Readings from the other desks
The cloud baseline is read through each steward’s lens, then once as a whole. Each lens is a projection of reviewed findings, not a separate argument. The other desks’ own editions of this subject are listed first, as cross-references, not copies.
Contents
- ·Edition home
- ·Executive summary
- 1Cloud is shared infrastructure with a physical footprint
- 2Key findings
- 3Systems and sectors at baseline
- 4Risks and capability
- 5Shared control-plane fault with diverging sovereignty rules
- 6Readings from the other desks
- 6.1 The other desks’ editions of this subject
- 6.2 Three lenses
- 6.3 Standards, Academy and steward contributions
- 6.4 GCRI reading: the model card
- 6.5 Global Risks Forum reading: editorial essays
- 6.6 Global Risks Alliance reading: 2027 cloud readiness pack
- 6.7 Nexus Standards reading: standards and regulatory watch
- 6.8 Risk Academy reading: literature and evidence review, science and assessments
- 7The 2027 agenda
- 8Systems in depth
- AMethodology
- BData appendix
- CReferences and record
- ·Complete edition, for print
6.1The other desks’ editions of this subject
Federation: each desk writes its own edition for the subjects in its remit. Until a desk releases, its edition shows its frame and the reading this edition printed for it.
| Desk | Edition | State | Identifier |
|---|---|---|---|
| GCRI Systems Evidence | No edition of this subject at this desk in the 2026 Baseline cycle | Not in this cycle | |
| GRF Public Deliberation | Outside this desk’s remit | Not in remit | |
| GRA Capital Readiness | Outside this desk’s remit | Not in remit | |
| Standards Progress | No edition of this subject at this desk in the 2026 Baseline cycle | Not in this cycle | |
| Academy Capability | No edition of this subject at this desk in the 2026 Baseline cycle | Not in this cycle | |
| Index Measurement | Outside this desk’s remit | Not in remit |
6.2Three lenses
One edition, read by each steward. The lens of this site comes first.
GCRI · KEY T
Technical Truth
The evidence supports reading cloud and distributed computing as shared infrastructure with a measurable physical footprint. Electricity use is reported and rising, the market is concentrated, and large events have been traced to internal faults. Evidence is strongest for single events and dated rules, and weakest for dependence, water and edge.
ENE-001 · ENE-002 · INF-011 · SYS-012
GRF · KEY M
Public Meaning
For most people the cloud arrives as an app that stops working or a headline about energy and water. The baseline asks that public debate separate measured use from projections and company claims, and keep the dependence of public services in view.
ENE-003 · INF-011 · WAT-007
GRA · KEY F
Capital Meaning
Readiness implications only. Revenue is concentrated, switching charges end in 2027, and recovery from large events falls on customers as well as providers1016. These show where finance-readiness evidence will matter. Nothing here is advice, a rating or an approval.
FIN-008 · GOV-010
NEXUS
Synthesis
Cloud is well described by single events and dated rules and thinly measured as a system. The 2027 programme should map dependence of public services, put operator metrics on a common basis and test exit before the next large event.
SYS-012 · C-01 · C-03
6.3Standards, Academy and steward contributions
How the Nexus Standards drafts, the Risk Academy and the three stewards feed each quarterly edition for cloud. The standards are a preparatory working draft (2026) and are cited as drafts, never as adopted standards.
