The Crew Was the Control

Early in my time as a junior rating in naval supply, I spent a morning checking a consignment in against its paperwork. It is the kind of receipt inspection that fills a storekeeper's first years and attracts no attention when it goes well. On one line the paperwork said one thing and the item in my hands said another, and the difference was small enough to pass any reasonable glance at the record. It was caught because a person was holding the item beside the paperwork and had done the job long enough to feel the mismatch before being able to explain it. Eighteen years later, having run first-line stores and supply chain controls for much of that time, I still think of that morning as a control that no policy wrote down. The person who performed it appeared on no organisation chart as an assurance function.

That morning has been on my mind this month, since the Royal Navy reported on 1 October 2026 that Exercise REPMUS had trialled prototype uncrewed capabilities for its Atlantic Bastion programme. The exercise is the annual autonomous warfare experiment hosted by the Portuguese Navy, and around 200 UK personnel led a contingent drawn from ten NATO and partner nations. The systems on show described the fleet that is coming, with underwater gliders feeding data to larger sentinel gliders and squads of small and medium uncrewed surface vessels gathering acoustic contact reports. Two autonomous boats, twelve and seventeen metres long, towed sonar and launched other platforms. At Undersea Defence Technology 2026, a senior officer described Atlantic Bastion as "probably its biggest innovation transformation program in a generation."

What the crew was doing

Most commentary on uncrewed maritime systems concerns the sensors, the autonomy, the processing and the data architecture that connects them. The assurance question sits behind all of it, and for the most part it is being answered by omission. A crewed warship carries its own assurance system in the people on board, and almost none of it is documented. The engineer notices a reading drifting before it trips an alarm. The storekeeper rejects a part that arrived with the right label and the wrong provenance. The watchkeeper distrusts an instrument on a particular morning, for reasons that later prove sound. These are controls, exercised continuously, and no instruction classifies them as such, because the people exercising them are understood to be doing their jobs.

An uncrewed platform removes the people and leaves their functions in place, so the assurance a crew performs tacitly has to go somewhere. Some of it passes to a remote operator watching a console and to a shore maintenance team that may never stand on the hull. Some passes to a supplier whose quality process now carries weight that a person on board used to carry. Above all it falls on the documentary record, which has to bear load for the first time. One widely read naval analysis made the point earlier this year, observing that an uncrewed vessel "has no damage control team." Damage control includes a continuous, physical, human inspection that catches the condition of a platform before the platform reports it. The missing team therefore leaves a gap in materiel assurance as well as in resilience.

Where the control goes

Consider how a commercial-grade component reaches an uncrewed platform. According to UK Defence Journal's report of the same panel, industry is being engaged earlier and more openly, with companies forming consortia to develop solutions. The report also notes commercial-grade systems being used in some areas as a workaround to maintain pace. A consortium spreads a platform across many suppliers and sub-tiers, each contributing parts and software under its own assurance arrangements. The integration of those arrangements is itself a control that somebody now owns. On a crewed vessel, much integration assurance happens informally, in the judgement of the people who live with the equipment. On an uncrewed one, that judgement has to be designed in, specified, contracted for and evidenced, because nobody aboard supplies it by default.

The civilian frameworks that would carry this are still maturing, and they are maturing as guidance. The Industry Code of Practice for Maritime Autonomous Ship Systems is now at Version 8, dated November 2024, and it is adopted by contract and convention. The International Maritime Organization's MASS Code is on its way to becoming mandatory but is not there yet. A code that clients require as a basis for negotiation is a real and useful control, and it is a different kind of instrument from a regulation. The difference is the gap a storekeeper learns to watch for, between what the record says is assured and what someone able to feel a mismatch has actually verified.

More data, less provenance

The strongest objection is that uncrewed platforms are better instrumented than crewed ones. A modern uncrewed underwater vehicle can generate more condition and performance data on a single sortie than earlier systems were built to handle, as the Atlantic Bastion reporting makes clear. An engineer could fairly argue that continuous, logged, machine-generated telemetry is a more thorough record than any sailor's memory, and that tacit human judgement should not be romanticised.

The objection is largely right about volume, yet volume of data is a different thing from assurance of data, and the distance between them is the whole of the supply chain assurance discipline. Telemetry reports what a component did, and it cannot establish that the component is what the supplier certified or that it entered service through a controlled and documented route. Nor can it show that its readings can be trusted where the incentive to pass is high and a clean record is cheap to fabricate. The more a platform depends on self-reported machine data, the more the provenance of that data matters. Provenance is a physical and documentary chain, and a sensor cannot verify it about itself. More sensing therefore raises the value of independent verification.

A control worth naming

None of this argues against the uncrewed fleet, which is coming whether or not its assurance model is articulated in time. The Navy has framed the fleet as intended "to augment, not replace, crewed platforms." The case here is for naming a control that has operated for as long as there have been crews, so that it can be rebuilt deliberately. A remote operating model, supplier assurance, sub-tier visibility and a record designed to be independently checkable can reconstruct what a crew did by being present. That only happens if someone first recognises that those functions existed and carried load.

The capability will arrive, and the risk is that it arrives with its assurance assumed. The first time anyone looks closely at the record, nobody may be left who could have felt the mismatch. As the fleet adds mass in the water, the organisations that supply, integrate and assure these platforms should list the controls a crew used to perform and say where each one now sits.

The views expressed here are my own and are based on general observations about uncrewed maritime systems, materiel assurance and supply chain controls. They draw only on published sources and do not represent the position of the Royal Navy, the Ministry of Defence or any organisation with which I work. Nothing published here reproduces any organisation's internal policy, procedure or assurance output.