Author: Informatyk A. Przybysz

The new rules introduce a requirement to obtain an operating permit for certain foreign vessels operating in Polish maritime areas. This is an important change for shipowners, operators and contractors involved in offshore wind projects in the Baltic Sea.

In practice

If a foreign vessel is expected to operate in Polish maritime areas for more than 14 days in a year, the requirement to obtain an operating permit should be factored in already at the contract and charter planning stage.

The October 2025 amendment to the Act on Promoting Electricity Generation from Offshore Wind Farms, commonly referred to as the Offshore Wind Act, attracted a great deal of attention. Much less attention was paid to the amendment to the Maritime Safety Act, even though, from the perspective of the offshore market, it may have significant practical consequences.

The new provision addresses a problem that the offshore sector and shipowners had been facing for several years. It concerns the lack of real requirements and effective supervision over certain foreign non-convention vessels operating in Polish maritime areas.

The new Article 86¹ applies to foreign-flag vessels that are not subject to the SOLAS Convention, that is, the international safety requirements for larger ships. In practice, this mainly concerns smaller working vessels below 500 gross tons, including Crew Transfer Vessels (CTVs), guard vessels, survey vessels, small port tugs and other vessels supporting offshore operations. These are the vessels that carry out many of the day-to-day tasks required for the construction and operation of offshore wind farms.

Why this change was needed

Under the previous rules, the Polish maritime administration did not have effective tools to supervise some of these foreign vessels when they operated in Polish maritime areas. In practice, some of them operated on the basis of national certificates issued by the flag state, for example the MCA Small Commercial Vessel Certificate in the United Kingdom.

Such documents were not always regarded as equivalent to the class assigned by recognised classification societies that are members of IACS, the International Association of Classification Societies. These include, among others, DNV, Lloyd’s Register, Bureau Veritas and the Polish Register of Shipping (PRS).

This mattered not only for safety, but also for market competition. Some foreign shipowners could offer services at a lower price because they did not bear the same costs related to class, technical supervision and compliance that, in practice, were imposed on entities operating under the Polish flag.

The issue became more visible as offshore projects in the Baltic Sea developed and more foreign vessels started to work there on a permanent basis.

What the amendment changes

If a foreign-flag vessel that is not subject to the SOLAS Convention is to operate in Polish maritime areas for more than 14 days in a calendar year, the shipowner must first obtain an operating permit.

The permit is issued by the director of the competent maritime office. An inspection by a recognised classification society is also required.

What documents need to be prepared

In particular, the application should include:

• a description of the planned operation of the vessel, including routes, home port and the planned duration of offshore operations,
• consent from the flag state administration,
• the vessel’s certificates and class documents,
• a document confirming that the vessel meets requirements no less stringent than those applicable to vessels under the Polish flag; this document should be issued by a recognised organisation after a technical inspection of the vessel.

The permit may be issued for a maximum period of five years, but not longer than the validity period of the vessel’s documents.

What this means for the market

From a market perspective, this is an important change.

First, it increases the level of safety because a real technical inspection is carried out before a vessel is allowed to operate.

Second, it reduces competitive differences between vessels under the Polish flag and those under foreign flags.

Third, it affects the planning of contracts and charter arrangements because the permit procedure must now be taken into account at an early stage.

How it works in practice

The Maritime Office in Gdynia has already published a procedure describing how to obtain the permit. It makes clear, among other things, that the authority does not assist in obtaining the document from a recognised organisation, so the shipowner is responsible for preparing the complete set of documents.

The procedure also indicates the applicable inspection fee and assumes that the proceedings should be completed within one month from the submission of a complete application.

Summary

The new rules close an important gap in the system and introduce more uniform requirements for vessels working on offshore wind projects in Polish maritime areas.

For shipowners, operators and contractors, the message is clear: when planning the operation of foreign vessels in the Polish part of the Baltic Sea, it is now necessary to consider not only operational and contractual matters, but also the obligation to obtain the relevant permit.

Contact

Do you have questions about vessel operations in offshore wind projects, maritime administration requirements or planning vessel operations in Polish maritime areas?

Contact the lawyers at Wind & Water Legal Zbroja Adwokaci i Radcowie Prawni sp. k. We advise on vessel operation planning, administrative obligations and mitigating regulatory risks related to offshore wind projects in the Baltic Sea.

It is two in the morning. You are sailing in the Mediterranean alone or with a small group. The radar is clear. AIS shows no vessels nearby. 

Then, suddenly, an alert appears on the screen: a small object 180 meters off the bow. 

