Author: Informatyk A. Przybysz

Local content is undoubtedly a concept of fundamental importance when it comes to building a strong offshore wind industry in the Baltic Sea. That is why the government’s initiative, “Local Content: for the benefit of Poland”, which aims not only to define the concept itself but also to establish rules for its application, is of paramount importance for the energy transition, infrastructure investment and the entire offshore wind sector.   

We have already written about local content here, among other places: Local Content in offshore wind – challenges in defining the concept 

The definition, measurement methodology and proposed Code of Good Practice presented by the Ministry of State Assets (hereinafter: MSA) could have a real impact on how tenders are prepared, consortia are formed, supply chains are reported on, and bids are evaluated in energy projects. 

From slogan to standard 

For years, “local content” has featured in the Polish debate primarily as an economic demand. The aim was to ensure that as much of major infrastructure investment as possible remained within the country. In the offshore wind energy sector, the topic has been present since work began on The Polish Offshore Act (and thus as early as the Sector Deal stage!). But until now there has been no uniform, operational definition that could be applied by investors, contracting authorities, state-owned companies, suppliers and subcontractors. In short, there was no definition for all participants in the supply chain. 

The MSA’s project, “Local Content: for the benefit of Poland”, has been changing this perspective. The Ministry states that the aim of the programme is to localise supply chains. Particularly in projects carried out by companies in which the State Treasury holds a stake, and to enhance Poland’s strategic autonomy and economic security as a “key player” with a stake in the development of this sector of the economy.   

From a legal perspective, the most important point is that local content is beginning to evolve from a political declaration into a management, procurement and contractual tool. This means that in future investment projects, not only the price, deadline and experience of the contractor, but also the structure of the supply chain, the involvement of domestic entities, local service capacity, industrial expertise in Poland and transparency of reporting may become increasingly important. And all this in accordance with EU law, which guarantees that companies from across the European Union must be treated on equal terms with Polish companies. 

The government’s definition of the domestic component 

According to the approach presented by MSA, the “domestic component” refers to the value of goods or services produced or provided by a domestic entity, taking into account the criteria for classifying that entity as domestic. This definition is to be applied primarily in a pilot scheme for the energy sector, in which contracting authorities, suppliers and sub-suppliers will disclose the structure of the supply chain in forms submitted to the (GUS).   

This is a significant change. Local content is no longer understood solely in terms of the nationality of capital or the place of company registration. The government’s definition seeks to capture the actual economic contribution:   

• where the business is carried out,
• where added value is created,
• where taxes are paid,
• where employees are employed, and
• whether the business has a permanent presence on the Polish market. 

This approach may be of particular significance for offshore wind. The supply chain for offshore wind farms is inherently international. Turbines, foundations, cables, installation vessels, power systems, service ports, and design and operational services often involve entities from many different countries. However, this does not mean that domestic participation is impossible. On the contrary – it can occur at many levels: from the production of steel components, through port services, logistics, design, environmental studies, cybersecurity, maintenance, maritime transport, right through to staff training. 

Criteria for determining an entity’s “domestic status” 

The Code of Good Practice, which is no less important than the definition of local content itself, provides for a points-based assessment of a company’s domestic status. The criteria include, amongst other things: 

• the registered office of the ultimate parent company being in Poland,  
• the main business activity being carried out within Poland,  
• Polish tax residency,  
• the employment of more than 50% of staff who are Polish citizens or residents of Poland and who pay taxes and social security contributions in Poland,  
• a registered office in Poland, 
• at least three years of operation,  
• and the generation of more than 50% of annual turnover in Poland.  

Individual criteria are weighted between 10% and 25%.   

This means that enterprises will need to prepare in advance the documentation confirming their status. Simply being registered with the National Court Register (KRS) may not be sufficient. Tax information, the structure of the group of companies, the place where business is actually conducted, the employment structure, the proportion of turnover generated in Poland, and the method of documenting this information will also be relevant. 

In practice, this may lead to the creation of a new category of tender and contract documentation: 

• local content declarations,
• supplier questionnaires, reporting obligations to the contracting authority,
• subcontracting clauses,
• supply chain audit mechanisms,
• obligations to update data in subsequent years of the contract’s implementation. 

A particularly sensitive sector 

In the offshore wind energy sector, the issue of local content is not a new one. The Polish Offshore Act had already introduced a requirement to submit a supply chain plan for materials and services as part of the application process for support and during pre-qualification for auctions, with particular emphasis on the involvement of local entities. There is also a requirement to engage in technical dialogue with potential suppliers and to submit reports on the implementation of the plan. 

The MSA’s new definition could therefore complement the existing system. Until now, supply chain plans have primarily served an informational and stimulatory purpose. Now, local content will, by design, be measured more uniformly, and its level will become a factor in assessing management effectiveness, procurement policy and the investor’s reputation. It may also become a tool for monitoring the involvement of foreign companies in the construction of Poland’s critical infrastructure. 

The scale is considerable. The Polish Wind Energy Association (PSEW) estimates that potential investments could reach as much as PLN 900 billion in offshore wind and PLN 214 billion in onshore wind. This illustrates just how large a proportion of future investment expenditure could be covered by the debate on the domestic supply chain. 

