Data Centre Resilience in the Gulf

Spotlight: 

• Gulf Cooperation Council (GCC) AI data centres face procurement delays and entrenched supply-chain dependencies, requiring a shift towards localised component manufacturing and expanded trade diplomacy.
• AI data centres require 24/7 cooling and power. Mitigating these challenges in a fossil-fuel-dominated and arid environment requires renewable energy acceleration as well as storage facilities, enhanced grid interconnectivity, demand-side water-efficiency measures, and strategic water reserves.
• Data centre infrastructure is exposed to natural flash-flooding hazards as well as kinetic and cyber threats, necessitating hazard assessments, robust cyber security protocols, and enhanced security architecture.

The Gulf Cooperation Council (GCC) countries, particularly the United Arab Emirates (UAE) and Saudi Arabia, have positioned themselves as future data centre powerhouses by leveraging the investment capacity of their sovereign wealth funds (SWF), energy availability, political support, and trade relationships with global tech powerhouses. However, mounting regional environmental and geopolitical pressures question the resilience of the region’s data centre industry.

Table 1: Status and Expected Demands of GCC AI Data Centres 

Mid- to large-sized AI data centre facilities consume up to 5 million gallons of water daily and as much electricity as up to 2 million households, creating new interdependencies on the arid region’s energy–water nexus. Moreover, the UAE and Bahrain allegedly experienced several missile attacks on data centres at the start of the United States (US)–Israel–Iran conflict in March 2026, alongside a steep rise in cyberattack attempts. Infrastructure resilience must therefore account not only for resource inputs and supply-chain dependencies, but also for active physical and cyber threats.

This article identifies the key constraints impeding data centre resilience in the Gulf, specifically material procurement, energy and water sustainability, and exposure to physical and cyber damage, and proposes strategies to fortify critical infrastructure.

Embedding Resilience in Data Centre Design: Constraints and Progress

Supply Chain Concentration and Dependencies

At the operational stage, data centre resilience depends on the ability to procure and replace the materials required to build and maintain facilities. Concentrated global supply chains for semiconductors and servers to power transformers, switchgear, cooling systems, optical-networking equipment and long lead times can intensify procurement competition and delay capacity expansion even where Gulf resources are available. China accounts for around 60–70 percent of the mining of semiconductor-relevant rare earth elements (REEs) and nearly 90 percent of processing capacity. Further downstream, at the manufacturing level, Taiwan’s Taiwan Semiconductor Manufacturing Company (TSMC) supplies most of the world’s highest-performance AI chips, while the Netherlands-based ASML effectively monopolises the extreme-ultraviolet lithography equipment required to manufacture the advanced semiconductors used in leading-edge data centres.

Concentrated global supply chains for semiconductors and servers to power transformers, switchgear, cooling systems, optical-networking equipment and long lead times can intensify procurement competition and delay capacity expansion even where Gulf resources are available.

For Gulf states, these concentrations translate into dependence on external suppliers. Their components can be interrupted not only by shortages or disruption to trade routes, as has been evident in the Strait of Hormuz, but also by competition-driven export policies and tariffs such as those frequently used by the United States (US). GCC countries are directly affected by these measures and are responding partly through localisation. For example, Saudi Arabia has increased local manufacturing of data-centre-relevant technological components, including high-voltage switchgear and cooling equipment, while the UAE has established an AED 1 billion National Industrial Resilience Fund to support the localisation of advanced technologies. Gulf governments are also using trade and technology diplomacy to broaden access to overseas supply chains. The UAE has concluded Comprehensive Economic Partnership Agreements (CEPAs) with manufacturing economies, including semiconductor powerhouse South Korea. The region, as a whole, benefits from collective GCC Free Trade Agreements (FTAs), including those expected to enter into force with South Korea and the United Kingdom (UK), as well as a possible future agreement with China.

Energy and Water Pressures

Data centre water and energy demands are heavily interlinked, pressuring a region warming at a pace that is three times the global average. Despite having an energy surplus, the GCC faces severe electricity-grid strain from heightened summer cooling demand. Data centres also require round-the-clock cooling to prevent overheating. In response, policymakers primarily intend to expand desalination infrastructure that is highly energy intensive, poses threats to marine ecosystems, and is vulnerable to kinetic threats. Moreover, intermittent clean energy expansion alone cannot meet data centre needs for uninterrupted baseload power, unless accompanied by battery energy storage systems (BESS) or thermal baseload options such as natural gas.

Regional clean energy progress also remains asymmetrical. As of September 2026, clean energy accounts for 32.4 percent of the UAE’s installed energy capacity, close to its 2031 goal of 35 percent, while Saudi Arabia lags behind. Despite aiming for a 50 percent renewable generation mix by 2030, renewables currently supply just 4 percent of Saudi Arabia’s power, leaving a 46 percent gap to close in four years. The simultaneous opening of a new LNG terminal in 2024 in Saudi Arabia, combined with inflexible diesel-dependent desalination plants, suggests that fossil fuels will continue to anchor grid stability and meet data centre needs in the near term.

