ISM, ISPS and Yacht Compliance: A 2026 Guide for Managers and Captains

If you run a fleet or command a large yacht, the phrase "yacht ISM compliance" probably lands somewhere between a headache and a filing cabinet. It is the framework that decides whether your vessel sails on schedule or sits at the dock while a surveyor works through your paperwork. This guide is written for the people who actually carry that weight: yacht and fleet management companies, DPAs, captains, and the senior crew who keep certificates current and records straight. It walks through what ISM (safety), ISPS (security), MLC (crew welfare and hours of rest), and flag and class really ask of you, who has to comply, and how to keep a yacht audit-ready without living in a permanent state of pre-inspection dread.

A note before we start. This is general guidance, not legal or flag-state advice. Thresholds, exemptions, and interpretations shift by flag, by tonnage, by whether the yacht carries passengers commercially, and by how a specific administration reads its own rules. Always confirm the detail that applies to your vessel with your flag state, your classification society, and your management company. What follows is the practical map, the vocabulary, and the habits that make yacht ISM compliance manageable rather than mysterious.

What yacht ISM compliance actually means

The International Safety Management Code, the ISM Code, came out of a run of serious shipping casualties in the late 1980s where the root cause turned out to be poor shore-side management rather than a single bad decision on the bridge. The International Maritime Organization built the ISM Code to force owners and operators to write down how they run their ships safely, then prove they follow their own system. It became part of SOLAS (the Safety of Life at Sea convention) as chapter IX, and it became mandatory for commercial yachts of 500 gross tonnage and above on international voyages in 2001 to 2002, depending on the flag.

The heart of ISM is the Safety Management System, the SMS. This is not a single binder. It is the whole documented set of policies, procedures, checklists, and responsibilities that describe how your specific yacht is operated, maintained, and kept safe, plus how you respond when something goes wrong. A good SMS covers everything from how the engineer logs planned maintenance to what the crew does if there is a fire in the lazarette at 0300. The idea is honest and simple: write down how you say you operate, then operate that way, and keep evidence that you did.

ISM compliance is proven by two certificates. The management company holds a Document of Compliance, the DOC, which says the shore organization has an approved system. Each yacht holds a Safety Management Certificate, the SMC, which says that particular vessel operates in line with the approved system. Both are issued after audits, and both have to be kept alive through further audits on a schedule we will get to.

Who must comply: the thresholds that matter

The single most common source of confusion is figuring out which codes apply to a given yacht. The answer turns on three questions: how big is she in gross tonnage, is she registered commercial or private, and does she trade internationally. Get those three straight and most of the picture falls into place.

For a commercially registered yacht, meaning one that charters and earns revenue, the 500 GT line is the one to remember. At or above 500 GT on international voyages, ISM and ISPS both bite, and the yacht needs a full SMS, a DOC-holding company, an SMC, a Ship Security Plan, and the associated certificates. MLC 2006, the Maritime Labour Convention, applies to commercially operated yachts regardless of that 500 GT line, because MLC is about the people on board rather than the size of the hull. A 45 metre charter yacht at 480 GT still owes her crew MLC-standard employment agreements, hours of rest, accommodation standards, and repatriation cover.

Private yachts are treated more gently, and reasonably so, because a private owner using his own boat with his own guests is not running a commercial operation. Private pleasure yachts are generally outside mandatory ISM and ISPS, and MLC typically does not apply to a yacht used only for the owner's private pleasure with no seafarers employed under a commercial arrangement, though the detail depends heavily on the flag and on how the crew are actually engaged. Many large private yachts still choose to run a voluntary SMS because it is good practice, it helps with insurance, and it keeps the option open to switch to commercial registration later without rebuilding everything from scratch.

