The UAE built a bypass, and the bypass got hit

1. Where things stand

On oil and the bypass. The second West-East pipeline was reported roughly 50% complete in May 2026 and is expected operational in 2027. Set that against a blockade that began in March 2026, and the timing problem is plain: the capacity that would matter most is not available during the event that accelerated it.

Two loss figures circulate and they do not reconcile. Reporting gives more than 1 billion barrels lost to the closure, and separately about 100 million barrels lost per further week. At a constant 100 million a week, a billion implies roughly ten weeks, but the blockade is around twenty-four weeks old. They are measuring different things, most likely a cumulative regional total against a current weekly run-rate, and no source found states the basis for either. We quote them separately and never derive a duration from them, and we would suggest you do the same.

On property. Fitch forecasts a 15% correction in Dubai. The span is the part that gets dropped: it runs from July 2025 to the end of 2026, eighteen months rather than twelve. Quoted as an annual rate it overstates the speed of the decline by roughly a third, which flatters or frightens depending on who is using it. Between 42,000 and 45,000 new units arrive during 2026, concentrated in specific submarkets rather than spread across the city.

The channel that matters is the banking system. At end-2025, per Fitch, corporate real estate was 13% of UAE banks' total loans and retail mortgages around 10%. Those two figures are routinely added into a combined 23% exposure. They only add if the categories are disjoint, and no source states whether they are. Each is large on its own; the combined number is not established. Fitch's own view is that banks and developers can absorb the correction.

On compute, where the UAE genuinely leads. The country has over 400 MW of data-centre capacity operational, more than 45% of all switched-on IT power in the GCC, with Khazna alone above 350 MW. That is a real distinction from Saudi Arabia, which leads on announced pipeline rather than on delivery. In a region full of announcements, the UAE is the one actually running the machines.

The exposures sit in what it takes to keep building. G42 holds a US authorisation for 35,000 Blackwell accelerators, conditioned on security and reporting, enough for roughly 100 MW. Stargate UAE's announced ambition is 5 GW, which is 12.5 times the country's entire operational base today. Across the GCC, authorised silicon covers about 1.8% of the announced build.

And every layer of the supply chain has a chokepoint outside the Gulf. Silicon comes from Taiwan. High-bandwidth memory comes from three producers, all in Korea and the US. Power transformers come from Asia and a single US supplier of the specialist steel. Copper and magnets come from China. The fibre runs through the Red Sea. The region supplies the energy and the land. It supplies none of the equipment.

2. The ten emerging risks

Ranked by how much damage the event would do, not by how well we can evidence it. Several of the most severe rest on our judgement rather than on a published forecast, and where that is the case we say so in the entry itself. Ranking the other way round, by how well a risk can be counted, promotes the small measurable things and buries the ones capable of ending the strategy.

2.1 The bypass has one coordinate, and it has already been found

Fujairah has been hit once and loading recovered. A strike that takes the terminal offline rather than interrupting it would remove the only working crude bypass in the Gulf, at the moment it is carrying more than it has ever carried, and the replacement capacity does not arrive until 2027.

The first attack is the reason to take the second seriously, and the detail matters. The reported damage was to loading operations. That is the mild end of what a strike on a marine export terminal can do: berths, loading arms, storage tanks, metering and the pipeline manifold are all in the same place, and they have very different repair timelines.

Nothing about the first attack establishes a ceiling on the second. The distance between "loading was disrupted" and "the terminal is out for six months" is a question of what gets hit, not of how determined the attacker is.

Now look at what sits behind it, which is the actual risk. Until the second line is operational in 2027, the UAE's entire Hormuz position runs through one facility. There is no third route, no spare terminal, and no ability to build one inside the disruption. Lose Fujairah and the country moves from the best-hedged position in the Gulf to no hedge at all, in an afternoon.

We could find no published assessment of the damage from the first attack, and no repair timeline. That means the margin between what happened and what could have happened cannot be measured, and that absence is itself the argument for ranking this first rather than a reason to rank it lower.

2.2 The blockade outlasts the bypass built to answer it

The second pipeline is a 2027 asset responding to a 2026 event. Every month the disruption continues before it is commissioned is a month the UAE runs its entire crude export position on a single line.

This is arithmetic on published dates rather than a forecast, which makes it one of the more certain items here. The line was roughly half built in May 2026. It is expected to run in 2027. The blockade started in March 2026.

Acceleration has limits, and they are physical. Large-diameter pipeline construction is constrained by pipe supply, welding crews, right-of-way and commissioning sequences. Money speeds up some of that and none of it very much. The remaining half of the line cannot be compressed into the window that made it urgent.

The exposure is the overlap between the two periods, and it is why this risk and the one above are really the same risk seen from two ends. One says the terminal could be lost. This one says there is nothing behind it for as long as the overlap lasts.

What would change the assessment is a commissioning date. None has been published beyond the year, and no source found puts a date on when the blockade ends either. The overlap is therefore of unknown length in both directions, which is an uncomfortable thing to say and more honest than picking a number.

2.3 A Taiwan disruption stops the compute programme outright

Every accelerator in the UAE's AI build-out is fabricated on one island. There is no fabrication capacity in the country and no second source at the scale a gigawatt campus needs. A disruption to Taiwanese supply does not slow the programme. It ends it.

The distinction between slowing and stopping is the whole of this risk, and it is worth being precise about why capital does not solve it.

A delay is something money fixes. You pay for expedited shipping, overtime, a second shift, a premium in the spot market. A supply absence is different in kind: there is no spot market deep enough to matter when the constraint is leading-edge fabrication capacity, and there is no second foundry that can absorb the volume. The UAE could commit unlimited funds and change nothing about the delivery date.

The correlation is what makes this rank third rather than lower. The same event that interrupts Taiwanese fabrication would tighten high-bandwidth memory allocation and lengthen equipment lead times at the same moment, because every other buyer in the world would be doing what the UAE was doing. The three constraints in this risk and the next one do not fail independently. They fail together, in the same week.

No source found puts a likelihood on a Taiwan disruption, and any analysis offering one is inventing it. We are ranking on consequence alone, and the consequence is that the programme the UAE has built its non-oil economic story around would have no path forward for as long as the disruption lasted.

2.4 The licence is the ceiling, and Washington holds the pen

G42's authorisation covers 35,000 accelerators, roughly 100 MW. Stargate UAE's first phase alone needs about 70,000, twice the entire approval. If the conditions tighten or the allocation is not extended, campus capital already committed strands against a limit no sovereign fund can lift.

This is the sharpest structural fact about Gulf AI and it is the one most often missed, because the region's constraint is assumed to be money and money is the thing it has most of.

Run the arithmetic and the gap is not marginal. At roughly 350 accelerators per megawatt, a 200 MW first phase needs around 70,000 chips against 35,000 authorised. Scale it up and the UAE's announced 5 GW alongside Saudi Arabia's 6 GW would need roughly 3,850,000 accelerators between them, against 70,000 authorised in total. Across the GCC, licensed silicon covers about 1.8% of the announced build.

There are only three ways that resolves. Further licences are granted. The campuses fill with older, less restricted silicon and deliver less capability per megawatt. Or the programme slips. Those are materially different futures for anyone underwriting the build, and no source distinguishes between them or indicates which is expected.

The uncomfortable feature is that this bites hardest on the party doing everything right. The authorisation carries security and reporting conditions, and meeting them fully still leaves the decision with a government that is not the UAE's, on a renewal cycle shorter than the asset life of a data centre. A sovereign fund can finance a campus. It cannot finance an export authorisation.

The conditionality is a matter of public record. Whether it tightens is our judgement, and no source found forecasts it.

2.5 Memory and transformers bind before chips or capital do

**High-bandwidth memory has three producers and is effectively sold out for 2026 on contracts signed before the Gulf programmes existed. Power transformers run 128 weeks and generator step-up units

1. Being authorised to buy accelerators confers no claim on either.**

This is the least discussed constraint in the whole regional AI story and one of the most binding, because it operates even in a world where nothing geopolitical happens at all.

Take memory first. An accelerator without high-bandwidth memory is not a slower accelerator; it is an unusable one. HBM comes from three volume producers, and 2026 supply was committed under multi-year agreements signed before anyone in the Gulf was ordering at this scale. Critically, an export authorisation for chips says nothing about memory. They are separately contracted, from different suppliers, on different timetables.