| Quarter | Edition | Question | Boundary |
|---|---|---|---|
| Q1 | State and Agenda | What matters this year, and what is the starting position? | observed baseline stays distinct from planned work |
| Q2 | Evidence and Build | What new evidence and capability exist? | a configured capability is not a validated result |
| Q3 | Stress Test and Readiness | What do scenarios and tests show? | simulated loss or performance is not observed impact |
| Q4 | Annual Synthesis and Renewal | What changed in the year, and what renews? | release follows review, not event publicity deadlines |
| Steward or body | Role | Contribution route |
|---|---|---|
| The Global Centre for Risk and Innovation (GCRI Canada) | Lead Institution and Consortium Secretariat; publisher of record; technical truth (key T) | science and practice communities · GCRI gateway |
| The Global Risks Forum (GRF) | leadership, dialogue and the Universe programme; public meaning (key M) | policy, Universe and national adoption · GRF gateway |
| The Global Risks Alliance (GRA) | finance, insurance and development readiness; capital meaning (key F) | finance and insurance · GRA gateway |
| Nexus Standards | preparatory drafts on vocabulary, hazards, indicators and methods | Standards site · working groups HAZ, IND, MTH, FIN, AI |
| Risk Academy | learning pathways tied to the agenda questions | Academy gateway · learning by review |
| Nexus Standards and Academy | technology chapter inputs: GCRI evidence, NXS standards, RA capability | technology editorial board |
Standards drafts used in this edition
- Risk vocabulary NRS-C1 (424 terms) for terms in the glossary
- Hazard atlas NHS-1 1.1.0 (905 hazards in 120 families) for risk objects
- Seven risk classes: global, catastrophic, existential, emerging, planetary, exponential, frontier-tech
Standards calendar to watch
- Founding calls from 20 October 2026; working groups meet from 5 November 2026
- Inaugural Global Standards Council session, 12 January 2027
- Quarterly reviews in March, June, September and December, aligned with each edition
6.4GCRI reading: the model card
GCRI’s reading of this edition is its model card: what the national model is, what it computes and where it stops. It is printed in full in Annex A, with the methods it belongs to. Annex A, methodology
6.5Global Risks Forum reading: editorial essays
Four signed essays by the Reports editorial team set out the positions this edition takes. They are interpretation, labelled as such; the evidence they draw on is in the findings register.
Cloud services run on facilities owned by a few companies and used by almost every sector. That makes them infrastructure in effect, and the evidence on dependence is the thinnest part of the picture.
EDITORIAL ESSAY · 01
Shared infrastructure, private operators
Operators report PUE and water use, and each picks its own baseline. A common basis would show whether growth is limited by grids, water or money.
EDITORIAL ESSAY · 02
Footprints need a common basis
The Data Act, DORA, the DMA reviews and the Cloud and AI Development Act proposal address different parts of one market. Their order and overlap will shape 2027.
EDITORIAL ESSAY · 03
Rules arrive in sequence
Edge computing is defined in specifications and papers, but sites, devices and energy use are not counted in the sources read here.
EDITORIAL ESSAY · 04
The edge is the blind spot
6.6Global Risks Alliance reading: 2027 cloud readiness pack
The registers that open the 2027 global cycle. At baseline each is initialised from this edition.
| Item | Register | State at baseline | First 2027 entry |
|---|---|---|---|
| E1 | Cloud risk state delta | baseline set by this edition | changes against the baseline |
| E2 | WEFH+B state delta | five global system readings set | indicator updates and freshness |
| E3 | Agenda and Portfolio movement | eight agenda items · 6 proposed objects | admission decisions |
| E4 | Federation delivery register | national chapters in preparation | national chapters |
| E5 | Consortium capability register | national consortia forming | first contributions |
| E6 | Leadership questions and challenges | none yet | first challenge log |
| E7 | Foundry technical state | national environments prepared | first federation cut |
| E8 | Publication candidates | twelve findings carried forward | PUBLISH · HOLD dispositions |
| E9 | Universe readiness | one candidate mission | admission and role spine |
| E10 | Correction register | none | first federation-wide cycle |
Publication dispositions
- Publish
- Hold
- Needs evidence
- Restricted
- Superseded
6.7Nexus Standards reading: standards and regulatory watch
Instruments and published guidance that shape the systems in this edition, by status on the retrieval date. The edition assesses no one’s compliance.
- IN FORCE
- PUBLISHED
- PROPOSAL
- PUBLISHED · VOLUNTARY
| Instrument | Body | Scope | Status | Relevance |
|---|---|---|---|---|
| NIST SP 800-145, 800-146 and 500-292252627 | NIST | US, used globally | PUBLISHED 2011 AND 2012 | cloud definition and architecture |
| ISO/IEC 22123-142 | ISO and IEC | global | PUBLISHED · VOLUNTARY | cloud vocabulary |
| ISO/IEC 30134-241 | ISO and IEC | global | PUBLISHED · VOLUNTARY | PUE definition |
| EU Data Act151637 | European Union | EU | IN FORCE · APPLIES FROM 2025 | switching and data access |
| DORA1738 | European Union | EU financial sector | IN FORCE · APPLIES FROM 2025 | ICT third-party oversight |
| Energy Efficiency Directive data centre reporting193536 | European Union | EU | IN FORCE | energy and water reporting |
| FedRAMP 20x24 | US GSA | US federal | PROGRAMME ACTIVE | cloud authorisation |
| ETSI MEC specifications30 | ETSI | Europe | PUBLISHED · VOLUNTARY | edge computing |
| Cloud and AI Development Act18 | European Commission | EU | PROPOSAL 2026 | capacity, permits, sovereignty |
| Green Data Centre Roadmap43 | Singapore IMDA | Singapore | PUBLISHED | data centre growth and efficiency |
Changed since 2024
6.8Risk Academy reading: literature and evidence review, science and assessments
The review behind this edition covers cloud assessments, peer-reviewed science and the institutional reports that bind its findings. Systematic reviews for each agenda item begin in 2027.
