When data centres become targets: It's time to treat AI infrastructure as critical infrastructure

In March 2026, Iranian drones struck Amazon Web Services facilities in the United Arab Emirates and Bahrain, damaging physical infrastructure and disrupting cloud services across the region.

For the first time in modern conflict, commercial hyperscale data centres became explicit kinetic targets. Iranian state media described the strikes as blows to “the enemy’s technological infrastructure,” and the episode was widely interpreted as a watershed moment in the security meaning of cloud infrastructure. As the Associated Press observed, the attacks exposed a fundamental vulnerability: cloud reliability is engineered to manage component failures and system outages, not to withstand the physical destruction caused by missiles or drone strikes.

This incident was not an isolated cyber event or accidental collateral damage. It marked a geopolitical inflection point: AI infrastructure — once seen as neutral commercial real estate — is now strategic national infrastructure, comparable in importance to electricity grids, ports, or oil pipelines.

The Middle East, long a laboratory for energy geopolitics, is becoming the proving ground for the new geography of digital power. Gulf states are racing to position themselves as global hubs for AI inference and compute, even as regional tensions accelerate the recognition that these assets demand the same level of protection and resilience planning once reserved for traditional critical infrastructure.

Taken together, the episode highlighted a deeper structural shift. Infrastructure that once operated quietly in the background of the digital economy — hyperscale cloud campuses and AI compute clusters — is increasingly becoming part of the physical infrastructure landscape on which modern economies depend.

At the centre of this shift is the rapid expansion of artificial intelligence computing. As compute demand rises, large-scale data centres are beginning to resemble other enabling systems that modern states already treat as critical infrastructure, such as electricity grids, ports and major telecommunications exchanges.

One indicator is electricity consumption. An analysis prepared for the US Department of Energy by researchers at Lawrence Berkeley National Laboratory estimates that US data centres consumed roughly 176 terawatt-hours (TWh) of electricity in 2023 — about 4.4% of national electricity demand. The scale of the increase becomes clearer in historical context: in 2018, US data-centre electricity use was estimated at roughly 76 TWh, around 1.9% of national consumption, reflecting the pre-generative-AI era of cloud computing. Driven largely by the rapid deployment of AI accelerators and hyperscale computing infrastructure, electricity demand from US data centres could rise to between 325 and 580 TWh by 2028, equivalent to roughly 6.7-12% of total US electricity consumption. Researchers describe this trajectory as a structural shift in power demand tied to the expansion of AI compute workloads and large-scale hyperscale facilities.

The demand-side implications extend beyond individual facilities. The International Energy Agency has described data centres as an increasingly consequential driver of national electricity systems, particularly in the United States, where they are expected to account for a significant share of incremental electricity demand growth through 2030. When a sector begins to shape grid planning, generation investment, and transmission timelines, its continuity becomes a macroeconomic concern rather than a purely private operational matter.

The capital structure of AI infrastructure reinforces this dynamic. Benchmarks from Cushman & Wakefield estimate that developing one megawatt of data centre critical load capacity in the United States costs between $9.3 million and $15 million, averaging roughly $11.7 million per megawatt across surveyed markets. Such capital intensity means that physical damage is not only disruptive but also slow to reverse. Recovery requires construction lead times, constrained supply chains and complex commissioning of power and cooling systems — precisely the kinds of frictions that make outages in traditional infrastructure sectors economically costly.

Even in peacetime, outages illustrate the dependence created by concentrated compute infrastructure. Survey data compiled by the Uptime Institute indicates that a majority of operators report their most recent significant outage costing more than $100,000, with roughly one in five incidents exceeding $1 million. These figures represent baseline operational risks — before accounting for the additional disruption, safety constraints, insurance gaps or reputational damage that can arise when infrastructure becomes exposed to geopolitical conflict.

Economic history shows that enabling infrastructure often acts as a growth multiplier. A cross-country econometric study conducted for the World Bank examining telecommunications and broadband adoption across dozens of economies between roughly 1980 and 2006 found that a 10% increase in broadband penetration was associated with GDP gains ranging from about 0.25% to 1.4%, depending on country conditions and model specification. AI compute infrastructure is beginning to play a similar enabling role: by embedding intelligence into everyday services and industrial processes, it lowers transaction costs, diffuses new capabilities across sectors and expands the range of economic activities that digital systems can support.

AI’s “multiplier” logic is increasingly quantifiable. Recent macroeconomic modeling by the International Monetary Fund estimates that AI-driven productivity gains could raise global GDP by roughly 1.3% to 4% over the next decade, depending on the speed of adoption and diffusion across sectors. These gains are expected to be concentrated in economies with stronger digital infrastructure, skilled workforces and access to advanced compute resources, underscoring the structural advantages of countries that can deploy AI at scale. Crucially, the IMF analysis highlights that these effects emerge not from a single industry but from productivity improvements diffusing across multiple sectors — from services and finance to healthcare and logistics — reflecting the hallmark dynamics of a general-purpose technology whose enabling infrastructure acts as a multiplier of economy-wide productivity and growth.

The compute economics that enable “inference everywhere” also matter. The Stanford Institute for Human-Centered Artificial Intelligence reports that the cost of performing inference at GPT 3.5-level capability fell by more than 280-fold between November 2022 and October 2024, dramatically lowering the marginal cost of deploying AI applications at scale. At the same time, McKinsey & Company estimates that by 2030, inference will surpass model training as the dominant AI data-centre workload, representing more than half of all AI compute and roughly 30-40% of total global data-centre demand.

