Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Risks and capability

Four global risk objects open the portfolio. Order carries no rank. Each is read across driver, exposure, vulnerability, capacity, cascade and consequence; loss metrics are added only where they can be modelled.

5 min read0 figures1 table22 notesNR-STRATEGIC-STRATTECH-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1Technology rests on a few physical inputs
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
    1. 4.1 Risk objects
    2. 4.2 Capability ladder
  7. 5Local grid constraint that overlaps a chip or mineral supply constraint
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

4.1Risk objects

Each risk is read across the chain from hazard to consequence, with its status and evidence-quality level.

  1. ReportedEQL 4RSK-SR13-ENE-001

    Local grid constraint on large new loads

    Driver
    clustered data-centre load and fast growth12
    Exposure
    regions where data centres hold a large share of electricity12
    Vulnerability
    connection waits and local clustering; waiting times not bound
    Capacity
    grid reinforcement; flexible or interruptible connections; siting rules
    Cascade
    AIC → ENE → INF
    Horizon
    1 to 5 years

  2. ReportedEQL 3RSK-SR13-MIN-002

    Concentrated refining of energy and technology minerals

    Driver
    top-refiner average share of 72% in 20253
    Exposure
    chips, cables, batteries and power equipment
    Vulnerability
    one country holds most refining for most minerals tracked
    Capacity
    new refining projects; recycling; stockpiles; trade partners3
    Cascade
    MIN → TRD → AIC
    Horizon
    1 to 5 years

  3. ReportedEQL 3RSK-SR13-TRD-003

    Chip supply short of policy targets

    Driver
    fast demand growth with concentrated production47
    Exposure
    cloud, communications, vehicles, defence, health devices
    Vulnerability
    EU forecast of 11.7% against a 20% target7
    Capacity
    public funding and state aid decisions438
    Cascade
    TRD → AIC → DAT
    Horizon
    5 to 10 years

  4. InferredEQL 3RSK-SR13-DAT-004

    Dependence on shared cloud services

    Driver
    wide cloud use by enterprises9
    Exposure
    enterprises, public services, payments
    Vulnerability
    provider concentration; not bound in this edition
    Capacity
    data portability and switching rules17
    Cascade
    DAT → INF → FIN
    Horizon
    1 to 5 years

4.2Capability ladder

Existence is not readiness. Each of the fifteen capability functions is placed on the ladder by the strongest public evidence at the global level, from a policy listing to performance in real events.