Then there is the Red Ensign Group and the REG Yacht Code, the framework that grew out of what many people still call LY3, the Large Yacht Code. Flags like the Cayman Islands, the Isle of Man, Malta, Gibraltar, and the British Virgin Islands use the REG Yacht Code to set construction, safety, and manning standards for yachts of 24 metres load line length and above. The Yacht Code folds a lot of the SOLAS and MLC expectations into one yacht-specific rulebook, and it is where a captain of a 40 metre vessel spends more of her regulatory life than in the raw text of SOLAS itself.

Which code applies to which yacht

Yacht type	ISM (safety)	ISPS (security)	MLC (crew welfare)	Typical extras
Commercial yacht, 500 GT and above, international	Mandatory (SMS, DOC, SMC)	Mandatory (SSP, SSO, ISSC)	Mandatory (DMLC, SEAs)	REG Yacht Code, class, full SOLAS certificates
Commercial yacht, 24m to under 500 GT	Not usually mandatory; often voluntary	Generally not required	Mandatory	REG Yacht Code, Mini ISM (some flags), class
Private yacht, 500 GT and above	Not mandatory; often voluntary SMS	Not mandatory	Usually not applicable	Flag safety code, class, insurer requirements
Private yacht, under 500 GT	Not mandatory	Not mandatory	Usually not applicable	Flag pleasure-vessel rules
Yacht carrying more than 12 passengers	Mandatory, stricter	Mandatory	Mandatory	Passenger ship safety certificate, SOLAS passenger rules

Treat that table as a starting point, not a ruling. The moment a yacht sits near a threshold, near 500 GT, near the 12-passenger line, near 24 metres, the exact flag interpretation matters and you should confirm it in writing. Tonnage is measured, not guessed, and small design differences can put two similar-looking yachts on opposite sides of a line.

The Safety Management System and the DPA

Once ISM applies, the SMS becomes the spine of daily operation. A well-built SMS for a large yacht usually contains a safety and environmental policy, defined roles and responsibilities from the owner down to the deckhand, procedures for key shipboard operations, a planned maintenance system, emergency preparedness plans and drills, procedures for reporting non-conformities and accidents, and a schedule of internal audits and management reviews. The document set should match the yacht. A cut-and-paste SMS lifted from a cargo ship is one of the fastest ways to fail an audit, because auditors ask the crew to show them how a procedure works in practice, and a procedure written for a different vessel falls apart under a single follow-up question.

The person who ties the shore office to the vessel is the Designated Person Ashore, the DPA. The ISM Code requires every DOC-holding company to appoint at least one DPA, and the role is more than a name on a certificate. The DPA is the crew's direct line to the top of the company on any matter of safety or pollution prevention, and the Code specifically requires that the DPA has direct access to the highest level of management. That access is the point. If the captain raises a safety concern that costs money to fix, the DPA must be able to take it to the person who signs the cheques without it getting filtered on the way up.

In practice the DPA monitors the safety performance of every vessel under the DOC. That means reviewing audit findings, reading incident and near-miss reports, checking that corrective actions actually close out, tracking certificate status, and making sure drills happen and maintenance gets done. For a small management company the DPA might be a director who knows every yacht personally. For a larger operation there may be several DPAs covering different vessels, with deputies to provide 24-hour reachability, because a DPA who cannot be reached during an emergency is a gap an auditor will find. A good DPA is experienced, available, and willing to be unpopular when safety and schedule pull in opposite directions.

Captains carry the other half of this relationship. The ISM Code names the master's responsibility and authority in plain terms, including the master's overriding authority to make decisions for safety and to request the company's assistance. That authority has to be written into the SMS, and it has to be real. A captain who is told to sail against her own safety judgement, and who feels she cannot say no, is evidence that the system exists on paper only. The healthiest yacht operations are the ones where a captain flagging a problem is treated as doing her job well, not as creating one.

ISPS: security, the SSP and the SSO

The International Ship and Port Facility Security Code, ISPS, arrived after 2001 as an amendment to SOLAS and took effect in 2004. It applies to commercial yachts of 500 GT and above on international voyages and sets out how a vessel manages security threats, from unauthorized boarding to piracy to the security of the port interface. Where ISM asks "how do you stay safe," ISPS asks "how do you stay secure."

