force targets are drawn from current IMO statements, but the Committee has already revised the roadmap more than once, and any of these dates can shift again at a future MSC session. Treat the dates here as the plan as it stands, and check the latest MSC outcome before relying on a specific figure for a project or a contract.

Two further limits matter. First, the four degrees of autonomy are a tool for analysis, not a certification standard; a real ship is approved by its flag state and classed by its society against finer schemes like the DNV AROS notations, and the degree is shorthand, not a license. Second, the legal-gap discussion sets out the open questions (the meaning of master, crew, lookout, and watch for an uncrewed ship); it does not resolve them, because they are not yet resolved in the conventions. Where a flag state has issued its own national rules or granted a specific approval, those govern that ship, and they can be ahead of or different from the global position described here. For any operational decision, the governing texts are the conventions themselves, the flag state’s requirements, and the class society’s rules, read in their current versions.

See also

• Smart shipping and autonomy: the wider digital-ship and automation context around MASS.
• Satellite communication and vessel tracking: the connectivity that remote operation depends on.
• Maritime cyber security: the attack surface a network-controlled ship exposes.
• MASS time-to-collision calculator: the time-to-closest-approach metric behind collision avoidance.
• DP station-keeping footprint calculator: the position-holding envelope for remote and autonomous operation.