Permission, not money, limits Gulf data centres

1. Where things stand

Per the GCC colocation portfolio data, the region hosts 111 existing data centres with 72 more upcoming. The two leading states are running quite different races, and conflating them is the most common error in this subject.

The UAE leads on what is switched on. More than 400 MW operational, over 45% of all GCC operational IT power, with Khazna alone above 350 MW.

Saudi Arabia leads on what is planned, holding more than 60% of upcoming regional power capacity.

Commentary blurs those constantly, which produces the familiar mistake of treating an announcement as an asset. One country is running machines. The other has ordered a great many.

Saudi Arabia is the only Gulf state that publishes what is actually running, and that single decision makes it the most analysable market in the region despite trailing on delivery. Per MCIT, national operational capacity was 68 MW in 2021, 440 MW in 2025 and 467 MW in the first quarter of 2026, across more than 60 facilities.

The growth is real and should not be diminished. The ministry describes it as nearly sixfold since 2021; the computed figure is 6.47 times, so if anything the official framing is modest.

But the base is small against the ambition, and this is where the numbers become uncomfortable. HUMAIN's 1.9 GW target for 2030 is 4.1 times everything the Kingdom runs today. Its 6.6 GW pipeline for 2034 is 14.1 times.

Read the MCIT figure narrowly, because it is easy to over-interpret. It is a national total with no operator breakdown and no split between colocation and hyperscaler self-build, so it cannot be reconciled against any individual operator's claim. It tells you the sum is small. It does not tell you which claims inside that sum are inflated. And no UAE, Qatari or Kuwaiti equivalent exists at all, which means the GCC-wide energised figure is simply unknown.

One published attempt to break the Saudi total down fails its own arithmetic, and it is instructive. A third-party ledger classifying Saudi capacity facility by facility lists sites summing to 860 MW as live, against the same 467 MW national total that the ledger itself cites. That is a 1.84 times overshoot, driven by counting two hyperscaler cloud regions at 350 MW and 400 MW that no source substantiates. Treat any facility-level Gulf capacity ledger as unverified until its own figures close.

The money numbers are no more solid, and for a reason worth understanding. Three different quantities circulate under the label "market size": per IMARC a 2025 GCC base of $2.39bn, which is service revenue; per Arizton $5.46bn, which is construction capex. Those are 2.28 times apart because they measure different things, not because anyone is wrong. A third figure, a $93bn announced pipeline across 174 projects, is the value of things declared rather than built.

Megawatts are the only unit the sources agree on, which is why this article uses them throughout and treats every dollar figure as a description of a category rather than a measurement of a market.

2. What changed

Four things moved, and together they turned the funding story into a delivery story.

November 2025, and the licences arrived small. US Commerce authorised 35,000 Blackwell GB300 accelerators each to HUMAIN and G42, conditioned on security and reporting.

Set that against the announced ambitions. The UAE's 5 GW and Saudi Arabia's 6 GW would need roughly 3,850,000 accelerators between them. Coverage is near 1.8%.

Late 2025, HUMAIN broke ground at Riyadh and Dammam, each stated at up to 100 MW, both committed to go live in the second quarter of 2026.

Q2 2026 passed without confirmation. As of 31 July 2026, no announcement, regulatory filing or credible report confirms either site is in commercial service. Two independent facility registries still classify both as under construction. HUMAIN declined to disclose progress when asked on 18 June and again on 24 July 2026.

May 2026, and MCIT began publishing energised capacity. For the first time a Gulf government put a delivery number on the record, quarterly. That is what makes the gap described above measurable rather than rhetorical, and it is a genuinely significant piece of policy transparency that has gone largely unremarked.

3. The risks this creates

3.1 Permission is the gate, not capital

Licensed coverage sits near 1.8% of the announced build.

The same finding is sometimes quoted a second way, as announced gigawatts exceeding authorised silicon by about 55 times. That is the identical figure inverted, not a second piece of evidence. One divided by 1.8% is 55. Citing both as independent support for the same conclusion is double-counting, and it happens often.