The core ISPS document is the Ship Security Plan, the SSP. It is built from a Ship Security Assessment that looks hard at the vessel's weak points, and it is a controlled, confidential document because it describes exactly how the yacht defends itself. The SSP sets procedures for three security levels, from normal operations at level one up to a specific credible threat at level three, and it covers access control, restricted areas, handling of stores and deliveries, and the response to a security incident.

Two roles run ISPS. On board, the Ship Security Officer, the SSO, is usually a senior officer, often the captain or first officer on a yacht, who implements the SSP, maintains security equipment, trains the crew, and keeps the security records. Ashore, the Company Security Officer, the CSO, holds the company-wide security responsibility, keeps the SSP current, arranges the security assessment, and coordinates with port facilities and authorities. The certificate that proves ISPS compliance is the International Ship Security Certificate, the ISSC, issued after verification and, like the ISM certificates, kept alive through periodic checks.

For yachts, ISPS often feels lighter in day-to-day life than ISM, because a well-run yacht already controls who comes aboard. The audit still expects to see real evidence: security drills logged, the SSO trained and certified, records of security levels through the season, and a passage plan that accounts for higher-risk areas. Skipping the drills because "nothing ever happens on a yacht" is exactly the kind of gap that turns a routine verification into a finding.

MLC: crew welfare, agreements and hours of rest

The Maritime Labour Convention 2006, MLC, is sometimes called the seafarers' bill of rights, and for yacht crew it is the code that touches daily life most directly. MLC covers minimum age, employment agreements, wages, hours of work and rest, accommodation, food and catering, medical care, health and safety, and repatriation. It applies to commercially operated yachts, and enforcement runs through flag-state inspection and port-state control. Larger commercial yachts carry a Maritime Labour Certificate and a Declaration of Maritime Labour Compliance in two parts, the DMLC Part I set by the flag and Part II describing how the yacht meets each requirement.

Every seafarer on an MLC yacht is entitled to a Seafarer Employment Agreement, the SEA. This is a written contract, in a language the crew member understands, signed before they join, and it sets out the employer and owner details, the crew member's role and duties, wages and how they are paid, hours of rest, leave entitlement, repatriation arrangements, medical cover, and the terms for ending the agreement. A handshake and a monthly transfer is not an SEA, and a missing or incomplete SEA is one of the more common MLC deficiencies found in port. Keeping a signed, current SEA on file for every crew member, including seasonal and daywork crew where required, is basic hygiene.

Hours of rest is where MLC and yacht reality collide most often. The standard, shared with the STCW convention for watchkeepers, gives a seafarer a minimum of 10 hours of rest in any 24-hour period and 77 hours of rest in any 7-day period. The rest in a 24-hour period may be split into no more than two periods, one of which must be at least 6 hours, and the interval between consecutive rest periods must not exceed 14 hours. On a busy charter with early tenders and late guest service, hitting those numbers takes planning, honest logs, and enough crew to spread the load. Falsifying rest-hour records to make a short-handed schedule look legal is a serious problem in audits and, worse, it hides genuine fatigue that puts the vessel at risk.

This is where manning and compliance meet. If the numbers do not work, the answer is not creative bookkeeping, it is more or better-rested crew. Managers who plan the season with realistic crewing, and who bring on qualified relief for demanding programmes, spend far less time explaining rest-hour breaches to a surveyor. If you are trying to fill a gap, YSN lets you find qualified crew and DPA support directly, so you can close a manning shortfall before it becomes a compliance one.

Flag and class: the two authorities behind the codes

Behind ISM, ISPS, and MLC sit two players who actually issue and check most of the paperwork: the flag state and the classification society. Understanding what each does saves a lot of confusion about who to call when something needs signing.