Review protocol
- Question
- What does the published evidence establish about cloud, edge and distributed computing as infrastructure and its couplings?
- Sources searched
- foundational papers and standards; regulators and institutions; operator reports; national laboratories and statistics offices
- Window
- releases available at evidence close, 30 September 2026
- Selection
- sources that bind or contextualise a finding in this edition
- Next step
- systematic reviews for agenda items 01 to 05 in 2027
| Reference | Type | Year | Role | Used for |
|---|---|---|---|---|
| Armbrust et al.28 | technical report | 2009 | framework | cloud economics and obstacles |
| NIST SP 800-14525 | NIST | 2011 | framework | definition |
| NIST SP 800-14626 | NIST | 2012 | context | synopsis and recommendations |
| NIST SP 500-29227 | NIST | 2011 | context | reference architecture |
| Barroso, Clidaras and Hölzle34 | book | 2018 | context | warehouse-scale computers |
| Masanet et al.31 | journal article | 2020 | context | energy estimates |
| Li et al.8 | preprint | 2023 | supports | water projection |
| Reference | Issuer | Year | Role | Used for |
|---|---|---|---|---|
| Satyanarayanan32 | journal article | 2017 | framework | edge computing |
| Shi et al.33 | journal article | 2016 | framework | edge vision |
| CNCF annual survey29 | foundation survey | 2024 | context | cloud native adoption |
| ETSI MEC30 | ETSI | 2025 | context | edge specifications |
| ISO/IEC 22123-142 | ISO and IEC | 2023 | framework | vocabulary |
| Reference | Issuer | Year | Role | Used for |
|---|---|---|---|---|
| EU Data Act pages1516 | European Commission | 2025 | supports | switching rules |
| DORA page17 | ESMA | 2025 | supports | oversight timing |
| CMA market investigation11 | UK CMA | 2025 | supports | competition review |
| DMA cloud investigations12 | European Commission | 2025 | supports | competition review |
| FedRAMP 20x24 | US GSA | 2026 | context | authorisation reform |
| Reference | Issuer | Year | Role | Used for |
|---|---|---|---|---|
| Energy and AI1 | IEA | 2025 | supports | global electricity |
| US data centre report23 | LBNL and DOE | 2024 | supports | US electricity |
| Metered electricity4 | Irish CSO | 2025 | supports | grid share |
| Environmental reports567 | Google · Microsoft · Amazon | 2025 | context | company-reported |
| Cloud market release10 | Synergy Research | 2026 | supports | market shares |
| Global Data Center Survey9 | Uptime Institute | 2025 | context | PUE and outages |
Where the evidence agrees
Notes
Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references
- 10Synergy Research Group (ed.), Q2 Cloud Market Passes $143 Billion; Highest Growth Rate in Eight Years (release of 30 July 2026; Amazon 28%, Microsoft 20%, Google 15%; quarterly revenue USD 143.4 billion; growth 43%; definition IaaS, PaaS and hosted private cloud; industry analyst). Synergy Research Group, Reno. Observation year 2026. Accessed 2026-11-03.back
- 16European Commission (ed.), Data Act explained (policy page; switching charges including data egress charges removed from 12 January 2027; transitional period 11 January 2024 to 12 January 2027; notice period not on the page). Directorate-General for Communications Networks, Content and Technology, Brussels. Observation year 2025. Accessed 2026-11-03.back
- 25NIST (ed.), The NIST Definition of Cloud Computing, NIST SP 800-145 (publication page; September 2011; five essential characteristics, three service models and four deployment models). National Institute of Standards and Technology, Gaithersburg. Observation year 2011. Accessed 2026-11-03.back
- 26NIST (ed.), Cloud Computing Synopsis and Recommendations, NIST SP 800-146 (publication page; May 2012). National Institute of Standards and Technology, Gaithersburg. Observation year 2012. Accessed 2026-11-03.back
- 27NIST (ed.), NIST Cloud Computing Reference Architecture, NIST SP 500-292 (publication page; 8 September 2011). National Institute of Standards and Technology, Gaithersburg. Observation year 2011. Accessed 2026-11-03.back