Soft law, but tough consequences 

The definition of local content set out here is not introduced by a law that automatically changes all procurement procedures in Poland. Rather, we are dealing with a soft-law instrument, supported by the State Treasury’s ownership policy, the Code of Good Practice, KPIs for management boards, and reporting mechanisms. 

The Code of Good Practice states that it applies to contracts awarded by companies in which the State Treasury holds a stake, to the extent not covered by the Public Procurement Law. For public contracts covered by the Public Procurement Law, however, the State Procurement Policy for 2026–2029 remains the point of reference.   

This does not, however, mean that the documents issued by the MSA will be irrelevant. In state-owned companies, ownership guidelines, KPIs, internal procurement regulations and the expectations of supervisory boards can have a significant impact on contracting practices. For contractors and subcontractors, this means that local content may become a tangible element of business discussions, pre-qualification, technical dialogues and contract negotiations, ultimately affecting the competitiveness of Polish companies. 

Local content cannot amount to direct discrimination 

The greatest challenge will be to balance local content requirements with the principles of public procurement law, EU law and competition rules. In public procurement, preference cannot simply be given to a contractor solely on the grounds that they are based in Poland. The criteria must be objective, transparent, proportionate and relevant to the subject matter of the contract. 

It is therefore legally safer to formulate requirements based on the project’s actual needs. This includes security of supply, service availability, life-cycle costs, response times, cybersecurity, mitigation of logistical risks, the competence of the local team, the quality of operational support, transport emissions and maintenance capabilities.   

This means that local content should be designed as a set of legitimate procurement tools, rather than as an automatic national preference. Contracting authorities should therefore make use of needs analysis, the division of contracts into sections, quality criteria, requirements regarding continuity of supply, service clauses, and reporting obligations regarding subcontracting, as well as environmental and social criteria related to the subject matter of the contract. 

Significance for investors and contractors  

For offshore wind investors, the government’s definition of local content means that supply chain management must be approached in a more systematic way. It is worth identifying, as early as the project planning stage, those procurement packages where it is realistically possible to engage Polish suppliers. This applies in particular to design, port, logistics, maintenance, environmental, geotechnical, legal, consultancy, training and transport services, as well as certain aspects of manufacturing work. 

For contractors and suppliers, the definition of local content could become a business argument. Companies operating in Poland should prepare a “local content profile”, i.e. a set of data demonstrating their domestic contribution. This may include ownership structure, place of business, Polish tax residence, employment, local production or service facilities, experience in energy projects, the ability to work to offshore standards, and readiness to report. 

For foreign contractors, local content does not have to be a barrier. It can serve as an incentive to establish a stronger presence in Poland through the creation of subsidiaries, service centres and production facilities, partnerships with Polish companies, the transfer of know-how, joint ventures with local suppliers, and training programmes. 

Local content in contracts 

In offshore wind projects, local content will only be meaningful if it is translated into specific contractual mechanisms. In practice, it is worth considering including the following in contracts: 

• clauses requiring reporting of domestic content at the level of the contractor, subcontractors and further sub-suppliers, 
• an obligation to notify changes in the supply chain structure, 
• rules for the qualification of domestic entities according to the adopted methodology, 
• the contracting authority’s right to audit local content data, 
• commitments regarding the use of local maintenance facilities, 
• mechanisms for cooperation with Polish SME sector, universities, research institutes or training centres, 
• provisions concerning the protection of trade secrets and sensitive data,  
• rules on liability for false local content declarations.  

Particular care must be taken when processing data relating to employees. The criteria of employing more than 50% of staff who are Polish citizens or residents of Poland and who pay taxes and social security contributions in Poland may require the use of aggregated data, declarations and data minimisation procedures, so as not to create undue risks from a personal data protection perspective. 

Legal risks 

For contracting authorities, the greatest risks relate to an imprecise definition of the criteria for ‘Polishness’, excessive restriction of competition, a lack of connection between the requirement and the subject matter of the contract, disproportionate reporting obligations, and a discrepancy between the declared local content and the actual course of the contract’s performance. 

For contractors, the risk lies in making overly ambitious commitments that cannot be met within the subcontracting structure. In offshore wind projects, where schedules are tight and the availability of components and installation vessels is limited, any commitment regarding domestic participation should be preceded by a realistic market analysis. Excessive promises may lead to contractual disputes, contractual penalties, loss of credibility or problems in subsequent tenders. 

It will also be important to strike a balance between protecting trade secrets and meeting reporting obligations. The supply chain in the offshore wind sector can be multilevel, and data on suppliers, margins, the origin of components or cost structures may be of competitive significance. Therefore, local content documentation should be prepared in advance, rather than only at the stage of an audit or a dispute. 

Is legislation needed 

The fact that the changes are not being introduced by legislation requires separate consideration. The main concerns relate to the effectiveness of the proposed measures. However, it seems that the absence of a separate local content act does not necessarily undermine the new approach. In many areas, internal procurement policies, good practices, dialogue with the market, KPIs for management boards, reporting pressure and the professionalisation of procurement may be of greater significance. At the same time, the absence of a statutory regime means that each contracting authority should very carefully select the legal instruments appropriate to the type of procedure: different rules apply to public procurement, sectoral procurement, private procurement, and contracts of companies with State Treasury shareholding outside the Public Procurement Law. 