The precision here is softer than the conclusion, and we would rather say so than let a clean-looking number travel further than it should. The "35,000 chips is roughly 100 MW" conversion underneath it is a press characterisation rather than a Commerce specification. So the 1.8%, the 3,850,000 and the 55 times all inherit that softness.

What survives the uncertainty is the conclusion. Permission would still be the binding gate at several times the coverage. The argument tolerates wide error; the number should not be quoted to three significant figures.

This is an escalation of a known risk rather than a new one, and the exposed parties are specific: HUMAIN and G42, not "the region".

3.2 The 2026 queue closed in 2023

This is a genuinely new link, because it joins two things that are almost never discussed together: an AI compute ambition announced in 2025, and an electrical procurement decision that had to be made in 2023.

Per Terrapin CG, power transformers run 128 weeks and generator step-up units 144 weeks, with specialised orders reaching four years.

Work the calendar backwards, because the implication is stark. To energise capacity in the third quarter of 2026, you had to order transformers in early 2024 and generator step-up units in mid-2023.

Anything switching on in the Gulf in 2026 was therefore ordered before most of these programmes were public. The equipment for this year's capacity was bought by people who were not responding to the AI announcements, because the announcements had not happened yet.

The mechanism is unusual and worth naming. It is not that this risk might materialise. The outcome is already fixed and merely not yet visible. The 2026 pipeline is not a forecast at all. It is a procurement record. Only 2028 and beyond is still a decision anyone can influence.

3.3 Every announced campus depends on one island

Every accelerator in every announced Gulf campus is fabricated by TSMC, and there is no fabrication capacity anywhere in the GCC. Per TrendForce, TSMC took 69.9% of the global foundry market by revenue in FY2025, up from 64.4% a year earlier, and a disruption would impose an 18–24 month floor on any alternative silicon.

That floor is the number that matters, because it is not a money problem. Redesigning a chip for a different process is engineering time and foundry allocation. A buyer with more capital does not shorten it.

The underlying research marks this directional rather than quantified, and so do we: this is our read of the exposure, not a sourced probability. No source found puts a likelihood on a Taiwan disruption, and any analysis offering one is inventing it.

3.4 The same corridor carries the cables and the cargo

Gulf connectivity has failed twice in eighteen months.

In February 2024 the Rubymar's dragged anchor severed AAE-1, EIG and SEACOM, affecting a reported 25% of Asia–Europe–Middle East traffic. In September 2025 SMW4 and IMEWE were cut, and Microsoft rerouted Azure with measurable Gulf latency spikes, per NetBlocks.

This is the classic second-order risk, and it is the one operators are least equipped to think about. Nothing about the data centre fails. The power holds, the cooling holds, the machines run, and the thing the facility sells becomes unsellable, because it cannot be delivered.

Repairs take weeks against service levels measured in minutes. It is the one constraint here that capital genuinely cannot fix, because the failure is several hundred kilometres offshore and the repair fleet is small and globally shared.

3.5 Compute load displaces other national demand

HUMAIN's full 6 GW target would draw a computed 42.0 TWh a year, about 12% of Saudi national electricity consumption, and 2.0 times the electricity used by all Saudi desalination.

The framing that matters is displacement rather than consumption. That power does not appear from nowhere; it comes from a national system with other users.

Note also which story the arithmetic supports, because the popular one is wrong. The water story is the one usually told about Gulf data centres: the desert, the cooling, the scarcity. The same build-out needs 2.30–4.61% of desalination output. That is not trivial and it is not the binding constraint.

Power is the binding coupling. Water is not. We include this correction because our own earlier work framed it the other way round.

3.6 Sovereign programmes do not report delivery, and listed ones do

Listed operators disclose capacity because they are required to. stc reports its white space. MCIT reports the national total.

Sovereign vehicles publish targets and stay silent on delivery. HUMAIN was asked twice and declined both times.

Be precise about what that silence is, because it is easy to over-read. It is an absence of evidence, not a disclosure of delay. Nobody has said the sites are late. Nobody has said they are running. A quiet energisation is entirely possible, though a sovereign programme has every incentive to publicise one, and did not.

The asymmetry is the risk. Our read, not a sourced finding: any regional capacity estimate built by summing announcements will skew high exactly where verification is weakest, which is to say in the sovereign programmes that account for most of the announced total.

