Putting armed guards aboard a merchant ship is one of the most consequential decisions a shipowner or master can take. Done properly, a vetted team of Privately Contracted Armed Security Personnel (PCASP) can deter a piracy attack and protect the crew. Done badly, it exposes the company to criminal liability, arms-smuggling charges in coastal states, insurance disputes and the death or injury of innocent people. This guide sets out the legal and flag-state framework that governs armed guards at sea, explains when their use is justified, walks through the practical mechanics of embarkation and floating armouries, and clarifies where the master's authority begins and ends. It is written for operators making a real decision about a real voyage, not as a legal opinion: always confirm the position with your flag administration, your insurer and qualified counsel before you commit.
There is no single global law authorising armed guards on ships. Instead, a layer of International Maritime Organization (IMO) guidance sits over a patchwork of national flag-state rules, and the flag state has the final word. The core IMO instruments are interim guidance circulars, not binding conventions:
The critical point is that each flag state decides for itself whether armed guards may be carried, and on what terms. Some administrations require prior authorisation for each voyage or each contract; some mandate notification of embarkation and disembarkation points; some prohibit armed teams outright. Coastal and port states impose a separate and often stricter set of rules on the weapons themselves: carrying firearms into a port's territorial waters without permission can constitute serious arms offences regardless of what the flag state allows. The flag rule and the coastal-state rule are different questions, and both must be answered for every leg of the voyage.
Because the IMO circulars are guidance rather than law, the industry developed standards to professionalise the companies supplying armed teams. ISO 28007-1:2015 is the recognised international standard for PMSCs providing PCASP on board ships. It sets out management-system requirements covering selection, vetting and training of personnel, command and control, insurance, weapons accountability and incident reporting. A PMSC certified to ISO 28007 by an accredited body has demonstrated an auditable system, and that certification is a basic filter when selecting a provider.
Governing how force may be used, the 100 Series Rules for the Use of Force, drafted by barrister David Hammond, provide an international model set of Rules for the Use of Force (RUF) for armed teams at sea. They were written with reference to the IMO MSC circulars and ISO 28007 and aim to give teams a defensible, proportionate framework grounded in the right to self-defence. A clear, voyage-specific RUF that the master has seen and understood is a hallmark of a properly run operation. When vetting a provider, an operator should confirm at minimum:
Armed guards are justified only when a documented threat and risk assessment shows that lower-tier measures are insufficient. The IMO guidance and Best Management Practices are explicit that hardening the ship comes first. Best Management Practices Maritime Security (BMP5) sets out the layered self-protection measures: routing and reporting, lookouts, increased speed, freeboard and physical barriers such as razor wire, a citadel and water or foam defences. Armed guards sit on top of those measures; they do not replace them.
The assessment should weigh the specific threat on the planned route, the ship's own vulnerability (speed, freeboard, manoeuvrability), the legal exposure created by carrying weapons through the intended ports and waters, and the alternative of naval escort or convoy where available. High-risk and voluntary-reporting areas shift over time as the threat picture changes, so a risk assessment written for last year's chart is not evidence for this voyage. Reporting to the relevant centre, principally UK Maritime Trade Operations (UKMTO) for many of the world's high-risk waters, remains a core measure whether or not a team is embarked.
The practical problem with armed teams is the weapons. Most port and coastal states will not allow privately held automatic weapons and ammunition to enter their jurisdiction, so teams cannot simply join the ship at the load port with their kit. The industry solution is the floating armoury: a vessel stationed in international waters, outside any state's territorial sea, that stores weapons and hosts teams between assignments. Guards embark the merchant ship from the armoury at the edge of the transit area and disembark to it at the far side, so the weapons never enter a port jurisdiction.
Floating armouries operate in a thin regulatory space, and their standards vary widely. The flag of the armoury, its weapons-accountability records, its own licensing and the legality of the transfer all matter, and a poorly run armoury has been the cause of seizures and detentions. An operator relying on a floating armoury should satisfy itself of the armoury's flag and licensing, the chain of custody for weapons embarked and landed, and the precise geographic points of transfer relative to territorial limits. Embarkation and disembarkation points should be agreed in writing in advance, recorded, and notified to the flag state and reporting centre where required. Improvised changes to the transfer location are where legal exposure tends to arise.
Embarking an armed team does not transfer command of the ship. The master retains overall authority for the safety and security of the vessel, crew and cargo at all times, and the security team operates under the master's overall command. What is delegated is narrower and specific: once the Rules for the Use of Force have been invoked in response to an attack, the team leader, not the master, makes the tactical decisions on the application of force, because the team are the trained and armed professionals and the master is not. The master retains the right to order a ceasefire. Industry guidance is clear that owners should not accept contract terms that put the decision to discharge live rounds in the master's hands; that is the team leader's responsibility under a proper RUF.
Liability is shared and the boundaries must be set before sailing. The contract should define command and control, the RUF, the chain of accountability if force is used, insurance and indemnities, and the obligation to report any incident to the flag state and relevant authorities. A use-of-force incident can trigger criminal investigation in multiple jurisdictions, so accurate logs, the team's own incident reports and preserved evidence are essential. The decision to embark, the risk assessment behind it, and the conditions imposed by the flag state should all be documented contemporaneously: that paper trail is the operator's first line of defence if an incident is later examined.
Deciding whether to embark an armed team turns on the quality of the threat picture for the specific route, on the current high-risk and reporting-area boundaries, and on the flag and coastal-state rules in force right now. Verihelm is an analyst-verified maritime intelligence platform that brings those inputs together: route-specific threat assessment, current incident data and reporting-centre boundaries, so the risk assessment that underpins a PCASP decision rests on verified intelligence rather than last year's assumptions. Explore how Dryad Global supports the full picture through our voyage and transit risk assessment capability, and brief every armed-transit decision on intelligence you can defend.