For states positioning themselves as AI “inference exporters,” this matters in two ways. First, it makes compute demand more continuous and utility-like: inference is embedded into everyday services, not confined to episodic R&D training runs. Second, it deepens the societal and industrial dependence on always-on compute availability. When inference is woven into payments, logistics, healthcare operations and government service delivery, compute outages begin to resemble power outages in their cross-sector spillovers.

The Middle East — and particularly the Gulf — has become a revealing test case because it sits at the intersection of three forces: rapid AI demand, capital and energy availability, and increasing strategic contestation over infrastructure nodes. The region’s strategy is not simply to consume AI services, but to become a host for compute and inference at global scale. The investment pattern is visible across sovereign partnerships with hyperscalers and GPU-centric buildouts.

In Saudi Arabia, AWS is building a new cloud region expected to become available in 2026, with Amazon stating it plans to invest more than $5.3 billion in the Kingdom to develop that region, and in May 2025 AWS and HUMAIN also announced an additional “AI Zone” investment described as separate from the previously announced region investment. In parallel, Google Cloud and the Saudi Public Investment Fund said in May 2025 that they were advancing their AI-hub partnership, describing it as a $10 billion joint investment to be launched with Saudi technology company Humain. And Microsoft said in February 2026 that customers will be able to run cloud workloads from its Saudi Arabia East datacentre region starting in Q4 2026, positioning this as part of the Kingdom’s broader digital and AI ambitions under Vision 2030.

In the UAE, the compute-hub strategy has moved into an industrial phase measured in megawatts. In November 2025, Microsoft and G42 announced a 200 MW expansion of UAE data-centre capacity to be delivered through Khazna Data Centers, reported as part of Microsoft’s broader $15.2 billion UAE investment plan running from 2023 to 2029. Oracle announced deployment of the Middle East’s first OCI Supercluster in Abu Dhabi powered by NVIDIA Blackwell GPUs, which the company said is intended to support sovereign AI initiatives in the region.

This buildout logic depends on stable continuity — and March 2026 showed why continuity can no longer be assumed. Drone strikes that impaired AWS facilities in the UAE and Bahrain turned “regional redundancy” into a geopolitical question: if multiple zones inside a single region can fail due to physical attack, then resilience requires multi-region and sometimes cross-border failover, precisely where data residency and sector rules can constrain rapid rerouting. Reuters reported that an affected UAE insurance platform was working with AWS to temporarily shift workloads outside the region, but that such migration required regulatory approval because local rules mandate that insurance-related data be hosted domestically.

The strikes in the Gulf did not create this emerging risk landscape — they revealed it. As the region accelerates investments to become a global hub for AI compute and inference, the strategic importance of large-scale data centres is becoming clearer: modern economies are beginning to rely on compute infrastructure in ways that resemble their dependence on energy, transport and telecommunications systems. In this context, the Gulf is evolving into a proving ground for a new form of infrastructure competition. States are not only building the capacity to host and export AI compute, but increasingly must secure and sustain it — physically, energetically and legally — much as they would ports, pipelines or power stations, because in an AI-first economy, the resilience of compute infrastructure becomes inseparable from broader questions of national security and economic continuity.

As AI infrastructure becomes woven into the functioning of modern economies, the implications extend beyond corporate resilience strategies. Governments will increasingly need to treat AI compute as critical infrastructure in law, planning and security architecture — reflecting the role it already plays in sustaining economic activity and public services. The legal and regulatory signals are moving in that direction.

In 2024, the United Kingdom announced that data centres would be designated as Critical National Infrastructure, placing them alongside sectors such as energy and water for national resilience prioritization. In the European Union, the NIS2 framework establishes heightened cybersecurity and resilience obligations across critical sectors; its Annex I explicitly includes digital infrastructure, listing cloud computing service providers and data centre service providers among the entities subject to these requirements.

The incidents in the Gulf sharpen what treating AI infrastructure as critical infrastructure must mean in practice. Resilience can no longer be defined only in terms of single-site outages or isolated technical failures. Planning must account for correlated disruptions affecting multiple facilities within a single region, including physical attacks, energy shocks or connectivity disruptions. Events in the region have illustrated how redundancy assumptions based on geographically proximate facilities can break down when infrastructure is exposed to kinetic risk.

Continuity planning also requires reconciling two policy objectives that often sit in tension: data sovereignty rules designed to keep sensitive information within national borders, and failover architectures that may require rapid cross-border rerouting during major disruptions. In practice, regulatory constraints can complicate the emergency migration of workloads outside a region during major infrastructure disruptions. Policy-makers may therefore need mechanisms for temporary “emergency data mobility” during defined infrastructure crises.

Beyond digital governance, AI infrastructure policy increasingly intersects with energy, water and land-use policy. As data centres become material electricity consumers and major industrial facilities, their development shapes grid planning, generation investment and water allocation decisions. In this sense, the governance of compute infrastructure begins to resemble the governance of other networked utilities.

Viewed through that lens, the March 2026 strikes in the Gulf appear less as an anomaly than as an early signal of how the geopolitical meaning of digital infrastructure is changing. As economies integrate AI into everyday production, services and government operations — and as states compete to host and export inference capacity — the resilience of large-scale compute infrastructure becomes inseparable from broader questions of economic continuity and national security.