The thermal camera shows a drifting dinghy. It is empty, and you can breathe a sigh of relief. 

This story is fictional, but it could happen in real life. Meanwhile, this is exactly how artificial intelligence-based systems work, and they are increasingly finding their way onto yachts. 

In today’s yachting, artificial intelligence is increasingly helping people at sea. However, these systems still only perform a supporting role. They do not take control but warn the crew of an impending danger. 

Yacht owners value the ability to sail the vessel themselves, but they also appreciate an extra “eye” that improves safety and comfort. This makes it easier to spot dangers that cannot be seen by ordinary radar or AIS systems, let alone the human eye. 

In cooperation with SEA.AI, one of the leaders in computer vision on the water, we show how those support systems work and what legal challenges they create. 

How the system works 

SEA.AI is an advanced system based on optical and thermal cameras combined with artificial intelligence algorithms. The cameras monitor the surroundings in real time – they also operate in low-light conditions, at night in the most difficult weather conditions. 

The system detects and recognises objects on the water surface, such as: 

• drifting containers and rubbish,
• kayaks, jet skis, dinghies and boats without AIS,
• buoys, pieces of wood, pieces of ice,
• whales and orcas,
• people overboard,
• sea mines. 

SEA.AI complements radar and AIS, filling in their gaps. Radar often misses small objects, especially in high waves, rain, interference or at a bad angle. In addition, it has blind spots close to the yacht, and its effectiveness depends on the operator’s experience. 

In recreational yachting, the system does not replace the captain. It does not take over the helm or manoeuvres – it remains a tool that supports the crew. It acts as an extra pair of eyes that constantly monitors the surroundings and warns of potential hazards. 

The system also offers practical functions to support observation. For example, it can automatically keep a selected object in the centre of the image (such as a person overboard) and, when sailing, automatically adjusts the camera towards the bow, the most important part of the field of view. 

The system analyses images from AI-supported optical and thermal cameras, generates acoustic alarms for the crew, and displays detected objects on navigation maps, phones, tablets, and computers, which significantly increases the crew’s situational awareness and translates into high effectiveness in detecting objects around the vessel. 

Since 2018, SEA.AI has installed over 1,200 systems and collected a database of over 24 million tagged objects. As a result, their algorithms are constantly learning and becoming more accurate. 

It is also worth noting that SEA.AI is used, for example, on IMOCA class yachts in the Vendée Globe race. More than half of the fleet used it as a ‘second pair of eyes’ during their solo circumnavigation of the globe, detecting drifting objects invisible to radar or AIS. 

Function of systems in yachting 

With luxury yachts, often worth several million euros, even the smallest collision or contact with an object can cause serious problems. It is not just a matter of human safety – it is also about the aesthetics and value of the vessel. A small scratch, paint damage or contact with a buoy, dinghy or even driftwood can ruin the perfect appearance of the hull. 

Repairing such damage can be costly. Systems such as SEA.AI help to avoid such ‘cosmetic’ incidents. Early detection of a small object (even up to several hundred metres away) gives time for a calm manoeuvre – without panic, without the risk of scratches or abrasions. 

It not only protects against serious collisions, but also minor contacts. 

Legal liability 

Imagine a collision in the harbour. The system sounds the alarm, but the captain continues sailing.  

The decision is theirs. He will be held responsible if he ignores the alarm and even the slightest collision occurs.  

A yacht equipped with support systems is still operated by humans. In the event of a collision involving the yacht, liability usually begins with the operator (the owner of the vessel). He is responsible for ensuring that the yacht has functioning equipment and that the crew knows how to use it. 

So, who is responsible? 

• the captain – makes the decisions.
•  the crew – carry out the captain’s orders.
• the operator – should ultimately have the appropriate insurance. 

If the AI system fails to detect an object due to an error in the algorithm, the manufacturer will still not be held liable. All developers of such solutions emphasise that the systems are designed to assist, not replace. 

Liability could fall on the manufacturer of monitoring solutions only if a false alarm led to damage being caused. Is this possible in practice? Yes. But is such a scenario likely to occur? No. 

In practice, manufacturers are constantly developing their systems, so it is important to ensure that they are always up to date and correctly installed. This is not only a matter of responsibility, but also of cyber security. 

Complications with fully autonomous units 

Imagine a yacht sailing at night, without a captain or crew – the system makes all the decisions itself. When it approaches a drifting container, it decides whether to turn, accelerate or avoid the obstacle. Sounds futuristic? This is the fourth level of autonomy according to the International Maritime Organisation (IMO) – full autonomy, where the system operates independently. 