That is why, when advising investors, contractors and suppliers in the offshore wind sector, rather than asking whether local content “applies”, what we should do is to analyse how to integrate it correctly, safely and effectively into the investment process, turning it into an asset rather than an obstacle. 

What needs to be done now 

Entities operating in the offshore wind sector should start by auditing their own supply chain. It is worth checking which parts of the project can be carried out by domestic entities, what data is available, what the subcontracting structure looks like, and whether the contracts allow for the collection of the information needed for reporting. 

Next, an internal, consistent local content procedure must be established: who collects the data, how it is verified, who makes the declarations, which documents are archived, and how trade secrets are protected. In the case of larger corporate groups, it may also be necessary to agree on a uniform reporting methodology across the entire group. 

Finally, it is worth communicating your capabilities regarding local content as early as the technical dialogue or tender stage. In the coming years, suppliers who not only possess technical expertise but can also demonstrate their contribution to the Polish economy may gain a competitive edge.  

Summary 

It appears that the government’s definition of local content is not merely an economic policy slogan. It signals a new standard for strategic investments in energy, infrastructure and industry. For offshore wind, this could be one of the key elements of the next stage of market development. 

However, the most important thing will be for local content to be implemented in accordance with the law, transparently and proportionately. If well-designed, it can support Polish companies, increase the resilience of supply chains and strengthen energy security. If poorly designed, it can lead to disputes, allegations of discrimination and inefficiency in procurement. 

For investors, contracting authorities and suppliers, this means one thing: local content is becoming an element that must be managed just as professionally as the schedule, budget, regulatory risks and contract documentation.

The new rules introduce a requirement to obtain an operating permit for certain foreign vessels operating in Polish maritime areas. This is an important change for shipowners, operators and contractors involved in offshore wind projects in the Baltic Sea.

In practice

If a foreign vessel is expected to operate in Polish maritime areas for more than 14 days in a year, the requirement to obtain an operating permit should be factored in already at the contract and charter planning stage.

The October 2025 amendment to the Act on Promoting Electricity Generation from Offshore Wind Farms, commonly referred to as the Offshore Wind Act, attracted a great deal of attention. Much less attention was paid to the amendment to the Maritime Safety Act, even though, from the perspective of the offshore market, it may have significant practical consequences.

The new provision addresses a problem that the offshore sector and shipowners had been facing for several years. It concerns the lack of real requirements and effective supervision over certain foreign non-convention vessels operating in Polish maritime areas.

The new Article 86¹ applies to foreign-flag vessels that are not subject to the SOLAS Convention, that is, the international safety requirements for larger ships. In practice, this mainly concerns smaller working vessels below 500 gross tons, including Crew Transfer Vessels (CTVs), guard vessels, survey vessels, small port tugs and other vessels supporting offshore operations. These are the vessels that carry out many of the day-to-day tasks required for the construction and operation of offshore wind farms.

Why this change was needed

Under the previous rules, the Polish maritime administration did not have effective tools to supervise some of these foreign vessels when they operated in Polish maritime areas. In practice, some of them operated on the basis of national certificates issued by the flag state, for example the MCA Small Commercial Vessel Certificate in the United Kingdom.

Such documents were not always regarded as equivalent to the class assigned by recognised classification societies that are members of IACS, the International Association of Classification Societies. These include, among others, DNV, Lloyd’s Register, Bureau Veritas and the Polish Register of Shipping (PRS).

This mattered not only for safety, but also for market competition. Some foreign shipowners could offer services at a lower price because they did not bear the same costs related to class, technical supervision and compliance that, in practice, were imposed on entities operating under the Polish flag.

The issue became more visible as offshore projects in the Baltic Sea developed and more foreign vessels started to work there on a permanent basis.

What the amendment changes

If a foreign-flag vessel that is not subject to the SOLAS Convention is to operate in Polish maritime areas for more than 14 days in a calendar year, the shipowner must first obtain an operating permit.

The permit is issued by the director of the competent maritime office. An inspection by a recognised classification society is also required.

What documents need to be prepared

In particular, the application should include:

• a description of the planned operation of the vessel, including routes, home port and the planned duration of offshore operations,
• consent from the flag state administration,
• the vessel’s certificates and class documents,
• a document confirming that the vessel meets requirements no less stringent than those applicable to vessels under the Polish flag; this document should be issued by a recognised organisation after a technical inspection of the vessel.

The permit may be issued for a maximum period of five years, but not longer than the validity period of the vessel’s documents.

What this means for the market

From a market perspective, this is an important change.

First, it increases the level of safety because a real technical inspection is carried out before a vessel is allowed to operate.

Second, it reduces competitive differences between vessels under the Polish flag and those under foreign flags.

Third, it affects the planning of contracts and charter arrangements because the permit procedure must now be taken into account at an early stage.

How it works in practice

The Maritime Office in Gdynia has already published a procedure describing how to obtain the permit. It makes clear, among other things, that the authority does not assist in obtaining the document from a recognised organisation, so the shipowner is responsible for preparing the complete set of documents.

