AI adds dependencies to connected operations
An AI-enabled workflow may depend on sensors, networks, cloud services, data pipelines, vendor software, and user accounts. Each dependency can introduce operational and cyber risks. Incorrect or manipulated inputs, unavailable connectivity, compromised credentials, and unpatched components can affect the quality or availability of outputs.
AI should therefore be considered within the organization's existing safety and cybersecurity management, not treated as a separate magic layer. Map the information flow, identify systems that can affect operations, and understand who is responsible for access, maintenance, incident response, and vendor coordination.
Plan for degraded or unavailable systems
Useful safeguards include least-privilege access, network segmentation where appropriate, controlled updates, logging, backups, vendor review, and clear incident procedures. Test what happens when data is missing, communications are lost, or an AI service returns an implausible result. Do not expose sensitive operational data to unapproved services.
The IMO's maritime cyber-risk guidance places cyber risk management within safety management systems. Organizations should consult current IMO guidance and their flag, company, and system-specific requirements when designing controls.