Degree One – a vessel with automated processes and decision support 

• There are always sailors on board who operate and monitor the systems.
• Some operations can be automated and sometimes run without supervision, but the crew is ready to take the helm at any time. 

Degree Two – remotely controlled ship with sailors on board 

• The yacht is controlled from another location, but there are sailors on board who can take control and operate the systems. 

Degree Three – remotely controlled ship without sailors on board 

• The yacht is remotely controlled from another location.
• There are no sailors on board. 

Degree Four – fully autonomous ship 

• The yacht’s operating system makes decisions and determines actions independently. 

If yachts became completely autonomous – with no crew on board and a system that makes decisions independently – the issue of legal liability would become extremely complicated. 

International conventions such as COLREG assume that there is a captain or crew on board who responds to threats. In the case of full autonomy, there is no clearly defined person responsible for the ship, which makes it difficult to assign blame in the event of an accident. 

In practice, responsibility could lie with many entities: the operator, the AI system manufacturer, the software developer, the sensor supplier, or even the remote-control centre operator. 

In yachting, full autonomy is still a dream of the future. Imagine a yacht sailing alone across the ocean, deciding on every manoeuvre, avoiding drifting containers and buoys without a captain on board. It sounds fascinating, but in legal practice it is a maze – maritime law still assumes the presence of a person who makes decisions and is responsible for the vessel. 

In fact, it is not just about law and safety. Yachting is a pleasure. Everyone wants to feel the wind on their face and steer their own yacht sometimes – after all, that is what it is for. Assistance systems such as SEA.AI are the perfect compromise: they increase safety, warn of dangers, but do not take away the joy of steering independently. Full autonomy may come one day, but today, what matters most in yachting is the pleasure of being at sea. 

Summary 

Fully autonomous yachts are still a long way off, not only because of technology, but also because of the law. The sea is unpredictable, and even the most accurate algorithms can make mistakes. That is why the law requires someone to be clearly responsible for decisions – a specific person, not a system. 

Most owners therefore prefer to remain the captain of their own yacht. That is why assistance systems such as SEA.AI are the ideal compromise: they increase safety and warn of dangers, but do not take away the pleasure of steering. 

This is not a revolution, but a sensible step forward. The sea is too unpredictable to leave everything to a machine – at least for now. After all, sailing is not only about reaching your destination, but also about the joy of steering your own yacht. 

This article was created in collaboration with SEA.AI, a company that develops artificial intelligence systems supporting safety and navigation at sea. The knowledge and experience of the SEA.AI team in the field of technologies used on autonomous yachts helped to present current solutions and directions for the development of artificial intelligence in yachting. 

Consultation: Agata Widuto

In recent years, multihull yachts have gained popularity. Although their concept was born long ago, they have only recently achieved success in recreational sailing.

What is a multihull?

A multihull is a vessel that has more than one hull. A vessel with two hulls is called a catamaran, while one with three hulls is a trimaran. Very rarely, there are vessels with more than three hulls, typically used for specialized purposes. 

Advantages and disadvantages of multihulls 

• Stability and safety – one of the greatest advantages of multihulls is their high stability, resulting from their wide beam. Compared to monohulls, they have significantly smaller heeling angles during sailing, which increases crew comfort and a sense of safety.
• Speed – multihulls often achieve higher speeds than monohulls of the same length, mainly due to lower hydrodynamic resistance and the lack of ballast. This allows for more efficient sailing, especially on favorable courses and wind conditions.
• Space – with two hulls, there is significantly more space, both inside and outside. This provides more room for cockpits, storage, and other amenities.
• Maneuverability – multihulls typically have two separate engines, one in each hull. This allows the yacht to rotate in place, providing greater control and reducing the impact of tides and wind during navigation.
• Comfort – all of the previously mentioned factors contribute to greater comfort while sailing, especially for families and people prone to seasickness.
• Experience – some argue that multihulls do not offer the same sailing experience as monohulls. Monohulls are less stable and more susceptible to wind and waves, making sailing more exciting.
• Transport – monohulls are smaller, and thus easier to transport. If you plan to transport your boat, this is something to consider when making a purchase.
• Maintenance – a hull requires regular cleaning and protection. Having more hulls means more work or costs. The same applies to engines.
• Costs – multihulls are more expensive to produce, and therefore, their price is higher.

Important provisions in the sales agreement 

If you’ve already decided on a multihull, it’s important to pay attention to specific provisions in the sales agreement related to this type of vessel, which should address: 

• responsibility for inspecting each hull individually,
• structural condition of the crossbeam (i.e., the wider beam – cross elements running between the hulls),
• a detailed handover protocol, divided by hulls and onboard equipment,
• conditions for rejection after a survey revealing structural defects,
• costs of testing and insurance (which will typically be covered by the buyer). 