The flag state is the country whose flag the yacht flies, the administration that registers her and takes legal responsibility for enforcing the international conventions on her. Popular yacht flags include the Cayman Islands, Marshall Islands, Malta, the Isle of Man, and Gibraltar, and they compete partly on the quality and reachability of their technical support. The flag sets the DMLC Part I, approves the SMS or delegates that approval, and either conducts the ISM, ISPS, and MLC audits itself or authorizes a Recognized Organization to do them on its behalf. A responsive flag with a good yacht department is worth real money over a vessel's life, because a phone call that gets answered on a Friday afternoon can be the difference between sailing and waiting.

The classification society, class, is the technical body that certifies the yacht's hull, machinery, and systems against its own rules and against the international conventions. Lloyd's Register, DNV, Bureau Veritas, RINA, and ABS are the names you see most on large yachts. Class carries out the periodic surveys that keep the vessel in class, and many flags authorize a class society as their Recognized Organization to also handle the statutory ISM, ISPS, and MLC verification. So the same surveyor visit can cover both class survey items and statutory audit items, which is efficient when it is coordinated and painful when it is not. Keeping class survey dates and statutory audit windows lined up in one calendar is one of the simpler wins in yacht management.

Audits, surveys and the timeline that keeps you legal

Certificates are not permanent. ISM, ISPS, and MLC all run on a cycle of audits and surveys, and missing a window can invalidate a certificate, which can in turn ground the yacht or expose her to detention. The exact pattern varies slightly by flag and certificate, but the general shape is worth committing to memory.

The company DOC is issued for five years with an annual verification each year. The yacht's SMC is issued for five years with at least one intermediate audit, usually between the second and third anniversary. The ISSC follows a similar five-year pattern with an intermediate verification. The Maritime Labour Certificate runs five years with an intermediate inspection between years two and three. On top of statutory audits sit the internal audits the SMS requires you to run yourself, typically annually, plus the management review where the shore office and DPA step back and ask whether the whole system is actually working.

Before any certificate is first issued, an initial audit or verification checks that the system is in place and being followed. New yachts and newly managed yachts get an interim DOC and interim SMC to operate under while the full system beds in, valid for a shorter period. The lesson for managers is that a yacht joining your fleet is not instantly compliant on your DOC. You need the interim certificates arranged before she trades under your management.

Certificate and audit cycle at a glance

Certificate	Issued to	Validity	Interim / intermediate check	Proves
Document of Compliance (DOC)	Management company	5 years	Annual verification	Shore SMS is approved and working
Safety Management Certificate (SMC)	The yacht	5 years	One intermediate audit (yr 2 to 3)	Vessel operates the approved SMS
International Ship Security Certificate (ISSC)	The yacht	5 years	Intermediate verification (yr 2 to 3)	ISPS security plan in force
Maritime Labour Certificate	The yacht	5 years	Intermediate inspection (yr 2 to 3)	MLC crew-welfare standards met
Internal ISM audit	The yacht, by the company	Ongoing	At least annually	You check yourself before the flag does

What happens if it goes wrong? Port State Control, PSC, is the inspection regime that lets a coastal state check foreign vessels in its ports against the conventions. Regimes like the Paris MoU in Europe and the United States Coast Guard in the US board vessels, review documents, and inspect the ship. If they find serious deficiencies, they can issue findings that must be corrected, and in bad cases they can detain the vessel until problems are fixed. A detention is expensive in money, in charter cancellations, and in reputation, and detentions become part of the flag's and the company's record. The strongest defence against detention is boring: current certificates, honest records, working equipment, and crew who can demonstrate the procedures they are supposed to follow.

Non-conformities, corrective action and honest records

Auditors do not expect a perfect yacht. They expect a yacht that finds its own problems and fixes them. That is the whole logic of the ISM Code, and it is why the way you handle a non-conformity matters more than whether you have one. A non-conformity is a situation where evidence shows a requirement has not been met. A major non-conformity is a serious failure that threatens safety or the environment and needs immediate action, and it can stop a certificate being issued or continued. A minor non-conformity is a single lapse that needs correcting but does not on its own threaten the whole system.

