When autonomous ships collide, who keeps the log?

The paper

A research paper by Farzaneh Javadi, published on SSRN in January 2025, looks at what happens when an autonomous ship collides with another vessel and the only record of what the software decided is held by the software vendor ^[1].

The paper is titled Insuring Maritime Autonomy and addresses hull and machinery insurance for autonomous and semi-autonomous vessels. It identifies concentration risk as a new problem for marine insurers: when many ships run the same navigation software, a single defect could trigger claims across fleets, and in each case the evidence sits with the vendor who built the software.

The paper proposes a claims protocol that includes third-party custody of logs and verifiable event recording. The goal is to keep insurers' subrogation rights intact, so they can recover losses from the party at fault without getting stuck in disputes over whether the logs have been changed.

Concentration risk

In traditional shipping, each vessel has its own crew. If two ships collide, each side has witnesses and its own records. Disputes still happen, but at least there are two independent accounts.

With autonomous vessels, decisions are made by software. If the same software runs on dozens or hundreds of ships, a bug in the collision avoidance logic could cause incidents on many of them within a short time. Each claim would rely on logs that the vendor controls, and those logs are what insurers need to decide liability and pursue subrogation.

It's a bit like if every car in a motorway pile-up had the same dashcam, and the camera manufacturer kept all the recordings. Even if the manufacturer acts in good faith, the other drivers might wonder whether the footage tells the whole story.

The paper argues that this setup undermines the balance marine insurance has always relied on: independent records from both sides. When one party keeps all the evidence, trust breaks down, and disputes drag on.

The proposed protocol

The paper suggests a claims protocol with three main elements ^[1]:

1. Third-party log custody. Event logs from autonomous systems are held by a neutral third party, not by the vessel owner or the software vendor. The paper doesn't specify who that third party should be, but the idea is to remove the conflict of interest.

2. Verifiable event recording. Logs are recorded in a way that shows if they have been altered. The paper mentions blockchain as one option, though it notes that other methods could work too.

3. Insurer access. Insurers get prompt access to the logs when a claim is made, so they can assess liability without waiting months for a vendor to hand over evidence.

The protocol is designed to preserve subrogation. If an insurer pays out on a claim and later finds that the other vessel's software was at fault, it can recover from that vessel's insurer. That only works if the evidence is trustworthy.

Why logs matter in marine insurance

Marine insurance has always turned on evidence. A damaged container, a collision or a grounding leads to a claim, and the claim leads to questions: what happened, when and whose fault was it? Traditionally, the answers come from the crew, the ship's log, photos and surveys.

Autonomous vessels change that. The crew shrinks or disappears, and decisions are made by algorithms. The ship's log becomes a digital record of sensor data, model outputs and software commands. That record is still the answer to the same questions, but now it's kept on servers that the vessel owner or the software vendor controls.

If the log can be quietly edited, it stops being evidence and becomes a claim. The paper argues that marine insurers cannot accept that.

How a digital witness would work here

This case fits the pattern well: the thing to prove is what decisions the system made and when, and the evidence is a log that the people who keep it could also change.

Here's what gets sealed: each event record as the autonomous system writes it to the log. That could be a navigation decision, a collision avoidance manoeuvre, a sensor reading or an alert. The content of the record stays with the vessel operator or the software vendor. The witness takes a fingerprint and seals it on a chain where any later change would show, even one made by us.

To check, the insurer, a surveyor or a court calculates the fingerprint of the record again and compares it with the sealed one. If it matches, the record hasn't changed since the system wrote it. Change a single character and it won't match.

The witness doesn't show that the software was working correctly, or that the decision was reasonable, or that the log is complete. What it does is make it checkable whether a record is the one written at the time, so disputes can focus on what happened rather than whether someone has rewritten the story.

For the third-party custody the paper talks about, the witness gives the third party something concrete to offer: not just "we keep the logs", but "we can show the logs haven't changed, and anyone you share them with can check".

You'd seal each event as it's written, using the REST API or the SDK. The fingerprint goes to WitniumChain, the event itself stays in the vessel's systems. When a claim comes in, the sealed log goes to the insurer, who can verify it without having to trust the operator. The first 2,000 witnesses a month are free. Read the docs.

How it would work

1. The autonomous system writes each decision to the log.
2. A fingerprint of that record is sealed immediately.
3. When the insurer asks for the log, anyone can check that it matches the sealed fingerprint.

What this means for you

If you insure vessels, build maritime software or operate autonomous ships, here are three questions worth asking now:

• When an incident happens, who controls the evidence, and will the other side accept it?
• If your software runs on multiple vessels and a defect causes several claims at once, how will you show each insurer what their vessel's system did?
• If a claim goes to arbitration two years later, can you prove the logs haven't been edited since the day of the incident?

The paper is aimed at insurers, but the answers matter for anyone in the chain. Autonomous shipping is coming, and the evidence question is already here.

What to watch

There is no specific regulation yet that requires autonomous vessels to seal their logs, but the principle is appearing in other sectors. Under DORA, financial institutions must protect logs against tampering ^[2]. The EU's proposal for liability rules treats software as a product and gives claimants stronger rights to evidence ^[3].

Marine insurers and classification societies are starting to publish guidelines on cyber risk and digital evidence. As autonomous vessels move from trials to commercial operation, expect the question of log integrity to move up the agenda.

The paper is on SSRN and is worth reading if you work in marine insurance or autonomous systems.