For most of MARPOL’s history there was one lawful way to keep an Oil Record Book: ink on the paper form. That changed on 17 May 2019, when the IMO’s Marine Environment Protection Committee adopted resolution MEPC.312(74), the “2019 Guidelines for the use of electronic record books under MARPOL,” at its 74th session. The companion amendments to MARPOL, in resolution MEPC.314(74) adopted the same day, entered into force on 1 October 2020 and added a definition of an electronic record book to Annex I and the parallel annexes. From that date a ship can keep its Oil Record Book electronically, provided the system meets the guidelines and the flag administration approves it.
This is the regulation ShipORB is built against. It is short, about a dozen pages, and it reads less like a software specification than a list of properties a paper book already has and an electronic one must not lose. The rest of this article walks through what it actually says.
What MEPC.312(74) is, and what it is not
MEPC.312(74) is a set of guidelines, not a product standard. It does not name a file format, a database, or a cryptographic algorithm. It defines an electronic record book as a device or system the Administration has approved, used to record the entries that MARPOL requires in place of a hard-copy book. The technical choices are left to the vendor and the approving body; the guidelines fix the outcomes those choices have to deliver.
That distinction matters. A system passes by demonstrating the required properties, not by using a particular technology. ShipORB uses SHA-256 hash chains and ECDSA P-256 signatures to meet the integrity and attestation outcomes, but the resolution would accept any method that produced the same result. The properties are the law; the cryptography is one way to satisfy it.
The enabling MARPOL amendments
The guidelines do not stand alone. MEPC.314(74) amended MARPOL Annex I, and Annexes II, V, and VI in parallel, to permit an electronic record book and to define one. For Annex I that means the Oil Record Book Part I, required of every ship of 400 gross tonnage and above, and Part II, required of every oil tanker of 150 gross tonnage and above, can now be kept electronically under Reg.17 and Reg.36 respectively.
The amendments also kept the duties that surround the book. The Administration must approve the electronic system before use. The record has to be available to a surveyor or a port state control officer. The retention period is unchanged: the book stays on board and is kept for three years after the last entry. An electronic system inherits all of this; it does not get a lighter regime because it is digital.
The integrity rule: entries cannot be quietly changed
The core requirement is that a confirmed entry cannot be altered or deleted without the change being detectable. On paper this is handled by the rule that a wrong entry is struck through with a single line, initialled, and the correct entry made alongside, so the original stays legible. The electronic guidelines ask for the same property by a different means: the system must prevent unauthorized amendment and must make any amendment traceable.
ShipORB meets this with an append-only hash chain. Each entry’s record includes the SHA-256 hash of the entry before it, so the entries form a chain in which any change to a stored entry breaks every hash that follows. A correction is never an overwrite; it is a new amendment entry linked to the original, and both are retained and shown together. The verification check recomputes the chain and flags the first point where the stored bytes no longer match, which is the digital equivalent of spotting an erased line on a paper page.
The attestation rule: who made the entry, and who signed it
MARPOL has always required entries to be signed. Each completed operation is signed by the officer in charge, and each completed page is signed by the Master, under Annex I Reg.17 for Part I and Reg.36 for Part II. MEPC.312(74) carries this into the electronic world: the system has to identify the person responsible for each entry and record a signature that binds that person to the content.
ShipORB binds an ECDSA P-256 signature to each state transition, so the Created, Reviewed, and Verified steps each carry the identity of the officer who made them. Only the Master can verify, and the book-close logic refuses to close a book while any page that holds entries is still unsigned by the Master. A page is a fixed block of 25 entries, the same lines-per-page as the paper form, so “the Master signs each completed page” is enforced by the software rather than left to habit.
Inspection access, fully offline
A record book is only useful at an inspection if the inspector can read it on the spot. The guidelines require that an authorized officer can access, inspect, and obtain a copy of the entries. For a ship this has a hard constraint the guidelines acknowledge: the inspection has to work without shore connectivity, because a vessel at a berth may have no usable internet and the inspector will not wait for a satellite pass.
ShipORB runs the inspection entirely on the vessel. A port state control officer reads and filters entries on a LAN device, sees the full signing trail on any entry, re-runs the hash-chain check independently, and exports an IMO-format PDF for any date range with a verification stamp on each page. None of that touches the shore system. The encrypted database holding the authoritative record is on the ship, in SQLite with SQLCipher, so an inspection during a connectivity blackout is the same inspection it would be at a connected port.
Backup and continuity
The guidelines expect the data to survive a hardware failure, so a backup is part of the requirement, not an optional extra. They also expect the record to be continuous: a record book covers a span of time without gaps, and a new book picks up where the old one closed.
ShipORB keeps continuity across the book roll with a hash that links each closed book to the next, so the chain a surveyor verifies runs unbroken across every book the vessel has kept, not just the current one. This matters because the three-year retention clock runs from the last entry, which routinely spans more than one book. A break in that cross-book chain is flagged the same way a break inside a single book is.
Approval is by the flag Administration
One point trips up buyers: no vendor can declare its own system MARPOL-compliant in a way that binds a flag state. Under the amendments the electronic record book is approved by the ship’s Administration, the flag state. Class societies support that approval with type approval against the framework; DNV does so under Type Approval Programme No. 1-433.20. New ships also fall under the IACS unified requirements UR E26 and E27 on cyber resilience, which apply to vessels contracted for construction on or after 1 July 2024 and reach onboard software like an e-ORB.
So the path to a lawful electronic ORB runs through the flag state, with a type-approved system and, on newer tonnage, the cyber requirements met. A vendor’s job is to hold the type approval and the evidence the flag state asks for; the flag state makes the call.
Why the guidelines are written as outcomes
Read end to end, MEPC.312(74) is a translation exercise. It takes the properties the paper Oil Record Book has earned over decades, that entries are signed, that corrections leave a trace, that the book is continuous and retained, that an inspector can read it on board, and restates them for a system that has none of paper’s physical guarantees. The result is technology-neutral on purpose: it will outlast any particular database or signing scheme.
For an operator choosing a system, that is the checklist. Does it stop a confirmed entry being changed without detection, does it bind a named officer and the Master to their entries, does it let a PSC officer inspect and export on board with no connectivity, does it back up and stay continuous across books, and does it hold a flag-state-recognized type approval. ShipORB is built to answer yes to each, and the compliance page maps each answer to the regulation it satisfies.