The agreement should also specify how the multihull yacht will be handed over. Due to the size of these vessels, the transport cost is significantly higher compared to monohull equivalents. It’s important to define whether the handover will take place on land, on water, or ready for further transport. 

For more information on yacht sales agreements, see here: Pitfalls in yacht acquisition agreements – how to avoid troubles?

For tax-related matters related to the purchase, see here: New yacht and VAT – do you need to pay and when?

Market situation 

The market for the most popular multihulls, catamarans, is growing dynamically. Depending on the source, its value is estimated to be between 900 million and 2.2 billion dollars. In 2024, according to analysts, catamaran sales doubled compared to the previous year, accounting for one-third of total yacht sales. Forecasts predict continued, intense growth in the coming years – by 2030, the market value is expected to reach between 1.5 billion and approximately 3 billion dollars.

source: https://www.mordorintelligence.com/industry-reports/catamaran-market

source: https://www.marketgrowthreports.com/market-reports/powered-catamaran-market-107733

Summary 

Multihull yachts are increasingly asserting their position in the yachting market, becoming an attractive alternative to monohulls. With high stability, more space, excellent performance, and enhanced sailing comfort, they are particularly well-suited for recreational, family, and charter sailing. However, they require an understanding of their specifics – higher purchase and maintenance costs, greater service requirements, and a somewhat different “sailing experience.” The dynamic growth in sales and optimistic market forecasts indicate that multihulls have already become one of the most important segments of the modern yachting market.

Do you know that slight unease before visiting a doctor? Especially for the first time? Will they listen to me? Will they understand me? Will I understand them? Will I forget to mention something? And depending on personal traits, the rest of the similar dilemmas.

Yes, this is another reference to doctors, because – just like with lawyers – we don’t go to them for trivial matters but for problems. And with all due respect to other professions, it’s easier to deal with a bad haircut or a leaking washing machine than with the prospect of surgery or imprisonment. 

The stress level before the first meeting with a lawyer can, of course, be very high, depending on the matter we’re bringing in. In the mindset of many people, a visit to the law office is a last resort, a sign that something went wrong in their business (or life) and they can’t handle it. While many entrepreneurs’ awareness is changing, for a large portion, a lawyer is still seen as someone who puts out fires. And when there’s a fire, it’s a disaster. 

The client walks in and doesn’t know what to do 

So, this client walks in, stressed about their situation and the fact they need to tell someone about it. It’s great if they immediately see someone in an obvious spot, so there’s no doubt that they can approach them. It’s worse if there’s no clear place, or no one they can speak to. It feels a bit like standing at the entrance of a restaurant, seeing a sign that says, “Please wait here,” and then no one comes to greet you for the next ten minutes – not even a glance. 

Let’s assume the client enters the office, sees the reception desk, but there’s no one behind it. No one acknowledges their arrival, and they stand there, waiting. They look at their watch – the meeting is in a minute, but they left early to avoid being late. They start nervously moving around, and eventually peek into the rooms, apologizing for interrupting, and explain they’re there for a scheduled meeting.

Has their stress level increased before the meeting? Definitely. Perhaps this situation even irritated them a little. Did it make them wonder if anyone is working here? If anyone is engaged? It might, especially if they pay attention to such things or if customer service in their own business works very differently. Finally, did they feel safe in this situation? Comfortable? Certainly not.

Our core value is safety 

We don’t let situations like this happen. In our Client Service Procedure, we clearly define that during office hours, someone must always be at the reception desk. We know who is filling in and when, and what to do if the reception desk is temporarily empty. There is absolutely no option for a client not to know what to do, where to go, or not to be welcomed and invited into a conference room, or asked to wait. And absolutely everyone must be able to do this and feel responsible for it. No matter how complex their tasks may be, everyone should be ready to help the client. 

A client must feel safe and comfortable in the office – not only in the substantive aspect but also in the organizational one. That’s why procedures are necessary. The first contact can truly make a significant difference. 

The NIS2 Directive (Network and Information Security 2) is a new legal act that replaces the earlier NIS1 Directive of 2016. The Directive entered into force on 16 January 2023, and Member States were required to transpose it into their national legal systems by 17 October 2024. Poland, like France, Spain, the Netherlands, Luxembourg, and Bulgaria, has not yet completed this process. However, the national legislative process is currently at an advanced stage.

