Summary
- The UAE is revising a planned 5GW AI data-centre estate after attacks damaged technology infrastructure in the Gulf.
- Security options under consideration include geographic dispersion, underground elements, blast-resistant construction, and enhanced air defence.
- The redesign provides a direct comparator for European debate over physical resilience and concentration risk in critical digital infrastructure.
The United Arab Emirates is redesigning its planned 5GW AI data-centre programme around a more distributed and physically protected infrastructure model after attacks on technology facilities exposed the risk of concentrating compute capacity in a single campus.
The programme had been conceived around a very large Abu Dhabi development, but the revised approach is expected to spread facilities across multiple locations in the UAE. Security measures being examined include underground construction, blast-resistant materials, and stronger protection against drone and missile threats.
The project is being led by G42 and forms part of the UAE’s wider attempt to build large-scale AI infrastructure with US technology partners. An initial phase of the Stargate UAE programme was announced with significant capital commitments and a first block of capacity intended to come online during 2026.
The redesign follows attacks earlier this year that damaged technology infrastructure in the UAE and Bahrain. The resulting change in architecture turns physical security from a perimeter requirement into a question about the geographic and structural design of the entire compute estate.
A distributed model can reduce the probability that one strike or infrastructure failure removes a very large share of national AI capacity at once. It also creates new engineering trade-offs because several protected campuses require duplicated substations, cooling systems, network routes, backup generation, security systems, and operational teams.
Concentration risk moves into facility design
The shift provides a useful comparator for Europe, where data centres are increasingly being treated as critical infrastructure rather than ordinary commercial property. Governments have concentrated heavily on cyber resilience, supply-chain security, and data sovereignty, but physical concentration creates a different failure mode.
Large AI campuses are attractive because they allow operators to place enormous computing clusters behind shared electrical, cooling, and network systems. That can improve operating efficiency and simplify high-speed connections between compute resources. The same concentration can also create a larger single point of exposure.
Geographic distribution reduces that exposure but complicates the network architecture. Workloads and data must be replicated or shifted between locations, fibre routes need physical diversity, and operators must decide how much electrical and cooling redundancy is duplicated across sites.
Underground construction creates another set of engineering consequences. Below-ground facilities can offer protection, but excavation, groundwater management, heat rejection, ventilation, fire safety, access, equipment replacement, and emergency response become more complex. A blast-resistant envelope does not remove the need to reject large quantities of heat continuously or to maintain resilient electrical supply.
European operators are unlikely to reproduce the UAE threat model directly, but the underlying design question is relevant. The UK has designated data centres as critical national infrastructure, while European governments are placing greater emphasis on resilience of digital and energy systems. Facilities that support government, defence, finance, communications, or large-scale AI may face closer scrutiny over physical dependencies as well as cyber controls.
There is also a power-system dimension. A dispersed estate can spread demand across more than one grid location, potentially reducing local concentration, but it can also require several large connection agreements rather than one. The resilience benefit depends on whether those sites ultimately depend on separate substations, transmission routes, fuel logistics, and communications corridors.
The UAE programme is unusually large, and its security response is being shaped by an active regional conflict rather than normal commercial risk. It should therefore be treated as a comparator rather than a template for European construction.
It does, however, demonstrate how quickly assumptions about optimal data-centre scale can change once physical attack is included in the design basis. A 5GW campus may offer extraordinary computing density, but its value depends on the ability to keep that capacity available under the failure scenarios the owner is required to withstand.