The mature response to a finding is a corrective action that treats the cause, not just the symptom. If a fire extinguisher was out of date, replacing it closes the symptom, but asking why the maintenance schedule missed it, and fixing the schedule, closes the cause. Auditors reward root-cause thinking because it is the difference between a system that improves and one that keeps failing the same way. Keeping a clear log of findings, actions taken, who did them, and when they closed out is some of the most useful evidence you can show at the next audit, because it demonstrates the SMS working exactly as designed.

The near-miss report is the quiet hero of a good safety culture. A near miss is an event that could have caused harm but did not, and a yacht where crew feel safe reporting near misses is a yacht that fixes hazards before they become accidents. If your near-miss log is empty, that usually means the crew have stopped reporting, not that nothing is happening. Managers who thank crew for reports, rather than punishing them, get the information they need to keep everyone safe.

How managers and captains keep a yacht audit-ready

Audit-ready is a habit, not an event. The yachts that sail through verifications are not the ones that panic-clean the paperwork the week before. They are the ones where records are kept current all season, because keeping them current is simply how the vessel is run. A few practices separate the calm yachts from the stressed ones.

First, own a live document register. Every certificate, every crew qualification, every SEA, every survey date, with its expiry and next-check date, in one place the captain and the shore office both see. Second, run your internal audits properly and early, so you find your own gaps months before the flag surveyor does, and you have time to close them. Third, keep the SMS matched to reality. When you change how you run a procedure, update the procedure. An SMS that describes a yacht that no longer exists fails on the first follow-up question. Fourth, keep crew qualifications and drills logged against the people who hold and do them, so you can produce the evidence instantly rather than searching a drawer. Fifth, plan manning against the real programme, so hours of rest hold up honestly. Good crewing is a compliance tool, not just an HR one.

Managing this across a fleet is where good vendor and crew organization pays off. A management company that keeps clean records of its vessels, its crew, and its trusted vendors spends less time firefighting and more time operating. If you want a wider view of how the pieces fit together, our guides on yacht management for owners and fleets and fleet management for companies go deeper on the operating side, and our piece on marine vendor management across a yacht fleet covers how to keep the suppliers behind your compliance work organized and accountable.

Audit-readiness checklist

Area	What to have ready	Who owns it	Check frequency
Certificates	DOC, SMC, ISSC, MLC certificate, class and statutory certificates, all current	Captain and DPA	Monthly review
SMS documents	Procedures matching actual practice, updated after any change	Captain and DPA	Ongoing, formal review yearly
Crew records	SEAs signed, certificates and endorsements valid, medicals current	Captain and management	On join and monthly
Hours of rest	Honest logs meeting 10 in 24 and 77 in 7	Officers and captain	Weekly
Drills and training	Fire, abandon ship, security and other drills logged with dates and crew	SSO and officers	Per SMS schedule
Maintenance	Planned maintenance system up to date, safety equipment serviced	Engineer	Continuous
Findings log	Non-conformities, corrective actions, near misses, all tracked to close-out	Captain and DPA	Continuous

You do not need expensive software to run this well, though many fleets do use dedicated compliance platforms. What you need is discipline and a single source of truth. YSN gives yacht and fleet managers a free place to keep vessel records, crew profiles, certificates, and the vendor relationships behind them, so the day-to-day organization that makes a yacht audit-ready lives in one account rather than scattered across spreadsheets and inboxes. On the go, the free YSN app puts the same crew and vessel records in your pocket, which helps when a surveyor asks a question dockside and the office is closed.