Then the electrical equipment, where the lead times are startling once stated plainly. Power transformers are quoted at 128 weeks and generator step-up units at 144, with specialised orders running to four years. Work backwards and the implication is stark: to energise capacity in the third quarter of 2026, transformers had to be ordered in early 2024 and step-up units in mid-2023.

That means the 2026 pipeline is not a forecast at all. It is a procurement record, already determined by orders placed two to three years ago. Only the 2028-and-beyond pipeline is still a decision anyone can influence. Any announcement about near-term capacity that is not backed by equipment ordered years ago is describing an aspiration.

2.6 The property correction reaches bank asset quality

Corporate real estate is 13% of UAE bank loans and mortgages around 10%. A correction that impairs those books turns a property cycle into a question about the financial system.

This is the channel that makes the price forecast worth watching at all. A 15% move in an asset class is a market event that participants absorb. The same move running through a large share of the banking system's loan book is a different category of problem, because banks that are provisioning against one sector lend less to every other sector at the same time.

The mechanism has a schedule attached, which is unusual and useful. Between 42,000 and 45,000 units complete during 2026, and the correction window runs to the end of that year. The peak of new supply lands inside the forecast decline rather than after it, which is the sequence most likely to produce distress in specific projects rather than a gentle citywide drift.

Two things argue the other way and should be stated with equal weight. Citywide oversupply is judged unlikely on absorption rates, since Dubai has absorbed large completions before. And Fitch, the same institution producing the forecast, judges that banks and developers can absorb the correction.

We rank this sixth rather than higher for that reason. It is a real transmission channel with a real counter-argument, and the risk is conditional on the correction behaving worse than its own central case rather than on the central case being right.

2.7 The combined property exposure is larger than the market believes

Per Fitch, corporate real estate was 13% of UAE bank loans at end-2025 and mortgages around 10%. Those are quoted everywhere as a combined 23%. Nobody has published whether the two categories overlap, so the number in circulation is an assumption wearing the clothes of data.

This is a live pricing question rather than a technical quibble. Analysts, counterparties and rating commentary are all working from a combined exposure figure that no source has ever stated.

The direction of the error is not knowable in advance, which is exactly what makes it a risk rather than a conservatism. If the two books are largely disjoint, with different borrowers and different collateral, the sum is close to right, and UAE bank real-estate concentration sits at the top of the regional range. If they overlap substantially, the true figure is materially lower and the market is overstating the exposure.

An estimate that could be wrong in either direction is not a cautious assumption. It is an unpriced one, and it sits underneath the risk above.

Anyone quoting 23% is presenting an assumption as data. Each number is large on its own, and that is as far as the published evidence goes.

2.8 A third cable cut lands in a corridor that is now busier

Two multi-cable failures in eighteen months is a demonstrated rate, not a tail risk. Repairs take weeks. The service levels the UAE sells to hyperscalers and banks are measured in minutes.

The record is specific and neither event was exotic. In February 2024 the Rubymar's dragged anchor severed AAE-1, EIG and SEACOM together, taking out roughly a quarter of Asia–Europe–Middle East traffic. In September 2025 SMW4 and IMEWE were cut, and Microsoft rerouted Azure traffic with measurable latency spikes across the Gulf.

Both were the ordinary consequence of heavy vessels operating in shallow water near a chokepoint. The blockade has put considerably more of them there, along with naval traffic that was not previously in the corridor.

For most economies a cable cut is an inconvenience with a workaround. For a state selling itself as the region's digital hub it is a product failure, because the connectivity is the product. The availability commitments underpinning cloud regions and financial infrastructure are written in minutes; the repair ships work in weeks, and there is no amount of capital that shortens a cable-repair vessel's transit and splice time.

This is the constraint on the list that money most clearly cannot fix, and the rate is the finding. Two events in eighteen months requires no forecast to be concerning, only that the conditions producing them have not improved, and they have not.

2.9 Dubai's correction runs deeper than the central forecast

Fitch's 15% is a central case, not a floor. A correction that overshoots would land on a market absorbing 42,000 to 45,000 new units in a single year, in submarkets where the new supply and the speculative buying are the same places.