The procedure also indicates the applicable inspection fee and assumes that the proceedings should be completed within one month from the submission of a complete application.

Summary

The new rules close an important gap in the system and introduce more uniform requirements for vessels working on offshore wind projects in Polish maritime areas.

For shipowners, operators and contractors, the message is clear: when planning the operation of foreign vessels in the Polish part of the Baltic Sea, it is now necessary to consider not only operational and contractual matters, but also the obligation to obtain the relevant permit.

Contact

Do you have questions about vessel operations in offshore wind projects, maritime administration requirements or planning vessel operations in Polish maritime areas?

Contact the lawyers at Wind & Water Legal Zbroja Adwokaci i Radcowie Prawni sp. k. We advise on vessel operation planning, administrative obligations and mitigating regulatory risks related to offshore wind projects in the Baltic Sea.

It is two in the morning. You are sailing in the Mediterranean alone or with a small group. The radar is clear. AIS shows no vessels nearby. 

Then, suddenly, an alert appears on the screen: a small object 180 meters off the bow. 

The thermal camera shows a drifting dinghy. It is empty, and you can breathe a sigh of relief. 

This story is fictional, but it could happen in real life. Meanwhile, this is exactly how artificial intelligence-based systems work, and they are increasingly finding their way onto yachts. 

In today’s yachting, artificial intelligence is increasingly helping people at sea. However, these systems still only perform a supporting role. They do not take control but warn the crew of an impending danger. 

Yacht owners value the ability to sail the vessel themselves, but they also appreciate an extra “eye” that improves safety and comfort. This makes it easier to spot dangers that cannot be seen by ordinary radar or AIS systems, let alone the human eye. 

In cooperation with SEA.AI, one of the leaders in computer vision on the water, we show how those support systems work and what legal challenges they create. 

How the system works 

SEA.AI is an advanced system based on optical and thermal cameras combined with artificial intelligence algorithms. The cameras monitor the surroundings in real time – they also operate in low-light conditions, at night in the most difficult weather conditions. 

The system detects and recognises objects on the water surface, such as: 

• drifting containers and rubbish,
• kayaks, jet skis, dinghies and boats without AIS,
• buoys, pieces of wood, pieces of ice,
• whales and orcas,
• people overboard,
• sea mines. 

SEA.AI complements radar and AIS, filling in their gaps. Radar often misses small objects, especially in high waves, rain, interference or at a bad angle. In addition, it has blind spots close to the yacht, and its effectiveness depends on the operator’s experience. 

In recreational yachting, the system does not replace the captain. It does not take over the helm or manoeuvres – it remains a tool that supports the crew. It acts as an extra pair of eyes that constantly monitors the surroundings and warns of potential hazards. 

The system also offers practical functions to support observation. For example, it can automatically keep a selected object in the centre of the image (such as a person overboard) and, when sailing, automatically adjusts the camera towards the bow, the most important part of the field of view. 

The system analyses images from AI-supported optical and thermal cameras, generates acoustic alarms for the crew, and displays detected objects on navigation maps, phones, tablets, and computers, which significantly increases the crew’s situational awareness and translates into high effectiveness in detecting objects around the vessel. 

Since 2018, SEA.AI has installed over 1,200 systems and collected a database of over 24 million tagged objects. As a result, their algorithms are constantly learning and becoming more accurate. 

It is also worth noting that SEA.AI is used, for example, on IMOCA class yachts in the Vendée Globe race. More than half of the fleet used it as a ‘second pair of eyes’ during their solo circumnavigation of the globe, detecting drifting objects invisible to radar or AIS. 

Function of systems in yachting 

With luxury yachts, often worth several million euros, even the smallest collision or contact with an object can cause serious problems. It is not just a matter of human safety – it is also about the aesthetics and value of the vessel. A small scratch, paint damage or contact with a buoy, dinghy or even driftwood can ruin the perfect appearance of the hull. 

Repairing such damage can be costly. Systems such as SEA.AI help to avoid such ‘cosmetic’ incidents. Early detection of a small object (even up to several hundred metres away) gives time for a calm manoeuvre – without panic, without the risk of scratches or abrasions. 

It not only protects against serious collisions, but also minor contacts. 

Legal liability 

Imagine a collision in the harbour. The system sounds the alarm, but the captain continues sailing.  

The decision is theirs. He will be held responsible if he ignores the alarm and even the slightest collision occurs.  

A yacht equipped with support systems is still operated by humans. In the event of a collision involving the yacht, liability usually begins with the operator (the owner of the vessel). He is responsible for ensuring that the yacht has functioning equipment and that the crew knows how to use it. 

So, who is responsible? 

• the captain – makes the decisions.
•  the crew – carry out the captain’s orders.
• the operator – should ultimately have the appropriate insurance. 

If the AI system fails to detect an object due to an error in the algorithm, the manufacturer will still not be held liable. All developers of such solutions emphasise that the systems are designed to assist, not replace. 

Liability could fall on the manufacturer of monitoring solutions only if a false alarm led to damage being caused. Is this possible in practice? Yes. But is such a scenario likely to occur? No. 