Objective of the Directive

The primary objective of the Directive is to strengthen protection against digital threats across the European Union. It introduces uniform cybersecurity rules for sectors that are critical to the economy and society, including energy, transport, healthcare, digital infrastructure, banking, and the maritime economy. The regulation obliges Member States to develop national cybersecurity strategies, enhances cross-border cooperation in responding to major incidents, and grants supervisory authorities stronger powers to monitor compliance and enforce the provisions.

What does the implementation of the NIS2 Directive look like in Poland?

In Poland, the NIS2 Directive is being implemented through an amendment to the Act on the National Cybersecurity System. To date, the legislative work has involved two draft bills. However, it was only the second draft that softened the most heavily criticised solutions, including, among others:

• the mandatory application of ISO standards, which was ultimately abandoned,
• the deadlines for conducting the first audit, which were extended,
• supply chain requirements, which were limited to direct suppliers.

The draft amendment adopted by the government:

• expands the catalogue of entities subject to the obligations,
• introduces new incident response teams (sectoral CSIRTs),
• strengthens the powers of supervisory authorities, such as the Minister for Digital Affairs and CSIRT GOV.

Entities covered by the new regulations will be required, inter alia, to conduct risk assessments, implement security measures, train employees, and report incidents. It is anticipated that the new provisions will enter into force around mid-2026.

The maritime sector – who is covered

Importantly for businesses, the NIS2 regulations introduce a differentiated supervisory model. Under this model, certain organisations will be subject to particularly intensive supervisory obligations. This applies to so-called essential entities, for which the legislator has envisaged more far-reaching oversight than for other participants in the system. The transport sector, including maritime transport, is classified as an essential sector due to its significant role in the economy and society.

In practice, the NIS2 regulations primarily affect entities operating on a larger scale, which ensure the continuity of transport and logistics processes. These are mainly organisations that employ at least several dozen employees and generate substantial annual revenues.

In the maritime sector, this primarily concerns:

• operators of maritime, inland waterway, and coastal transport (both passenger and cargo),
• port authorities,
• entities carrying out work and operating equipment within ports,
• operators of vessel traffic systems.

Such entities will be required to implement the full set of NIS2 requirements. It should also be emphasised that the size criterion is relevant, although it is not always decisive. In certain cases, inclusion under the regulations depends on the importance of a given activity for the functioning of the state or for ensuring the continuity of services.

This approach ensures that protection covers the entire critical maritime infrastructure, which is vulnerable to cyberattacks capable of paralysing trade and logistics.

Obligations for maritime entities and the significance of NIS2

• Entities operating in the maritime sector will be required to:
• regularly assess cybersecurity risks to IT and OT systems (operational technology, e.g. port control systems),
• implement incident response procedures and report serious breaches,
• train personnel on digital threats,
• ensure supply chain security (although, in the Polish draft, this has been limited to direct suppliers),
• cooperate with other entities and authorities in the exchange of information on threats.

A key novelty is the explicit emphasis on the responsibility of senior management for overseeing the implementation of cybersecurity obligations. This means that cybersecurity issues cease to be the exclusive domain of IT departments and become an element of managerial accountability.

The implementation of NIS2 is undoubtedly a challenge in terms of costs, as it involves investments in technology, audits, and training. However, it also delivers numerous benefits by strengthening resilience to incidents, which in the long term will help minimise financial losses and the risk of losing critical data. It also enhances international cooperation and improves the exchange of information on threats.

From a reputational perspective, the regulations may also affect competitiveness and development opportunities. Companies that meet high cybersecurity standards gain the trust of global partners, while the modernisation of IT/OT systems can deliver operational efficiencies (e.g. in offshore wind projects or logistics).

The significance of the ISPS Code

The International Ship and Port Facility Security (ISPS) Code was developed in response to global security threats that emerged at the beginning of the 21st century and led to strengthened protection of port and maritime infrastructure. ISPS regulations focus primarily on a systemic approach to the security of ports and vessels, encompassing threat assessments, the organisation of protective procedures, and the preparation of personnel to respond to incidents. The NIS2 Directive extends this approach into the area of cybersecurity, placing emphasis on the resilience of information and technological systems to increasingly sophisticated digital threats.

Integrating NIS2 requirements with existing ISPS mechanisms enables ports and maritime operators to build a coherent security management system in which physical and digital risks are analysed jointly and incident response is coordinated.

For Polish ports, this represents an opportunity to modernise security systems. Combining the new procedures introduced by the Directive with existing security plans based on the ISPS Code will help avoid duplication of efforts and create a single, coherent risk management framework covering both digital and physical security.