As an alternative to fossil fuels or intermittent renewables, UAE regulators are increasingly open to leveraging nuclear small modular reactors (SMRs) to meet baseload data centre energy requirements. Although a fairly nascent technology, SMRs occupy less space and can be co-located with facilities, eliminating the need for costly and time-intensive transmission infrastructure. However, deploying nuclear energy also risks nuclear entanglement. Data centres are already emerging as military targets due to their potential processing of civil, commercial, and military data. Co-locating SMRs with data centres could position them as valuable targets for adversaries.

Beyond power supply, managing facility-level water demand requires shifting away from traditional evaporative cooling systems, which consume massive volumes of freshwater. To address this issue, Gulf operators are adopting advanced cooling architectures. By circulating liquid coolants directly to chips in a sealed loop, operators can reduce direct water consumption by up to 98 percent. To further reduce freshwater withdrawal, they are also exploring alternative water sources. Treated sewage effluent (TSE) offers the most scalable alternative to potable water and has been applied in other water-stressed cities. On-site wastewater recycling can reduce freshwater use between 50 and 70 percent. Industrial wastewater can also be used for data centres co-located near manufacturing facilities but faces quality variation, requiring specialised treatment, and strict quality monitoring.

Beyond direct facility use, water security is indirectly tied to a “virtual water” footprint embedded in grid electricity generation. The GCC partially mitigates power-plant water intensity

through co-generation, which accounts for roughly 75 percent of regional capacity. In co-generation plants, fossil fuels are burned to generate electricity, producing steam that boils seawater into potable water. Although this system enables fuel efficiency, the coupling creates inflexibility. Water and power production become interlinked, preventing the former from being managed independently of grid load. During summer, power systems operate at full capacity, sometimes resulting in excess water production. Conversely, during winter, a decline in electricity demand due to reduced air-conditioning use threatens a consequential decline in desalinated water supply.

Physical and Cyber-Security Risks

Data centre site selection must also consider natural disaster exposure. The GCC region is located on a geologically stable Arabian Plate, away from major fault lines, and has low-to-moderate risk of local seismic activity. However, minor seismic risks persist along the Zagros Fold and Thrust Belt and the Makran Subduction Zone. Rare but devastating flash floods due to poor rain absorption would be more common, given the UAE and Oman’s experiences in April 2024. Guarding against future flooding requires physical adaptation through careful site selection, drainage infrastructure, and flood-resistant design.

Protecting facilities against aerial kinetic attacks is a new physical security challenge where experts have highlighted a lack of preparedness.

Geopolitical instability introduces an additional layer of physical risk to hyperscale infrastructure. While the cost of the March 2026 drone debris-induced data centre outages in the UAE and Bahrain was not publicly disclosed, similar high-impact outage events bear a median total annual expense cost of US$76 million for data centre service-dependent businesses. Civilian-service functions that leverage data centres for data storage or for intelligent systems such as agentic AI in government services would face immediate implications on national resilience.

Protecting facilities against aerial kinetic attacks is a new physical security challenge where experts have highlighted a lack of preparedness. Beyond traditional perimeter defences, individual facilities lack dedicated protection against aerial attacks, as rapid data centre demand outpaces security architecture planning. Physical resilience must also extend to the subsea cables and landing stations that connect Gulf facilities to international networks, which remain vulnerable to accidental and deliberate damage, especially amid reports of Iran laying naval mines in the Strait of Hormuz.

Recommendations to Build Infrastructure Resilience

Regional policymakers should thus build a tailored and adaptive resilience framework mitigating supply-chain chokepoints, resource demands, and kinetic and cyber vulnerabilities.

GCC states could strengthen supply-chain resilience by mapping dependencies and diversifying suppliers and transport routes, thus reducing exposure to disruptions concentrated in certain geographies. Coordination within the bloc could also support the strategic stockpiling of components with long production times, such as transformers and switchgear, and enable joint procurement, giving GCC buyers greater leverage. Finally, greater standardisation and equipment interchangeability across GCC markets could facilitate component replacement during disruptions.

Focusing solely on desalination expansion without parallel emphasis on demand-side water efficiency remains costly and environmentally damaging

The energy intensity of data centres demands adequate and stable electricity grids. While Gulf countries can continue to meet baseload demand through domestic energy sources, expanding interconnectivity for AI power availability through the GCC Interconnection Authority (GCCIA) would allow member states to share infrastructure investments, manage peak load strains, and protect against blackouts.

Focusing solely on desalination expansion without parallel emphasis on demand-side water efficiency remains costly and environmentally damaging. Enhancing water-use monitoring, smart scheduling, drought contingency planning, and site-specific water assessments will help reduce freshwater withdrawal. Directing excess desalinated water from winter months towards strategic reserves can also help meet the demand during the hot summer months.

Location selection also involves trade-offs. Basing hyperscale facilities away from dense urban centres can reduce exposure to local grid instability and provide cheaper land, but will probably require expensive new transmission lines and time-intensive fibre connections. Gulf states should thus require site-specific hazard assessments alongside redundant power and cooling systems, favouring locations with lower exposure to conflict and environmental hazards. Cyber resilience should be treated as an important design requirement, with tested incident-recovery plans, data back-ups, and regular recovery and business continuity exercises.

Leigh Mante is Junior Fellow, Climate and Energy, ORF Middle East. 

Elizabeth Heyes is Junior Fellow, Emerging Technologies, ORF Middle East. 

^[a] ‘Installed capacity’ refers to the maximum power output that all power plants can deliver if operating at full load.