Bringing management support in

Not every owner wants to run a DOC-holding company in-house, and most do not. This is where professional yacht management earns its fee. A management company holds the DOC, provides the DPA and CSO, builds and maintains the SMS and SSP, arranges audits with the flag and class, keeps the MLC paperwork straight, and handles the crewing and payroll that sit underneath it all. For an owner, that turns a sprawling compliance obligation into a service with a clear point of contact.

If you are weighing whether to bring in that support, or comparing what different providers actually cover, it helps to see the full scope in one place. Our overview of yacht management lays out what professional management includes across safety, crew, and technical operation, and for revenue-earning vessels our guide to charter management covers the extra compliance and commercial layers that come with chartering, where ISM, ISPS, and MLC all apply in full and the paperwork has to hold up to real scrutiny. Whether you keep management in-house or outsource it, the underlying discipline is identical: know which codes apply, keep the system real, and keep the records current.

Frequently asked questions

Does my private yacht need ISM compliance?

Generally no. Mandatory ISM applies to commercial yachts of 500 GT and above on international voyages, and private pleasure yachts sit outside it. That said, many large private yachts run a voluntary Safety Management System because it improves safety, satisfies insurers, and makes a future switch to commercial registration far easier. Confirm your exact position with your flag state, because the treatment of large private yachts varies.

What is the difference between ISM and ISPS?

ISM is about safety and pollution prevention: how the yacht is operated, maintained, and kept safe, proven through a Safety Management System, a DOC, and an SMC. ISPS is about security: how the yacht controls access and responds to threats, proven through a Ship Security Plan and an International Ship Security Certificate. Both are amendments to SOLAS and both apply to commercial yachts of 500 GT and above on international voyages, but they answer different questions and produce different documents.

Who can be a DPA, and can the captain do it?

The DPA is a shore-based role appointed by the DOC-holding company, with direct access to the highest level of management and responsibility for monitoring safety across the vessels. Because the DPA is meant to be an independent shore link for the crew, the serving captain of a yacht is not the right person to be that yacht's DPA. Many management companies provide an experienced DPA as part of their service, and you can also find qualified DPA and management support through YSN.

What are the MLC hours of rest limits?

The common standard gives a seafarer a minimum of 10 hours of rest in any 24-hour period and 77 hours of rest in any 7-day period. The 24-hour rest may be split into no more than two periods, one of which is at least 6 hours, and the gap between rest periods must not exceed 14 hours. Busy charter programmes make these hard to hit, which is why realistic crewing and honest logs matter so much.

What happens if we fail a Port State Control inspection?

It depends on what is found. Minor deficiencies are recorded and must be corrected, often within a set time or before the next port. Serious deficiencies that affect safety, security, or crew welfare can lead to detention, where the vessel is held until the problems are fixed. Detentions are costly, damage the yacht's and company's record, and can cancel charters, so keeping certificates current and records honest is the best prevention.

Do we need ISPS if the yacht never leaves one region?

ISPS applies to qualifying commercial yachts of 500 GT and above on international voyages, so a genuinely domestic-only vessel may fall outside it, but most large yachts cross borders and trigger the requirement. Even where it is not strictly mandatory, insurers, ports, and charter clients often expect a security plan. Check the specific international-voyage definition with your flag before assuming you are exempt.

How long do the certificates last?

The DOC, SMC, ISSC, and Maritime Labour Certificate each run for five years, kept valid through interim checks: an annual verification for the DOC and an intermediate audit or inspection, usually between the second and third year, for the others. New or newly managed yachts operate under shorter interim certificates while the system is verified. Missing a required verification window can invalidate a certificate, so tracking the dates is part of staying legal.

Can YSN help us stay audit-ready?

Yes, within what a free platform does. YSN gives yacht and fleet managers a place to keep vessel records, crew profiles, certificates with their expiry dates, and the vendor relationships behind your compliance work, all in one account at no cost during beta. It does not replace your flag, your class society, or your SMS, but it helps you keep the crew and certificate records organized so the evidence an auditor asks for is already in order. Create a free account and set up your first vessel to see how it fits your operation.