Current situation in the maritime sector

As of December 2025, the Polish national legislation implementing NIS2 has not yet entered into force, and the legislative process is in its final stage. This means that entities operating in the maritime sector are not yet subject to formal obligations arising from the new act.

However, many port operators and shipowners are already voluntarily preparing for implementation. This includes modernising IT infrastructure, integrating NIS2 procedures with existing ISPS security plans, and investing in training.

The maritime sector is facing significant changes, but the full set of obligations will only apply once the amendment to the Act on the National Cybersecurity System is adopted and enters into force—most likely in the first half of 2026.

The NIS2 Directive represents an important step towards strengthening cybersecurity across the European Union. For seaports and maritime sector entities, it entails not only new regulatory obligations, but above all an opportunity to enhance operational resilience and competitiveness.

Sailing, especially on large, open waters, has always carried many risks. Some of these risks can be more easily mitigated (e.g., by building vessels with better construction), while others can only be prevented (e.g., by anticipating adverse weather conditions). 

In today’s world, however, there is another emerging threat – the risk associated with cybersecurity. 

On a yacht, this is not only a technological issue but also a legal one. It can have significant implications for owners, shipowners, and the crew. Ensuring the vessel’s cybersecurity is becoming increasingly important for the safety of navigation, data protection, and avoiding potential legal liability. 

Cybersecurity as an element of maritime safety 

Cybersecurity is the organised management of risks associated with the use of IT systems. 

IT systems affect the daily work of the crew, passenger comfort and overall navigation. These include, for example, Wi-Fi networks and crew and passenger computers. Problems with these systems can delay a voyage, disrupt communication or cause data loss. 

Some of them, such as autopilot systems or propulsion control, have a direct impact on the physical operation of the yacht. Disruption of their operation can lead to loss of controllability, navigation errors or loss of communication. 

The yacht also processes the personal data of crew members and passengers. Violation of personal data protection rules resulting from a lack of adequate security measures may in turn lead to claims or notification obligations. 

Therefore, ensuring cybersecurity on board is an integral part of maritime safety. 

Example:
During a cruise in the Mediterranean Sea, a luxury yacht suddenly changes course. It turns out that a cybercriminal has taken control of the autopilot. The crew must quickly regain control to avoid running aground. 

International rules and regulations 

Cybersecurity rules on yachts are governed by international law. The International Maritime Organisation (IMO) introduced the obligation to include cyber risk in the International Safety Management (ISM) system in 2017. In 2024, an industry shipping consortium involving BIMCO (Baltic and International Maritime Council) and others issued specific guidelines on this issue. 

Although these regulations mainly apply to commercial vessels, their principles are equally important for yachts. Compliance with them can help manage risk, limit legal and financial liability, and keep documentation in order. 

Example:
The yacht owner regularly audited the systems in accordance with IMO guidelines. During the attack attempt, critical areas were protected, which prevented an incident and avoided costly claims. 

Cyber risks on a yacht – what are we facing? 

Cyber threats on a yacht can come from various sources. Here are the most common problems that may occur while sailing: 

1. Targeted attacks – cybercriminals can take control of yacht systems, such as the navigation system, leading to a change of course, data theft or disruption of yacht operations.
2. Accidental attacks – e.g. installing software that contains a virus that can infect systems.
3. Crew errors – crew members may accidentally introduce a threat, e.g. through improper management of access to IT systems.
4. Supplier errors – suppliers who do not adhere to appropriate security standards may introduce devices or software that are vulnerable to attack. 

Common cyber threats include: 

• phishing – attacks involving impersonating trusted sources in order to obtain login details,
• malware – malicious software that infects systems,
• ransomware – locking systems and data and demanding a ransom,
• Wi-Fi attacks – taking control of the Wi-Fi network on a yacht,
• navigation manipulation – e.g. manipulating GPS data in order to steer a yacht onto a dangerous course. 

Example:
A young crew member connects his phone to the on-board network, unknowingly introducing malware that blocks the yacht’s computers and compromises passenger data. 

Cyber risk management cycle – IMO and NIST 

Cyber risk management is based on a cycle consisting of five steps: 

1. Identification – identifying resources and threats related to IT systems,
2. Protection – implementation of appropriate security measures, such as access and user control,
3. Detection – monitoring systems for threats and analysing logs,
4. Response – taking corrective action in response to an incident,
5. Recovery – restoring normal operations after an incident and securing systems.

This cycle, developed by IMO and NIST, should be activated regularly, especially after any system changes or incidents. 