Table 4.1Capabilities on the ladder of evidence: listed, exists, demonstrated, tested
FunctionRungLevelStrongest public evidence at baseline
Prevention and mitigationEXISTSsecurity, continuity and risk standards widespread; implementation uneven31323334
Monitoring and observationADEQUATEload and sales series published; supply-chain visibility uneven14
Early warningLISTEDno common early warning for chip or mineral shortages
Preparedness and planningEXISTSchips, AI, data and cyber rules in force or applying816171819
Redundancy and reservesLISTEDstockpiles and spare capacity not consolidated
ResponseLISTEDcrisis coordination set up under the EU Chips Act, not tested here8
Continuity of critical servicesEXISTScontinuity standards and critical-entity rules2932
RecoveryLISTEDrecovery of data services after multi-site loss not consolidated
AdaptationEXISTSnew refining projects reported3
Social protectionLISTEDsupport for exposed workers and regions not consolidated
Finance and insuranceEXISTSUSD 50 billion US chip programme; EU state aid decisions438
Institutional coordinationEXISTSEuropean Semiconductor Board and AI Office; cross-border practice uneven816
Technical infrastructureEXISTSAI Factories established across Member States15
WorkforceLISTEDskills shortages noted by auditors7
Research capacityADEQUATEinterdependency science mature373940
A capability listed in policy is not a tested one; each rung is the strongest public evidence at baseline.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 1IEA (ed.), Energy and AI (World Energy Outlook Special Report). International Energy Agency, Paris, April 2025. Observation year 2024. Accessed 2026-11-03.back
  2. 2IEA (ed.), Global Energy Review 2026 (revised version, May 2026). International Energy Agency, Paris. Observation year 2025. Accessed 2026-11-03.back
  3. 12Central Statistics Office (ed.), Data Centres Metered Electricity Consumption 2024 (release of 10 June 2025; 22% of metered electricity in 2024, 21% in 2023, 5% in 2015). CSO, Cork. Observation year 2024. Accessed 2026-11-03.back
  4. 3IEA (ed.), Global Critical Minerals Outlook 2026 (revised version, July 2026). International Energy Agency, Paris. Observation year 2025. Accessed 2026-11-03.back
  5. 4WSTS (ed.), Global Semiconductor Market grows 26% in 2025 to USD 796 billion (release page; sales of USD 795.6 billion, up 26.2%). World Semiconductor Trade Statistics, Dec 2025 data, release dated March 2026 by file name. Observation year 2025. Accessed 2026-11-03.back
  6. 7European Court of Auditors (ed.), The EU’s strategy for microchips, special report 12/2025 (news item read; the 20% target and the Commission forecast of 9.8% in 2022 and 11.7% in 2030; the full report was not opened). European Court of Auditors, Luxembourg. Observation year 2025. Accessed 2026-11-03.back
  7. 43US Congress (ed.), CHIPS and Science Act of 2022, Public Law 117-167, Division A, Title I, section 102 (statute text, US Government Publishing Office; CHIPS for America Fund appropriations for fiscal years 2022 to 2026 of USD 39 billion for manufacturing incentives under section 9902 and USD 11 billion for research; totals are sums of the annual amounts). Observation year 2022. Accessed 2026-11-03.back
  8. 8European Commission (ed.), European Chips Act (policy page; Regulation (EU) 2023/1781; three pillars; 19 State aid decisions with over EUR 33 billion of public and private investment). European Commission, Brussels. Observation year 2026. Accessed 2026-11-03.back
  9. 9Eurostat (ed.), Cloud computing: statistics on the use by enterprises (Statistics Explained; 52.74% of EU enterprises with 10 or more persons used paid cloud services in 2025). Eurostat, Luxembourg. Observation year 2025. Accessed 2026-11-03.back
  10. 17European Commission (ed.), Data Act (policy page; Regulation (EU) 2023/2854; in force 11 January 2024; applies from 12 September 2025). European Commission, Brussels. Observation year 2025. Accessed 2026-11-03.back
  11. 31UNVERIFIED, not opened: ISO/IEC 27001:2022, Information security management systems. International Organization for Standardization, Geneva. Observation year 2022. Accessed 2026-11-03.back
  12. 32UNVERIFIED, not opened: ISO 22301:2019, Security and resilience: business continuity management systems. International Organization for Standardization, Geneva. Observation year 2019. Accessed 2026-11-03.back
  13. 33UNVERIFIED, not opened: IEC 62443 series, Security for industrial automation and control systems. International Electrotechnical Commission, Geneva. Observation year 2018. Accessed 2026-11-03.back
  14. 34UNVERIFIED, not opened: ISO 31000:2018, Risk management: guidelines. International Organization for Standardization, Geneva. Observation year 2018. Accessed 2026-11-03.back
  15. 16European Commission (ed.), AI Act (policy page; Regulation (EU) 2024/1689; in force 1 August 2024; general application 2 August 2026; omnibus in force 27 July 2026). European Commission, Brussels. Observation year 2026. Accessed 2026-11-03.back
  16. 18European Commission (ed.), Cyber Resilience Act (policy page; Regulation (EU) 2024/2847; in force 10 December 2024; reporting from 11 September 2026; main obligations from 11 December 2027). European Commission, Brussels. Observation year 2026. Accessed 2026-11-03.back
  17. 19European Commission (ed.), NIS2 Directive (policy page; Directive (EU) 2022/2555; transposition deadline 17 October 2024). European Commission, Brussels. Observation year 2024. Accessed 2026-11-03.back
  18. 29UNVERIFIED, not opened: Directive (EU) 2022/2557 on the resilience of critical entities, Official Journal of the European Union, 2022, cited from memory; the EUR-Lex request returned no text. Observation year 2022. Accessed 2026-11-03.back
  19. 15EuroHPC Joint Undertaking (ed.), AI Factories (programme page; states 19 AI Factories and 13 antennas while the listing shows 18 entries; no amounts). EuroHPC Joint Undertaking, Luxembourg. Observation year 2026. Accessed 2026-11-03.back
  20. 37UNVERIFIED, not opened: Farrell, H. and Newman, A.L., Weaponized Interdependence: How Global Economic Networks Shape State Coercion, International Security 44(1), 42 to 79, 2019, cited from memory. MIT Press. Observation year 2019. Accessed 2026-11-03.back
  21. 39UNVERIFIED, not opened: Rinaldi, S.M., Peerenboom, J.P. and Kelly, T.K., Identifying, understanding, and analysing critical infrastructure interdependencies, IEEE Control Systems Magazine 21(6), 11 to 25, 2001, cited from memory. Observation year 2001. Accessed 2026-11-03.back
  22. 40UNVERIFIED, not opened: Buldyrev, S.V. et al., Catastrophic cascade of failures in interdependent networks, Nature 464, 1025 to 1028, 2010, cited from memory. Springer Nature. Observation year 2010. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 4: Risks and capability. In Strategic Systems Report 2026: Strategic Technology Infrastructure and Sovereign Readiness (Baseline Edition 2026, Report No. NR-STRATEGIC-STRATTECH-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Strategic Technology Infrastructure and Sovereign Readiness.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskStrategic Systems

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices