A practical guide for owners and crew

Just as it has in businesses the world over, AI has found its way into day-to-day life on board. Crew are using it for tasks like writing emails, checking charter contracts, and troubleshooting technical issues, amongst other things. On the face of it this is reasonable, using a tool to do the job faster or better, or both. However, there are some implications if a personal or free account is used, and it has a name: shadow AI.

shadow AI /ˈʃadəʊ ˌeɪˈaɪ/ · noun

The use of AI tools for work without an organisation’s knowledge, oversight or approval, typically on personal or free accounts.

An organisation cannot protect data it does not know is leaving.

e.g. “Crew are using shadow AI to check charter contracts without considering where the data is going.”

When a contract is pasted into a chat it goes to the provider and is held on their servers. By default on a personal or free account that text can be used to train the model, and once it has been used in training it cannot practically be removed from the model, even if the original conversation is later deleted.

It also sits in the crew member’s personal account, which stays with them when they leave. A crew member who moves on at the end of the season still has access to everything they entered.

Banning it is the wrong instinct

The instinct, faced with this, is to ban it outright. However, that rarely works as a ban only drives the behaviour underground. It would also be throwing away something genuinely useful. The better course is not to forbid AI but to manage how it is provided and used.

Provide an authorised tool

The fix is to give the crew a tool the yacht controls. That means a company account rather than a personal or free one. The business tiers from the main providers such as ChatGPT Team, Claude for Work and Microsoft 365 Copilot carry a contractual commitment not to train on the data they are given, along with administrative controls and proper data handling.

The retention and privacy settings should still be configured deliberately rather than left untouched. That one step turns the largest risk into a managed tool, and lets the crew work in the open rather than in the shadows.

What a licence does not cover

Even with a secure tool in place, judgement about what goes in still matters. A company account makes it safe to handle the everyday confidential business of running a yacht, but the more sensitive the information, the more care it deserves. Some things, for example the principal’s security arrangements, or a guest’s identity under a confidentiality agreement, are better kept out of any external system altogether.

With the tool secured, the other thing to watch is reliability. AI answers with confidence whether or not it is right, so anything that matters should be verified, particularly where safety, medical or legal questions are involved. It is a tool to be used, not the absolute authority on anything.

A test before you paste anything in. Take “AI can do that” and swap it for “someone I know can do that.” Now swap it again for “someone I don’t know can do that.” Still want to put it in? That’s your answer.

A quick guide

Do

• Strip the identifying details first, and use placeholders like “the guest” or “the port”
• Use a business or enterprise account, not a personal free one
• Agree one simple rule on board: what is fine, what is off-limits, who to ask

Don’t

• Paste guest or owner names, itineraries, locations, financials or security details
• Drop contracts or NDAs in for a quick summary
• Trust AI on safety, medical, legal or navigational matters without checking

AI is on board and in the hands of the crew, whether it was invited or not. Better, then, to take control of it, and provide the tools and guidance to keep its use safe and responsible.

David Nabarro is the founder of Nabarro Consulting, which advises businesses on AI strategy before they invest in it.
nabarroconsulting.com