Example:
Upon detecting unusual activity in the logs, the team immediately implemented the response and recovery procedure, minimising the impact of the attack. 

Responsibilities of the owner, operator, crew and suppliers 

Cybersecurity management on a yacht is not the responsibility of just one entity. There are five entities, each with its own specific duties in this regard: 

• owner: responsible for ensuring adequate financial resources for the implementation and maintenance of the cybersecurity system, defining security policies and conducting regular reviews,
• operator: manages cyber risk, verifies service providers, provides crew training,
• crew: complies with access policy, monitors systems and reports any irregularities,
• suppliers: ensure that their products comply with cybersecurity requirements, secure devices and software,
• passengers: they have no specific responsibilities, but should comply with the cybersecurity rules on board.

Cybersecurity is an issue that cannot be ignored from any perspective. A threat to a yacht from one of the entities mentioned above may pose a threat to all. 

Example:
A new navigation system was installed on a yacht, but the supplier did not verify the relevant security measures. Thanks to the shipowner’s vigilance, the vulnerability was detected and immediately removed. 

Protective measures and procedures 

There are simple and common measures to increase cybersecurity on a yacht. From the perspective of those responsible, it is definitely worth implementing: 

• network segmentation – division into zones (guests, staff, critical systems) to minimise the risk of threats spreading,
• access management – use of strong passwords, differentiation of passwords in different systems, regular password changes,
• software updates – regularly updating systems from trusted sources,
• security policy – implementation of procedures concerning access, use of external devices, system monitoring and incident response. 

Imagine a yacht as a hotel – only people with the appropriate “key” are allowed access to the navigation systems, which reduces the risk of unauthorised access. 

Conclusion 

Cybersecurity on a yacht is an important element of navigational safety management, data protection and legal risk minimisation. The use of appropriate protective measures, system monitoring, compliance with regulations and the implementation of incident response procedures help to reduce risk and ensure safety on board. Although cyber attacks in the maritime environment may seem rare, it is worth implementing the recommended procedures to avoid serious consequences. 

We will return to this topic, so if you are interested, keep an eye on our content! 

The end of the year is a time for entrepreneurs to close their accounts, budgets and projects. It is also the moment when most invoice receivables actually expire. If your company has outstanding invoices from 2023 and earlier, there is a high risk that at the end of this year you will lose the opportunity to effectively pursue payment in court.  

It is true that the debtor remains a debtor after the expiry of the limitation period. However, they gain a very powerful tool: they can raise the defence of limitation.   

You will then have a much bigger problem with enforcing your claim.  

After raising the defence of limitation, the court will dismiss your claim, and you will be left with an unpaid invoice, a lost case and the costs of the proceedings.   

In practice, this means that after the limitation period has expired, you can only count on:  

1. either a set-off against your debt (if you owe each other something), 
2. or the debtor’s goodwill – which, unfortunately, rarely works at that point.

When your receivables become time-barred – the most important deadlines 

From the point of view of running a business, there are three basic deadlines: 

• 2 years – receivables from sales made within the scope of the seller’s business (classic sales of goods between companies – Article 554 of the Civil Code) or a contract for specific work;
• 3 years – receivables related to business activities (typical B2B invoices for services, deliveries, some contractual penalties);
• 6 years – this is the general limitation period for receivables not covered by shorter periods (relatively rare in business-to-business transactions).  

The limitation period begins on the date on which the claim became due – most often this is the day following the invoice payment date (e.g. if the invoice payment date is set for 15 April 2023, it becomes due on 16 April 2023).  

In addition, the rule applies that if the limitation period is at least 2 years, it ends on the last day of the calendar year, and not exactly after 2 or 3 years ‘to the day’.  

This is why:   

• many invoices from 2023 (especially for the sale of goods) will expire on 31st December 2025,
• some claims from 2022 covered by a 3-year limitation period (e.g. B2B services) will also expire at the end of 2025.

Example – how it works in practice 

In May 2023, shipyard “Maritime New Wave” issued an invoice to “DEF” for the sale of a hull for a vessel, with a payment deadline of 30 June 2023. “DEF” did not pay, and the shipyard, busy with its current business, did not take any effective legal action, hoping that the payment would be made soon: 

• the claim became due on 1 July 2023,
• the limitation period (sale of goods, 2 years) would ‘nominally’ expire on 1 July 2025,
• but due to the end-of-year rule, the limitation period will not expire until 31 December 2025.  

If, by that date, shipyard “Maritime New Wave” has not taken any action to interrupt or suspend the limitation period, after the New Year the chances of successfully enforcing this invoice in court will fall to virtually zero.   

