EU AI Act for Maritime and Shipping: Classify by Use

Mostly minimal-risk — with two sharper edges. Route optimisation, port logistics, demand forecasting, fuel-efficiency models and the bulk of operational shipping AI are not listed in Annex III of Regulation (EU) 2024/1689 — the EU AI Act — and are not prohibited under Article 5, so the high-risk regime does not attach. The two places it does: crew recruitment and management AI, which is high-risk under Annex III point 4, and safety-critical autonomous-navigation AI, which sits at the unsettled product-and-sectoral edge of the Act. The discipline is to classify each system by what it does, not to assume "maritime" means either out of scope or uniformly heavy.

Maritime is genuinely different from aviation here. Aviation has a single EU product regime (EASA) that pulls all flight-safety AI onto the Article 6(1) product route. Shipping safety is governed largely through international instruments — the IMO's developing MASS Code and the COLREGs collision rules — so the EU product route reaches only specific listed marine equipment, and most autonomous-navigation AI is not yet captured by it. Start with how Article 6 classification works, then walk your estate system by system.

---

Most operational maritime AI is minimal-risk

Run the inventory and the majority of a shipping company's, port operator's or logistics provider's AI lands in the minimal tier — no mandatory AI Act obligations beyond the horizontal Article 4 literacy duty:

• Voyage and route optimisation — weather routing, fuel-burn minimisation, speed and trim advisory tools.
• Port and terminal logistics — berth allocation, yard planning, container-stacking optimisation, gate scheduling.
• Demand forecasting and chartering analytics — freight-rate prediction, cargo-flow modelling.
• Predictive maintenance — engine and machinery monitoring that flags components for human-led inspection.
• Document and customs automation — bill-of-lading processing, manifest checking, translation.

None of these is an Annex III use case, and none performs a safety function that brings it onto the product route. They are minimal-risk. The GDPR governs any personal data (crew or customer) and applies regardless of the AI Act tier, but it is a parallel regime, not a high-risk AI Act duty.

---

The clear high-risk surface: crew recruitment and management — Annex III point 4

The one routinely high-risk use in shipping is the same one every employer meets. Annex III point 4 makes high-risk AI used for recruitment and selection at point 4(a) — placing job ads, screening and filtering applications, evaluating seafarers and shore staff — and for employment decisions at point 4(b): promotion, termination, task and shift allocation, and performance evaluation based on individual behaviour.

For a shipping operator this is concrete. AI that screens or ranks seafarer applications, an automated tool that scores crew performance, or a system that allocates rotations and assignments based on individual evaluation is high-risk on the stand-alone (Article 6(2)) route. The Article 6(3) filter can exempt a narrow procedural tool — one that only parses certificates into fields, or checks document validity — but any system that profiles natural persons is always high-risk, and a crew-performance scorer profiles. Treat crew-management AI as the first high-risk candidate in any maritime inventory. See employment-decision AI and recruitment-screening AI.

---

The unsettled edge: safety-critical autonomous-navigation AI

This is where maritime classification is genuinely harder than aviation, and where careful hedging matters.

Why it is not a simple product-route call. Aviation safety AI is high-risk under Article 6(1) because the EASA Basic Regulation sits in Annex I. Maritime is only partly comparable. Annex I, Section B, lists Directive 2014/90/EU, the Marine Equipment Directive — but that directive covers specific listed shipborne equipment (navigation, radio, life-saving and similar fitted equipment subject to "wheel-mark" conformity), not the autonomous-ship regime as a whole. The broader framework for Maritime Autonomous Surface Ships (MASS) is being built at the IMO (the developing MASS Code) and rests on international rules such as the COLREGs, not on a single EU product regulation.

What that means in practice. Where AI is a safety component of a piece of marine equipment that is within the Marine Equipment Directive and subject to its conformity assessment, the Article 6(1) product route can apply, with the Annex I deadline of 2 August 2028. But a large share of autonomous-navigation and collision-avoidance AI for full vessels does not map cleanly onto a listed Annex I product today — it sits at the edge, governed by an international regime that is still forming. The honest classification is: assess the specific equipment and function against the Marine Equipment Directive; do not assume all autonomous-navigation AI is automatically AI Act high-risk, and do not assume it is automatically out of scope either. Track the MASS Code's development, because the boundary will sharpen.