In practice, manufacturers are constantly developing their systems, so it is important to ensure that they are always up to date and correctly installed. This is not only a matter of responsibility, but also of cyber security. 

Complications with fully autonomous units 

Imagine a yacht sailing at night, without a captain or crew – the system makes all the decisions itself. When it approaches a drifting container, it decides whether to turn, accelerate or avoid the obstacle. Sounds futuristic? This is the fourth level of autonomy according to the International Maritime Organisation (IMO) – full autonomy, where the system operates independently. 

Degree One – a vessel with automated processes and decision support 

• There are always sailors on board who operate and monitor the systems.
• Some operations can be automated and sometimes run without supervision, but the crew is ready to take the helm at any time. 

Degree Two – remotely controlled ship with sailors on board 

• The yacht is controlled from another location, but there are sailors on board who can take control and operate the systems. 

Degree Three – remotely controlled ship without sailors on board 

• The yacht is remotely controlled from another location.
• There are no sailors on board. 

Degree Four – fully autonomous ship 

• The yacht’s operating system makes decisions and determines actions independently. 

If yachts became completely autonomous – with no crew on board and a system that makes decisions independently – the issue of legal liability would become extremely complicated. 

International conventions such as COLREG assume that there is a captain or crew on board who responds to threats. In the case of full autonomy, there is no clearly defined person responsible for the ship, which makes it difficult to assign blame in the event of an accident. 

In practice, responsibility could lie with many entities: the operator, the AI system manufacturer, the software developer, the sensor supplier, or even the remote-control centre operator. 

In yachting, full autonomy is still a dream of the future. Imagine a yacht sailing alone across the ocean, deciding on every manoeuvre, avoiding drifting containers and buoys without a captain on board. It sounds fascinating, but in legal practice it is a maze – maritime law still assumes the presence of a person who makes decisions and is responsible for the vessel. 

In fact, it is not just about law and safety. Yachting is a pleasure. Everyone wants to feel the wind on their face and steer their own yacht sometimes – after all, that is what it is for. Assistance systems such as SEA.AI are the perfect compromise: they increase safety, warn of dangers, but do not take away the joy of steering independently. Full autonomy may come one day, but today, what matters most in yachting is the pleasure of being at sea. 

Summary 

Fully autonomous yachts are still a long way off, not only because of technology, but also because of the law. The sea is unpredictable, and even the most accurate algorithms can make mistakes. That is why the law requires someone to be clearly responsible for decisions – a specific person, not a system. 

Most owners therefore prefer to remain the captain of their own yacht. That is why assistance systems such as SEA.AI are the ideal compromise: they increase safety and warn of dangers, but do not take away the pleasure of steering. 

This is not a revolution, but a sensible step forward. The sea is too unpredictable to leave everything to a machine – at least for now. After all, sailing is not only about reaching your destination, but also about the joy of steering your own yacht. 

This article was created in collaboration with SEA.AI, a company that develops artificial intelligence systems supporting safety and navigation at sea. The knowledge and experience of the SEA.AI team in the field of technologies used on autonomous yachts helped to present current solutions and directions for the development of artificial intelligence in yachting. 

Consultation: Agata Widuto

In recent years, multihull yachts have gained popularity. Although their concept was born long ago, they have only recently achieved success in recreational sailing.

What is a multihull?

A multihull is a vessel that has more than one hull. A vessel with two hulls is called a catamaran, while one with three hulls is a trimaran. Very rarely, there are vessels with more than three hulls, typically used for specialized purposes. 

Advantages and disadvantages of multihulls 

• Stability and safety – one of the greatest advantages of multihulls is their high stability, resulting from their wide beam. Compared to monohulls, they have significantly smaller heeling angles during sailing, which increases crew comfort and a sense of safety.
• Speed – multihulls often achieve higher speeds than monohulls of the same length, mainly due to lower hydrodynamic resistance and the lack of ballast. This allows for more efficient sailing, especially on favorable courses and wind conditions.
• Space – with two hulls, there is significantly more space, both inside and outside. This provides more room for cockpits, storage, and other amenities.
• Maneuverability – multihulls typically have two separate engines, one in each hull. This allows the yacht to rotate in place, providing greater control and reducing the impact of tides and wind during navigation.
• Comfort – all of the previously mentioned factors contribute to greater comfort while sailing, especially for families and people prone to seasickness.
• Experience – some argue that multihulls do not offer the same sailing experience as monohulls. Monohulls are less stable and more susceptible to wind and waves, making sailing more exciting.
• Transport – monohulls are smaller, and thus easier to transport. If you plan to transport your boat, this is something to consider when making a purchase.
• Maintenance – a hull requires regular cleaning and protection. Having more hulls means more work or costs. The same applies to engines.
• Costs – multihulls are more expensive to produce, and therefore, their price is higher.

Important provisions in the sales agreement 

If you’ve already decided on a multihull, it’s important to pay attention to specific provisions in the sales agreement related to this type of vessel, which should address: 

• responsibility for inspecting each hull individually,
• structural condition of the crossbeam (i.e., the wider beam – cross elements running between the hulls),
• a detailed handover protocol, divided by hulls and onboard equipment,
• conditions for rejection after a survey revealing structural defects,
• costs of testing and insurance (which will typically be covered by the buyer). 