What interrupts the limitation period  

Interrupting the limitation period means that after the action is completed, the period starts counting again from scratch – as if the clock had been reset. The most important interrupting actions include, in particular:  

• filing a lawsuit for payment in court, 
• acknowledgement of the debt by the debtor – e.g. signing a settlement agreement (judicial or extrajudicial), written confirmation of the balance, request to spread the debt into instalments, partial payment,
• initiation of enforcement proceedings (by a bailiff),
• filing a claim in the debtor’s bankruptcy proceedings.  

From a business perspective, this means that instead of sending reminders for months on end, it is often more profitable to:  

1. try to obtain a settlement/acknowledgement of debt, 
2. prepare and, in the absence of a response, file a lawsuit.

Summons to settlement proceedings and mediation – only suspension  

Currently, filing a request for a summons to settlement proceedings or initiating mediation only suspends the limitation period – for the duration of the settlement proceedings or mediation.  

In practice, this means that:  

• the limitation period is suspended for the duration of the mediation/conciliation proceedings, 
• but after their completion, it continues from where it left off, 
• so if there is one month left before the limitation period expires, after the mediation is completed, there will still be only one month left.  

Therefore, a summons to a settlement attempt or mediation can be a valuable debt management tool, but should not be the only option for protecting a claim, especially at the end of the year.   

However, if it is not possible to file a lawsuit in the last days of the year, for example because the preparation of the formalities would take too long, a summons to a settlement attempt is a good solution:  

• firstly, it demonstrates the good will of the creditor, who does not want to initiate court proceedings immediately, 
• secondly, it suspends the limitation period, which extends the time limit for preparing the claim and the necessary documentation, in case the conciliation attempt is unsuccessful.   

Importantly, drafting a request for a settlement attempt is much less demanding than preparing a statement of claim. Therefore, even when acting at the last minute at the end of the year, calling on the debtor to attempt a settlement can effectively prevent the loss of the opportunity to recover your money.   

What does not affect the limitation period  

Many entrepreneurs live under the misconception that since they send payment reminders, they do not have to worry about the limitation period. Unfortunately, from a legal point of view:  

• payment reminders, reminders, emails, phone calls – do not interrupt or suspend the limitation period, 
• negotiations with the debtor alone – also do not stop time.  

These actions make sense in a business relationship, but from the point of view of the Civil Code, they are neutral – the limitation period clock continues to tick.   

What about interest on invoices  

Interest generally expires after 3 years, at the latest when the principal amount expires. However, if the principal amount has been paid and the dispute concerns only the interest, the latter – as periodic payments – generally expires after 3 years.  

Can the debtor waive the statute of limitations defence?  

Yes, the debtor may waive the statute of limitations defence, but only after the limitation period has expired. An earlier waiver (e.g. a clause in the contract stating ‘I waive the statute of limitations defence’) is ineffective.  

However, it is worth remembering that the vast majority of debtors wait for the limitation period to expire rather than waiving it. Basing a debt recovery plan on the hope that the debtor will voluntarily waive the statute of limitations is therefore, to put it bluntly, a very risky strategy.  

Patience does not pay off – especially at the end of the year  

 The closer we get to 31 December 2025, the less room there is for calm consideration and the more for concrete decisions. Delaying action against unreliable contractors for too long may mean:  

• the definitive loss of the possibility of pursuing claims in court, 
• no real chance of enforcement (debtors often dispose of their assets, change their form of business, or declare bankruptcy in the meantime), 
• the need to write off the invoice in full as an expense – not because of bad law, but because of a lack of response at the right moment.   

What to do now – in a few steps  

At the end of the year, we recommend a simple but very effective course of action for entrepreneurs:  

1.  Make a list of outstanding invoices – focus in particular on those from 2023 (sale of goods) and 2022 (B2B services). 
2. Check the limitation periods – determine the due dates, the relevant period (2, 3, 6 years) and the actual end of the period (usually 31 December of the given year). 
3. Decide on further steps – demand, negotiations, settlement, lawsuit, securing the claim, filing a claim in bankruptcy.
4. Consider seeking the support of a law firm – especially when the receivables arise from mixed cases (goods, services, transport, energy) or when partial payments, settlements or mediation have already taken place.  

The statute of limitations is not a ‘bad rule against creditors,’ but a test of activity and professionalism in receivables management. If you want your company to avoid paying for other people’s delays, the end of 2025 is the time when it is really worth looking at outstanding invoices with a calculator and a calendar. And preferably with a solicitor at your side.