Conventional ship approval is a checklist: does it have the equipment the rules require? The MASS Code is goal-based: does the safety case demonstrate that the risks of this specific design are identified and bounded? That shift — from compliance to argument — is the regulatory difference that makes autonomous ships possible and simultaneously makes them hard to approve.
For an AI-driven system the risk-assessment exercise is doubly hard: the system's failure modes are probabilistic, data-dependent, and still being discovered — the hazard list isn't a bounded set, it's a frontier.
Key findings
- MASS approval is goal-based: the safety case must demonstrate hazards identified and bounded — not equipment present. Established
- AI's failure modes are probabilistic — a model doesn't fail by breaking; it fails by being confidently wrong in a way the test didn't cover. Established
- The data-dependence problem: the hazard set changes with the deployment environment, the sensor suite and the model version — the assessment isn't one-time. Established
- Scenario-based coverage is the emerging method — enumerate the failure space, test it — but the space is unbounded. Research demonstration
- The risk-assessment output feeds the operating envelope — the two concepts are the same mechanism seen from two sides. Maritime-GPT analysis
The goal-based shift
A prescriptive rule says 'the ship shall have X'. A goal-based code says 'the ship shall achieve outcome Y, and you must show your design does it'. For an AI system — a component with no parts list — the only honest approval is the second: the safety case becomes a structured argument, backed by evidence, that the hazards are known and mitigated. That's harder than a checklist, and it's the only structure that can contain a learning system. Established
What the hazards actually are
- <strong>Model failures.</strong> Wrong classification, missed target, misread rule — the probabilistic errors that don't break the system but break the case. Established
- <strong>Data drift.</strong> The model trained on one season's traffic meets another's — the hazard that arrives without an update. Maritime-GPT analysis
- <strong>Sensor and link failures.</strong> The perception and connectivity degradations that feed the model bad inputs — the failure the fallback exists for. Established
- <strong>Interaction hazards.</strong> The system acting correctly per its model and wrongly per the situation — the emergent-convention problem of the multi-agent literature. Research demonstration
- <strong>Human-factor hazards.</strong> Automation bias, out-of-the-loop performance, alert fatigue — the human is part of the hazard picture, not separate from it. Established
The coverage problem
Risk assessment is only as good as the hazard list — and a learning system's list is open-ended. The method that's emerging is scenario-based: enumerate the encounter types, the failure injections, the environmental corners; test each; document the coverage. But the number of scenarios needed to bound the risk grows with the system's complexity and the environment's variability — the exercise is asymptotic, not finite. The practical answer is the same as the certification one: bound the operating envelope, bound the risk. Maritime-GPT analysis
The assessment is never finished
A static system's hazard list converges; a learning system's grows. Every model update is a new risk profile; every new deployment environment is a new hazard set; every reported incident adds a hazard the original assessment missed. The MASS Code's structure anticipates this — the risk assessment is a living document tied to the change process, not a survey artifact filed once. The ship that updates its model updates its safety case. Maritime-GPT analysis
What we know
- Goal-based approval = a safety case that demonstrates bounded risk, not an equipment list.
- AI's probabilistic, data-dependent failure modes resist closed-form hazard lists.
- The risk assessment is continuous — tied to every model update and environment change.
What we don't
- A settled methodology for bounding a learning system's hazard space.
- How much scenario coverage constitutes 'enough' for approval.
- How the risk case survives a model retrain without re-survey.
Being tested
- Scenario libraries and coverage metrics for maritime AI.
- Continuous-assessment frameworks tied to CI/CD-style model updates.
- Structured safety-case argumentation (GSN-style) for autonomous ships.
Maritime-GPT analysis
Risk assessment is the mechanism by which the MASS Code turns 'is it safe?' into 'show me how you know'. For a learning system the answer can never be 'we tested it once' — it has to be 'here is the process that keeps it verified as it changes'. The operators who understand that the safety case is a living system, not a document, are the ones whose ships will certify. The ones who treat it as paperwork are the ones whose ships won't sail. Maritime-GPT analysis
This is a research feature, not operational guidance. Simulation results are reported as simulation; demonstrations are not deployments; company claims are attributed as such. Verify safety-critical decisions against official nautical publications and flag-state requirements.
Sources & evidence
The goal-based instrument the risk assessment serves.
The safety-management tradition the risk assessment extends.
The certification side of the same safety-case problem.