This is a deliberately hedged area. Where the analysis is genuinely uncertain, document the reasoning and the equipment-specific assessment rather than forcing a tier. The conformity-assessment route explains how the product and stand-alone paths diverge.

---

The horizontal duties that apply across the fleet

Two obligations apply regardless of tier.

Article 4 — AI literacy

Article 4 requires deployers to ensure a sufficient level of AI literacy among crew and shore staff operating AI systems — in force since 2 February 2025, applying to all AI including the minimal-risk routing and logistics tools. For a maritime operator this means documented familiarity with what each tool does, its limits, and when a human officer must override it. See AI literacy requirements.

Article 50 — transparency

If a port or shipping company runs a chatbot for customers or crew, Article 50(1) requires telling users they are dealing with an AI system. If it publishes AI-generated media, Article 50(2) marking and Article 50(4) disclosure apply, with content-marking from 2 December 2026; most other Article 50 duties apply from 2 August 2026. See Article 50 transparency obligations.

---

Worked example: a shipping group classifies its stack

Consider Nordström Shipping A/S, a Danish operator of about 600 employees and roughly €120M turnover, running a mixed fleet plus a terminal. Its AI estate: a weather-routing and fuel-optimisation tool, a berth-allocation system at the terminal, a predictive-maintenance system for engines, a crew-rostering-and-performance tool, and a pilot project trialling AI-assisted collision-avoidance on one retrofitted coastal vessel.

Walking each system to a tier

The weather-routing tool, the berth-allocation system and the predictive-maintenance system are minimal-risk — not in Annex III, no safety-component status, GDPR governs any personal data. The crew-rostering-and-performance tool is high-risk via Annex III point 4(b) — it evaluates and allocates based on individual seafarer performance, and because it profiles crew, the Article 6(3) filter is closed. That is Nordström's clear high-risk system, on the 2 December 2027 stand-alone deadline (adopted). The AI-assisted collision-avoidance pilot is the hedged edge: Nordström assesses the specific equipment against the Marine Equipment Directive and the developing IMO MASS framework, documents that the classification is unsettled, and treats it conservatively pending the equipment-level conformity analysis and the maturing sectoral rules.

The outcome

Of five systems, one is clearly high-risk (crew rostering/performance), three are minimal-risk, and one sits at the unsettled product edge requiring an equipment-specific assessment. Nordström's confirmed AI Act workload is the Article 4 literacy duty across crew and shore staff, the full high-risk programme — risk management (Article 9), data governance (Article 10), technical documentation (Article 11), human oversight (Article 14), Article 49 registration — for the crew tool, plus a documented, ongoing assessment of the navigation pilot. The lesson: classify by use, isolate the one clearly high-risk system, and hedge the genuinely uncertain one rather than over- or under-stating it.

---

The maritime AI route-and-tier map

The reliably high-risk row is crew management; the marine-equipment and autonomous-navigation rows require an equipment-specific assessment; everything else is minimal- or limited-risk.

Penalties, with the SME cap

High-risk obligation breaches sit at up to €15,000,000 or 3% of total worldwide annual turnover, whichever is higher, under Article 99(4). Article 5 prohibited practices carry up to €35,000,000 or 7% under Article 99(3). Supplying incorrect or misleading information to authorities is up to €7,500,000 or 1% under Article 99(5). For SMEs and start-ups, Article 99(6) caps the fine at the lower of the two. See the Article 99 penalties.

---

Deadlines and how Confir helps

The dates that govern maritime AI

For the clear high-risk surface — crew recruitment and management under Annex III — the stand-alone obligations under Article 6(2) apply from 2 December 2027, the date set by the Digital Omnibus, adopted in June 2026. That deferral is now adopted: the European Parliament passed it in plenary on 16 June 2026 and the Council formally adopted it on 29 June 2026. Only publication in the Official Journal remains — expected before 2 August 2026 — a formality that does not affect the dates. The 2 December 2027 date is now the settled deadline for stand-alone Annex III high-risk obligations. Where safety AI is embedded in listed marine equipment on the product route under Article 6(1), the relevant date is 2 August 2028. Article 4 literacy applies since 2 February 2025; Article 50 transparency from 2 August 2026. See is the AI Act delayed.