The agreement should also specify how the multihull yacht will be handed over. Due to the size of these vessels, the transport cost is significantly higher compared to monohull equivalents. It’s important to define whether the handover will take place on land, on water, or ready for further transport. 

For more information on yacht sales agreements, see here: Pitfalls in yacht acquisition agreements – how to avoid troubles?

For tax-related matters related to the purchase, see here: New yacht and VAT – do you need to pay and when?

Market situation 

The market for the most popular multihulls, catamarans, is growing dynamically. Depending on the source, its value is estimated to be between 900 million and 2.2 billion dollars. In 2024, according to analysts, catamaran sales doubled compared to the previous year, accounting for one-third of total yacht sales. Forecasts predict continued, intense growth in the coming years – by 2030, the market value is expected to reach between 1.5 billion and approximately 3 billion dollars.

source: https://www.mordorintelligence.com/industry-reports/catamaran-market

source: https://www.marketgrowthreports.com/market-reports/powered-catamaran-market-107733

Summary 

Multihull yachts are increasingly asserting their position in the yachting market, becoming an attractive alternative to monohulls. With high stability, more space, excellent performance, and enhanced sailing comfort, they are particularly well-suited for recreational, family, and charter sailing. However, they require an understanding of their specifics – higher purchase and maintenance costs, greater service requirements, and a somewhat different “sailing experience.” The dynamic growth in sales and optimistic market forecasts indicate that multihulls have already become one of the most important segments of the modern yachting market.

Do you know that slight unease before visiting a doctor? Especially for the first time? Will they listen to me? Will they understand me? Will I understand them? Will I forget to mention something? And depending on personal traits, the rest of the similar dilemmas.

Yes, this is another reference to doctors, because – just like with lawyers – we don’t go to them for trivial matters but for problems. And with all due respect to other professions, it’s easier to deal with a bad haircut or a leaking washing machine than with the prospect of surgery or imprisonment. 

The stress level before the first meeting with a lawyer can, of course, be very high, depending on the matter we’re bringing in. In the mindset of many people, a visit to the law office is a last resort, a sign that something went wrong in their business (or life) and they can’t handle it. While many entrepreneurs’ awareness is changing, for a large portion, a lawyer is still seen as someone who puts out fires. And when there’s a fire, it’s a disaster. 

The client walks in and doesn’t know what to do 

So, this client walks in, stressed about their situation and the fact they need to tell someone about it. It’s great if they immediately see someone in an obvious spot, so there’s no doubt that they can approach them. It’s worse if there’s no clear place, or no one they can speak to. It feels a bit like standing at the entrance of a restaurant, seeing a sign that says, “Please wait here,” and then no one comes to greet you for the next ten minutes – not even a glance. 

Let’s assume the client enters the office, sees the reception desk, but there’s no one behind it. No one acknowledges their arrival, and they stand there, waiting. They look at their watch – the meeting is in a minute, but they left early to avoid being late. They start nervously moving around, and eventually peek into the rooms, apologizing for interrupting, and explain they’re there for a scheduled meeting.

Has their stress level increased before the meeting? Definitely. Perhaps this situation even irritated them a little. Did it make them wonder if anyone is working here? If anyone is engaged? It might, especially if they pay attention to such things or if customer service in their own business works very differently. Finally, did they feel safe in this situation? Comfortable? Certainly not.

Our core value is safety 

We don’t let situations like this happen. In our Client Service Procedure, we clearly define that during office hours, someone must always be at the reception desk. We know who is filling in and when, and what to do if the reception desk is temporarily empty. There is absolutely no option for a client not to know what to do, where to go, or not to be welcomed and invited into a conference room, or asked to wait. And absolutely everyone must be able to do this and feel responsible for it. No matter how complex their tasks may be, everyone should be ready to help the client. 

A client must feel safe and comfortable in the office – not only in the substantive aspect but also in the organizational one. That’s why procedures are necessary. The first contact can truly make a significant difference. 

The NIS2 Directive (Network and Information Security 2) is a new legal act that replaces the earlier NIS1 Directive of 2016. The Directive entered into force on 16 January 2023, and Member States were required to transpose it into their national legal systems by 17 October 2024. Poland, like France, Spain, the Netherlands, Luxembourg, and Bulgaria, has not yet completed this process. However, the national legislative process is currently at an advanced stage.

Objective of the Directive

The primary objective of the Directive is to strengthen protection against digital threats across the European Union. It introduces uniform cybersecurity rules for sectors that are critical to the economy and society, including energy, transport, healthcare, digital infrastructure, banking, and the maritime economy. The regulation obliges Member States to develop national cybersecurity strategies, enhances cross-border cooperation in responding to major incidents, and grants supervisory authorities stronger powers to monitor compliance and enforce the provisions.

What does the implementation of the NIS2 Directive look like in Poland?

In Poland, the NIS2 Directive is being implemented through an amendment to the Act on the National Cybersecurity System. To date, the legislative work has involved two draft bills. However, it was only the second draft that softened the most heavily criticised solutions, including, among others:

• the mandatory application of ISO standards, which was ultimately abandoned,
• the deadlines for conducting the first audit, which were extended,
• supply chain requirements, which were limited to direct suppliers.