The citywide average is the wrong lens, and this is the most common error in reading the Dubai market. A 15% decline across the city is entirely consistent with substantially larger falls in specific communities, because completions are not evenly distributed and neither is leverage.

Where new supply is heaviest, three things coincide: the largest volume of units seeking buyers at once, the highest share of investor rather than end-user demand, and the thinnest resale depth. Those are the conditions under which a moderate average becomes a severe local outcome.

The timing compounds it. Supply arrives during 2026 and the forecast window closes at the end of 2026, so the completions land inside the decline rather than after it has run its course.

We rank this ninth because the evidence genuinely points the other way on the citywide question, and because absorption in Dubai has repeatedly surprised on the upside. It is carried because a citywide average is not a promise about any particular submarket, and the leverage is concentrated where the risk is.

2.10 The compute leadership figure is revised downward

The UAE's 400 MW is reported by the companies building the capacity, not by a regulator counting it. Saudi Arabia publishes an official quarterly series through MCIT. The UAE publishes nothing comparable.

Sovereign AI partnerships, chip allocations and investor capital are all being sized against that figure. It is the basis on which the UAE is treated as the region's delivered-compute leader, and it is the single most important number in the country's technology story.

The asymmetry is the point, and it is genuinely awkward. Saudi Arabia trails on delivery and publishes a number every quarter that anyone can check. The UAE leads on delivery and publishes nothing, so its strongest claim is the one hardest to verify. If the operational figure is materially lower than reported, counterparties find out after committing rather than before, and the UAE holds no official series with which to correct the record in either direction, including upward.

We rank this last because a revision would reprice expectations rather than destroy assets. We include it because every other compute risk on this list is measured against that baseline, and a baseline nobody audits is a weak foundation for the region's most consequential industrial bet.

2.11 EGA's smelters were struck, and one faces a year-long outage

ADDED 2026-08-20. This risk was absent from the first version of this article. The vault's aluminium note now carries the event, and it is material enough that its omission understated the UAE's physical exposure.

Emirates Global Aluminium's Al Taweelah plant was struck on 28 March 2026 with reported "significant damage", and faces roughly 12 months to restore full production. Alba in Bahrain was hit in the same attack.

This matters beyond one company. EGA is 3.65% of world aluminium capacity across Jebel Ali and Al Taweelah, the largest producer outside China and Russia, and 8.03% of world smelting sits inside the Strait of Hormuz.

The severity comes from the physics rather than the ordnance. Smelting runs at 13–15 MWh per tonne, and a few hours without current freezes the bath into rock and destroys the cells. Qatar's Qatalum, warned in advance by QatarEnergy, executed a controlled 40% shutdown, took no physical damage and may be back at full output by Q4 2026. EGA got no warning and faces twelve months.

There is a second exposure underneath, and it predates the missiles. In August 2025 Guinea revoked the bauxite licences of a UAE aluminium producer's subsidiary and reallocated them to a state-backed company. Guinea is 34.09% of world bauxite. EGA was already losing feedstock seven months before it was attacked, which means the input chain and the plant were compromised independently and in sequence.

3. What this means

Every UAE hedge is a fixed asset. The pipeline, the terminal, the campuses, the cables. Each one converts a diffuse exposure into a concentrated one, which is usually an improvement and is never an elimination. The question a hedge invites is not whether it exists but what now has to survive, and six of the ten risks above are answers to that question.

The delivery record is the best in the region and the verification is the weakest. The UAE leads the GCC on energised compute and publishes no official series, while Saudi Arabia trails on delivery and publishes quarterly. That asymmetry means UAE claims are hardest to check precisely where they are strongest.

The severe risks are the unquantified ones. The three entries that would do the most damage, a disabling strike on Fujairah, a withdrawn authorisation and a Taiwan disruption, carry no defensible probability, and no source offers one. That is not a research gap. It is what an honest register looks like when it refuses to rank by what happens to be countable.

What to watch. Three indicators would move this assessment materially: a published damage and repair assessment for Fujairah, confirmation of the second pipeline's commissioning date, and any change to the terms of the G42 authorisation. None is currently in the public domain.