What Confir does

Confir registers each maritime AI system and classifies it under Article 5 and Article 6, separating the minimal-risk operational estate — routing, logistics, maintenance — from the clear Annex III point 4 crew-management high-risk case, and flagging the autonomous-navigation systems that need an equipment-specific, sectoral assessment rather than a snap verdict. It derives the provider or deployer role, runs the Article 6(3) filter explicitly, and generates the Article 11 / Annex IV documentation and Article 49 registration where they are owed.

The engine is deterministic and rule-based: the same intake produces the same finding, with the rule that fired shown — so a classification, including a hedged "assess further" verdict on a navigation system, is reproducible and audit-defensible rather than buried in a consultant's memo. Where the law is genuinely unsettled, Confir surfaces that rather than forcing a false certainty.

---

Frequently asked questions

Is maritime and shipping AI high-risk under the EU AI Act?

Mostly no. Route optimisation, port and terminal logistics, demand forecasting, fuel-efficiency models and predictive maintenance are not listed in Annex III and are minimal-risk. The clear high-risk exception is crew recruitment and management AI, which falls under Annex III point 4. Safety-critical autonomous-navigation AI sits at an unsettled product-and-sectoral edge: where it is a safety component of listed marine equipment it can take the product route, but much of it is governed by the developing IMO framework rather than a single EU product law. Classify each system by what it does.

Is crew-management AI high-risk?

Yes, generally. AI that screens or ranks seafarer applications, scores crew performance, or allocates rotations and assignments based on individual evaluation is high-risk under Annex III point 4 — point 4(a) for recruitment and selection, point 4(b) for in-employment decisions. The Article 6(3) filter can exempt a narrow procedural tool, such as one that only parses certificates into fields, but a tool that profiles crew is always high-risk and cannot use the filter. Crew management is usually the first high-risk system to surface in a maritime inventory.

Is autonomous-navigation AI high-risk under the EU AI Act?

It is unsettled, and the honest answer is "assess the specific equipment and function." Aviation safety AI is clearly high-risk via Article 6(1) because EASA law is in Annex I. Maritime is only partly comparable: Annex I lists the Marine Equipment Directive (2014/90/EU), which covers specific listed shipborne equipment, but the broader autonomous-ship regime is being built at the IMO (the MASS Code) on international rules like the COLREGs. Where AI is a safety component of listed marine equipment, the product route and the 2 August 2028 deadline can apply; for full-vessel autonomous navigation, document the equipment-specific assessment and track the MASS Code.

Why is maritime treated differently from aviation under the AI Act?

Aviation has one EU product regime — the EASA Basic Regulation — listed in Annex I, which pulls all flight-safety AI onto the Article 6(1) product route with the 2 August 2028 deadline. Maritime safety is governed largely through international instruments at the IMO, and the only maritime entry in Annex I is the Marine Equipment Directive, which covers specific listed equipment rather than vessels as a whole. So aviation safety AI has a clean product route, while much maritime autonomous-navigation AI sits at an edge that the EU product regime does not yet fully capture.

What maritime AI is minimal-risk?

A large share of it. Weather routing and fuel optimisation, berth and yard planning, container-stacking and gate scheduling, freight-rate and cargo-flow forecasting, and predictive maintenance that flags components for human-led inspection are all minimal-risk — not listed in Annex III and not safety components on the product route. They carry no high-risk AI Act obligation, only the horizontal Article 4 AI-literacy duty and, where customer chatbots are used, the Article 50 transparency duty. GDPR still governs any personal data regardless of the AI Act tier.

When do the maritime AI deadlines apply?

For crew-management AI under Annex III, the statute originally read 2 August 2026; the Digital Omnibus — adopted, with European Parliament plenary approval on 16 June 2026 and Council adoption on 29 June 2026 — now defers this to 2 December 2027, the settled deadline for stand-alone Annex III high-risk obligations. Where safety AI is embedded in listed marine equipment on the Article 6(1) product route, the deadline is 2 August 2028. Article 4 AI literacy has applied since 2 February 2025, and Article 50 transparency applies from 2 August 2026.

---

Related guides

• Article 6 high-risk classification
• The conformity-assessment route
• Employment-decision AI under Annex III
• Recruitment and selection AI under Annex III
• Article 4 AI literacy requirements
• Is the EU AI Act delayed?
• Logistics and supply-chain AI compliance