The draft amendment adopted by the government:

• expands the catalogue of entities subject to the obligations,
• introduces new incident response teams (sectoral CSIRTs),
• strengthens the powers of supervisory authorities, such as the Minister for Digital Affairs and CSIRT GOV.

Entities covered by the new regulations will be required, inter alia, to conduct risk assessments, implement security measures, train employees, and report incidents. It is anticipated that the new provisions will enter into force around mid-2026.

The maritime sector – who is covered

Importantly for businesses, the NIS2 regulations introduce a differentiated supervisory model. Under this model, certain organisations will be subject to particularly intensive supervisory obligations. This applies to so-called essential entities, for which the legislator has envisaged more far-reaching oversight than for other participants in the system. The transport sector, including maritime transport, is classified as an essential sector due to its significant role in the economy and society.

In practice, the NIS2 regulations primarily affect entities operating on a larger scale, which ensure the continuity of transport and logistics processes. These are mainly organisations that employ at least several dozen employees and generate substantial annual revenues.

In the maritime sector, this primarily concerns:

• operators of maritime, inland waterway, and coastal transport (both passenger and cargo),
• port authorities,
• entities carrying out work and operating equipment within ports,
• operators of vessel traffic systems.

Such entities will be required to implement the full set of NIS2 requirements. It should also be emphasised that the size criterion is relevant, although it is not always decisive. In certain cases, inclusion under the regulations depends on the importance of a given activity for the functioning of the state or for ensuring the continuity of services.

This approach ensures that protection covers the entire critical maritime infrastructure, which is vulnerable to cyberattacks capable of paralysing trade and logistics.

Obligations for maritime entities and the significance of NIS2

• Entities operating in the maritime sector will be required to:
• regularly assess cybersecurity risks to IT and OT systems (operational technology, e.g. port control systems),
• implement incident response procedures and report serious breaches,
• train personnel on digital threats,
• ensure supply chain security (although, in the Polish draft, this has been limited to direct suppliers),
• cooperate with other entities and authorities in the exchange of information on threats.

A key novelty is the explicit emphasis on the responsibility of senior management for overseeing the implementation of cybersecurity obligations. This means that cybersecurity issues cease to be the exclusive domain of IT departments and become an element of managerial accountability.

The implementation of NIS2 is undoubtedly a challenge in terms of costs, as it involves investments in technology, audits, and training. However, it also delivers numerous benefits by strengthening resilience to incidents, which in the long term will help minimise financial losses and the risk of losing critical data. It also enhances international cooperation and improves the exchange of information on threats.

From a reputational perspective, the regulations may also affect competitiveness and development opportunities. Companies that meet high cybersecurity standards gain the trust of global partners, while the modernisation of IT/OT systems can deliver operational efficiencies (e.g. in offshore wind projects or logistics).

The significance of the ISPS Code

The International Ship and Port Facility Security (ISPS) Code was developed in response to global security threats that emerged at the beginning of the 21st century and led to strengthened protection of port and maritime infrastructure. ISPS regulations focus primarily on a systemic approach to the security of ports and vessels, encompassing threat assessments, the organisation of protective procedures, and the preparation of personnel to respond to incidents. The NIS2 Directive extends this approach into the area of cybersecurity, placing emphasis on the resilience of information and technological systems to increasingly sophisticated digital threats.

Integrating NIS2 requirements with existing ISPS mechanisms enables ports and maritime operators to build a coherent security management system in which physical and digital risks are analysed jointly and incident response is coordinated.

For Polish ports, this represents an opportunity to modernise security systems. Combining the new procedures introduced by the Directive with existing security plans based on the ISPS Code will help avoid duplication of efforts and create a single, coherent risk management framework covering both digital and physical security.

Current situation in the maritime sector

As of December 2025, the Polish national legislation implementing NIS2 has not yet entered into force, and the legislative process is in its final stage. This means that entities operating in the maritime sector are not yet subject to formal obligations arising from the new act.

However, many port operators and shipowners are already voluntarily preparing for implementation. This includes modernising IT infrastructure, integrating NIS2 procedures with existing ISPS security plans, and investing in training.

The maritime sector is facing significant changes, but the full set of obligations will only apply once the amendment to the Act on the National Cybersecurity System is adopted and enters into force—most likely in the first half of 2026.

The NIS2 Directive represents an important step towards strengthening cybersecurity across the European Union. For seaports and maritime sector entities, it entails not only new regulatory obligations, but above all an opportunity to enhance operational resilience and competitiveness.

Sailing, especially on large, open waters, has always carried many risks. Some of these risks can be more easily mitigated (e.g., by building vessels with better construction), while others can only be prevented (e.g., by anticipating adverse weather conditions). 

In today’s world, however, there is another emerging threat – the risk associated with cybersecurity. 

On a yacht, this is not only a technological issue but also a legal one. It can have significant implications for owners, shipowners, and the crew. Ensuring the vessel’s cybersecurity is becoming increasingly important for the safety of navigation, data protection, and avoiding potential legal liability. 

Cybersecurity as an element of maritime safety 

Cybersecurity is the organised management of risks associated with the use of IT systems. 