4. What it means for chips, power equipment and telecoms

Every layer of this build-out has a chokepoint outside the Gulf. The region supplies the energy and the land. It supplies none of the equipment.

4.1 Chips: an authorisation is not a supply

Being licensed to buy accelerators confers no memory allocation whatsoever, and this catches buyers repeatedly.

High-bandwidth memory comes from three volume producers and, per Everstream, is effectively sold out for 2026 on multi-year agreements signed before the Gulf programmes existed. Advanced packaging competes for the same allocation as smartphone processors.

So there are two independent gates on the same box, and clearing the political one does nothing for the commercial one. An accelerator without memory is not a slower accelerator. It is an unusable one. Anyone modelling licence approval as the release condition for capacity will be wrong.

One honest caveat, because it would materially weaken this point if true. "Sold out" is an industry characterisation rather than a disclosed order book. Sovereign buyers may hold undisclosed allocations through OEM partners. If they do, this gate weakens considerably, and we have no way to check.

4.2 Power equipment: the queue closed before the money arrived

This is the cleanest case in the article because it is pure arithmetic with no judgement in it.

Capital moves a project up a queue only when the queue is priced. A four-year manufacturing lead time is not priced. It is physical, and paying more does not create a second transformer factory inside the window.

The consequence for anyone selling into this build-out is that 2026 revenue is already allocated and 2027 largely so. The only decision still open is 2028. For anyone buying, the transformer, not the accelerator, decides the date.

Beneath the equipment sit the materials, and they are concentrated too. China holds 94% of rare-earth magnet manufacture and around 44% of refined copper on IEA figures, so even the electrical equipment queue has a chokepoint behind it.

4.3 Telecoms: the corridor is a single point of failure

The Gulf's compute is worth only what it can deliver, and delivery runs through the Red Sea.

Two severance events in eighteen months is not a tail risk. It is a demonstrated rate, and the conditions that produced both, heavy vessel traffic in shallow water near a contested chokepoint, have become more common rather than less.

For operators this is the exposure that cannot be engineered away locally, and that is what makes it different from everything else here. You can build redundant power, redundant cooling and redundant compute inside the fence, spend whatever it takes, and still lose the service to a dragged anchor several hundred kilometres offshore.

5. What to watch

Count energised megawatts, not announced ones. For Saudi Arabia that is now possible, because MCIT publishes the national total quarterly.

Watch the increment rather than the level. Capacity rose 6.14% in a single quarter to reach 467 MW. Sustaining anything like the announced trajectory would require quarterly increments several times larger than that, sustained for years.

The two flagship sovereign sites are the specific test. If Riyadh and Dammam are confirmed in service, the delivery machine works and the licence is the only gate that matters. If they stay unconfirmed through 2026 while the national total creeps up in single-digit percentages, then the constraint is broader than permission, and the whole regional thesis needs revisiting.

Two other signals would move the conclusion materially. A new export authorisation with an actual unit count attached, not a statement of diplomatic intent, changes buildable capacity directly, and it moves on a timescale of weeks rather than years. A named cable system confirmed damaged tells you the corridor risk has recurred rather than resolved.

And if transformer lead times published by the manufacturers fall below roughly two years, the calendar constraint is easing and 2028 becomes genuinely open.

One framing to avoid while watching. The AI build-out case and the overbuild-correction case are one position with two outcomes, not two independent risks. Treating them as separate double-counts the uncertainty, and produces a risk register that looks more diversified than the underlying exposure is.

Finally, the reading that follows from all of it.

The usual description of this is supply-chain risk, and that undersells it considerably. A supply-chain risk is something you hedge with inventory, dual sourcing or a longer contract. None of those are available here. Every input outside energy and land is gated by a jurisdiction outside the region, and two of those jurisdictions have attached conditions to each other's participation.

That reading is ours rather than any source's, but it follows directly from facts that are sourced: the licence ratio, the fabrication concentration, and the plain fact that no amount of capital shortens a 128-week transformer.

Model the licence, not the capex. Track megawatts energised, not gigawatts announced.