AIS Switch-Offs in the Black Sea: When Does a “Dark” Vessel Become a Shadow-Fleet Vessel?

Automatic Identification System data has become an important source of evidence in EU sanctions assessments concerning vessels suspected of belonging to the Russian shadow fleet. Where a vessel ceases transmitting AIS signals for several days, the interruption is frequently described as a “dark activity” or “AIS gap” and may be relied upon as an indication that the vessel intended to conceal its movements, port calls or cargo operations.

That conclusion is not automatic. AIS interruptions can have several causes, including technical malfunction, loss of satellite reception, transmission errors and deliberate deactivation. Even where the system was switched off intentionally, the relevant question remains why it was switched off. International maritime rules expressly recognise that AIS may be deactivated where continued transmission would compromise the safety or security of the vessel.

AIS Is Not an Absolute Transmission Obligation

AIS is intended to improve navigational safety by automatically transmitting information such as a vessel’s identity, position, course and speed. It enables other vessels and coastal authorities to identify and monitor maritime traffic and is therefore an important collision-avoidance and oversight instrument.

The obligation to operate AIS is nevertheless not absolute. Paragraph 22 of IMO Assembly Resolution A.1106(29) recognises that the master may switch off the system where its continued operation might compromise the safety or security of the ship or where security incidents are imminent. The decision must be based on the circumstances confronting the master, who remains responsible for the safety of the vessel, its crew and its cargo.

A deliberate AIS interruption therefore does not necessarily amount to illicit concealment. The same technical act may have fundamentally different legal meanings depending on its purpose. Switching off AIS to conceal an unlawful ship-to-ship transfer is materially different from switching it off because transmission of the vessel’s precise position could expose the ship to a military or terrorist attack.

The Particular Security Situation in the Black Sea

This distinction is especially important in the Black Sea and the Sea of Azov. Since the beginning of the war in Ukraine, commercial shipping in the region has operated against the background of naval warfare, missile attacks, sea mines and attacks involving unmanned surface vessels.

Tankers and other commercial vessels may be particularly exposed because AIS transmissions make it possible to follow their movements in real time, identify their destination and predict when they will approach ports, straits or other vulnerable locations. For a vessel proceeding towards a Russian or Ukrainian Black Sea port, continuous transmission may therefore create a genuine operational-security risk.

Contemporaneous maritime reporting has documented the use of AIS deactivation as a protective measure in the region. In October 2023, Lloyd’s List reported that several tankers had stopped transmitting AIS after passing through the Bosporus on voyages towards Russian Black Sea ports. The measure was reportedly adopted because continued transmission could expose vessels to attack.

The practice was not limited to Russian-owned or Russian-operated vessels. Reporting from November 2024 indicated that vessels using Ukraine’s Black Sea corridor had also been instructed to disable AIS while underway and while berthed in port. Arrivals at the greater Odesa ports were consequently recorded as “dark port calls”. This is important because it demonstrates that AIS deactivation in the Black Sea cannot, as such, be treated as a practice peculiar to vessels transporting Russian oil or attempting to evade sanctions. It has also been used by vessels trading with Ukraine as a security measure.

Duration and Location Must Be Examined in Context

The duration of an AIS interruption may provide useful information, but it cannot be assessed in isolation. A gap lasting several days may correspond to the period required to enter the Black Sea, call at a loading or discharge port and return through the Bosporus. Depending on the vessel’s route, waiting times, terminal operations and weather conditions, such a voyage may take considerably longer than a simple distance calculation suggests.

The geographical location at which transmission ceased is likewise not necessarily conclusive. A vessel may deactivate AIS only after entering a high-risk area. A particularly cautious master may decide to do so earlier in order to prevent third parties from determining whether the vessel intends to enter the Black Sea and from predicting its subsequent route.