IT systems affect the daily work of the crew, passenger comfort and overall navigation. These include, for example, Wi-Fi networks and crew and passenger computers. Problems with these systems can delay a voyage, disrupt communication or cause data loss. 

Some of them, such as autopilot systems or propulsion control, have a direct impact on the physical operation of the yacht. Disruption of their operation can lead to loss of controllability, navigation errors or loss of communication. 

The yacht also processes the personal data of crew members and passengers. Violation of personal data protection rules resulting from a lack of adequate security measures may in turn lead to claims or notification obligations. 

Therefore, ensuring cybersecurity on board is an integral part of maritime safety. 

Example:
During a cruise in the Mediterranean Sea, a luxury yacht suddenly changes course. It turns out that a cybercriminal has taken control of the autopilot. The crew must quickly regain control to avoid running aground. 

International rules and regulations 

Cybersecurity rules on yachts are governed by international law. The International Maritime Organisation (IMO) introduced the obligation to include cyber risk in the International Safety Management (ISM) system in 2017. In 2024, an industry shipping consortium involving BIMCO (Baltic and International Maritime Council) and others issued specific guidelines on this issue. 

Although these regulations mainly apply to commercial vessels, their principles are equally important for yachts. Compliance with them can help manage risk, limit legal and financial liability, and keep documentation in order. 

Example:
The yacht owner regularly audited the systems in accordance with IMO guidelines. During the attack attempt, critical areas were protected, which prevented an incident and avoided costly claims. 

Cyber risks on a yacht – what are we facing? 

Cyber threats on a yacht can come from various sources. Here are the most common problems that may occur while sailing: 

1. Targeted attacks – cybercriminals can take control of yacht systems, such as the navigation system, leading to a change of course, data theft or disruption of yacht operations.
2. Accidental attacks – e.g. installing software that contains a virus that can infect systems.
3. Crew errors – crew members may accidentally introduce a threat, e.g. through improper management of access to IT systems.
4. Supplier errors – suppliers who do not adhere to appropriate security standards may introduce devices or software that are vulnerable to attack. 

Common cyber threats include: 

• phishing – attacks involving impersonating trusted sources in order to obtain login details,
• malware – malicious software that infects systems,
• ransomware – locking systems and data and demanding a ransom,
• Wi-Fi attacks – taking control of the Wi-Fi network on a yacht,
• navigation manipulation – e.g. manipulating GPS data in order to steer a yacht onto a dangerous course. 

Example:
A young crew member connects his phone to the on-board network, unknowingly introducing malware that blocks the yacht’s computers and compromises passenger data. 

Cyber risk management cycle – IMO and NIST 

Cyber risk management is based on a cycle consisting of five steps: 

1. Identification – identifying resources and threats related to IT systems,
2. Protection – implementation of appropriate security measures, such as access and user control,
3. Detection – monitoring systems for threats and analysing logs,
4. Response – taking corrective action in response to an incident,
5. Recovery – restoring normal operations after an incident and securing systems.

This cycle, developed by IMO and NIST, should be activated regularly, especially after any system changes or incidents. 

Example:
Upon detecting unusual activity in the logs, the team immediately implemented the response and recovery procedure, minimising the impact of the attack. 

Responsibilities of the owner, operator, crew and suppliers 

Cybersecurity management on a yacht is not the responsibility of just one entity. There are five entities, each with its own specific duties in this regard: 

• owner: responsible for ensuring adequate financial resources for the implementation and maintenance of the cybersecurity system, defining security policies and conducting regular reviews,
• operator: manages cyber risk, verifies service providers, provides crew training,
• crew: complies with access policy, monitors systems and reports any irregularities,
• suppliers: ensure that their products comply with cybersecurity requirements, secure devices and software,
• passengers: they have no specific responsibilities, but should comply with the cybersecurity rules on board.

Cybersecurity is an issue that cannot be ignored from any perspective. A threat to a yacht from one of the entities mentioned above may pose a threat to all. 

Example:
A new navigation system was installed on a yacht, but the supplier did not verify the relevant security measures. Thanks to the shipowner’s vigilance, the vulnerability was detected and immediately removed. 

Protective measures and procedures 

There are simple and common measures to increase cybersecurity on a yacht. From the perspective of those responsible, it is definitely worth implementing: 

• network segmentation – division into zones (guests, staff, critical systems) to minimise the risk of threats spreading,
• access management – use of strong passwords, differentiation of passwords in different systems, regular password changes,
• software updates – regularly updating systems from trusted sources,
• security policy – implementation of procedures concerning access, use of external devices, system monitoring and incident response. 

Imagine a yacht as a hotel – only people with the appropriate “key” are allowed access to the navigation systems, which reduces the risk of unauthorised access. 

Conclusion 

Cybersecurity on a yacht is an important element of navigational safety management, data protection and legal risk minimisation. The use of appropriate protective measures, system monitoring, compliance with regulations and the implementation of incident response procedures help to reduce risk and ensure safety on board. Although cyber attacks in the maritime environment may seem rare, it is worth implementing the recommended procedures to avoid serious consequences. 

We will return to this topic, so if you are interested, keep an eye on our content!