An interruption occurring in the Mediterranean south of Greece, for example, may initially appear too distant from the Black Sea to be security-related. Yet the assessment may be different where the vessel was proceeding towards the Bosporus during a period of acute attacks on shipping. In February 2024, shortly before one such reported interruption, the Russian landing ship Caesar Kunikov was reportedly sunk by Ukrainian naval drones in the Black Sea. At approximately the same time, commercial vessels were attacked in the Red Sea, including a tanker carrying Russian crude. Those incidents illustrated the broader vulnerability of merchant shipping and may have led masters to adopt unusually cautious security measures.

This does not mean that every AIS interruption occurring on a voyage towards the Black Sea was necessarily justified. It means that the interruption must be examined against the actual route, the prevailing threat situation, the vessel’s operational history and any available logbook or technical evidence. The mere appearance of a gap on a commercial tracking platform is insufficient to determine its cause.

AIS Gaps Are Not the Same as Intentional Avoidance of Detection

IMO Assembly Resolution A.1192(33), to which Article 3s of Council Regulation (EU) No 833/2014 refers, identifies “intentionally avoiding ship detection” as one of the practices potentially associated with shadow-fleet operations.

The inclusion of the word “intentionally” is decisive. The existence of an AIS gap proves only that the publicly available transmission record was interrupted. It does not, by itself, establish who caused the interruption, whether the interruption was deliberate or what objective was pursued.

A finding of intentional avoidance should therefore require evidence connecting the interruption to a concealment purpose. Such evidence might include the use of AIS deactivation during an undisclosed ship-to-ship transfer, manipulation of vessel identity data, a pattern of switching off AIS precisely when approaching sanctioned ports or discrepancies between transmitted positions and verified vessel movements.

By contrast, an interruption that is compatible with a voyage through an active conflict zone, occurred during a period of documented attacks and is not accompanied by evidence of concealed cargo operations cannot automatically be classified as sanctions evasion.

A technical malfunction must also remain part of the analysis where the original logbooks, equipment records or crew statements are no longer available. Satellite-based AIS records are themselves not identical to the signals transmitted directly between vessels and coastal stations. Gaps in commercially displayed data may result from limitations in reception, processing or data transmission even where the vessel’s AIS equipment remained operational.

An Isolated Historical Incident Is Normally Insufficient

Particular caution is required where the alleged AIS activity occurred before the present owner or operator acquired the vessel. A subsequent owner may have no access to the former owner’s logbooks, voyage instructions, technical records or crew members and may therefore be unable to reconstruct the precise cause of a historical interruption.

The absence of such records cannot reverse the burden of proof. A vessel should not be classified as engaging in irregular and high-risk shipping practices merely because its present owner cannot conclusively explain a single incident that occurred under different ownership.

Even where an isolated AIS switch-off was not fully consistent with the applicable IMO guidance, that would not necessarily establish that the vessel forms part of a shadow fleet. Such a classification requires reliable evidence of intentional conduct attaining a sufficient degree of seriousness. A single historical interruption admitting of plausible safety-related or technical explanations is qualitatively different from a systematic pattern of concealment connected with sanctions circumvention or unlawful cargo operations.

Conclusion

AIS data is an important maritime intelligence tool, but it is not self-interpreting. An interruption in transmission may indicate concealment, but it may also result from technical limitations or a legitimate decision by the master to protect the vessel from an imminent security threat.

This is particularly relevant in the Black Sea and the Sea of Azov, where both Russian- and Ukrainian-related shipping has used AIS deactivation in response to the risk of missile, drone and other attacks. In that environment, the mere existence, duration or location of an AIS gap cannot establish intentional avoidance of detection without a careful examination of the surrounding circumstances.

For the purposes of EU shadow-fleet listings, the decisive issue should therefore not be whether an AIS interruption occurred, but whether there is reliable evidence that it was deliberately used to conceal unlawful or sanctions-related conduct. Without that additional evidence, an AIS gap remains an indication requiring investigation, not proof of an irregular and high-risk shipping practice.

This article reflects the legal position and publicly available information as at 30 July 2026.

---

Your contact person: Dr. Hendrik Müller-Lankow, German/EU Attorney-at-law.