- 42UNVERIFIED, not opened: ISO and IEC (eds.), ISO/IEC 22123-1 Cloud computing, part 1, vocabulary, cited from memory. International Organization for Standardization, Geneva. Observation year 2023. Accessed 2026-11-03.back
- 41UNVERIFIED, not opened: ISO and IEC (eds.), ISO/IEC 30134-2 Information technology, data centres, key performance indicators, part 2, power usage effectiveness (PUE), cited from memory. International Organization for Standardization, Geneva. Observation year 2016. Accessed 2026-11-03.back
- 15European Commission (ed.), Data Act (policy page; applicable from 12 September 2025; entered into force in January 2024). Directorate-General for Communications Networks, Content and Technology, Brussels. Observation year 2025. Accessed 2026-11-03.back
- 37UNVERIFIED, not opened: Regulation (EU) 2023/2854 (Data Act), Official Journal of the European Union, 2023, cited from memory; the page returned no content, and the policy pages [15] [16] were read instead. Observation year 2023. Accessed 2026-11-03.back
- 17European Securities and Markets Authority (ed.), Digital Operational Resilience Act (page; applies from 17 January 2025; lists materials on critical ICT third-party provider designation; no designations on the page). ESMA, Paris. Observation year 2025. Accessed 2026-11-03.back
- 38UNVERIFIED, not opened: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Official Journal of the European Union, 2022, cited from memory; the ESMA page [17] was read instead. Observation year 2022. Accessed 2026-11-03.back
- 19European Commission (ed.), Energy Efficiency Directive (policy page; states a data centre energy efficiency package planned for the third quarter of 2026 and links to reporting of data centre energy consumption; no threshold or dates on the page). Directorate-General for Energy, Brussels. Observation year 2026. Accessed 2026-11-03.back
- 35UNVERIFIED, not opened: Directive (EU) 2023/1791 on energy efficiency, Article 12 on data centre reporting, Official Journal of the European Union, 2023, cited from memory; the page returned no content. Observation year 2023. Accessed 2026-11-03.back
- 36UNVERIFIED, not opened: Commission Delegated Regulation (EU) 2024/1364 on the first phase of the establishment of a common Union rating scheme for data centres, 2024, cited from memory; the page returned no content. Observation year 2024. Accessed 2026-11-03.back
- 24US General Services Administration (ed.), FedRAMP 20x (programme page; announced March 2025; phase 1 26 submissions; first pilot authorisations 6 March 2026; phase 3 wide-scale adoption active; new Rev5 submissions stop 11 June 2027, a future date that may change). FedRAMP, Washington. Observation year 2026. Accessed 2026-11-03.back
- 30ETSI (ed.), Multi-access Edge Computing (technology page; industry specification group; news item of 31 October 2025 on Phase 4 specifications and a white paper; no counts on the page). European Telecommunications Standards Institute, Sophia Antipolis. Observation year 2025. Accessed 2026-11-03.back
- 18Euronews (ed.), EU Cloud and AI Development Act gets mixed reception (news article of 22 June 2026; three pillars; aim to triple European data centre capacity in five to seven years; acceleration zones within six months; 12-month maximum permit procedure; four assurance levels; reactions; press report of the proposal, not the proposal text). Euronews, Lyon. Observation year 2026. Accessed 2026-11-03.back
- 43UNVERIFIED, not opened: Infocomm Media Development Authority (ed.), Green Data Centre Roadmap, Singapore, cited from memory; the page returned no content and no figure is used. IMDA, Singapore. Observation year 2024. Accessed 2026-11-03.back
- 12European Commission (ed.), Commission opens market investigations into cloud computing services under the Digital Markets Act (announcement of 18 November 2025; two investigations on whether AWS and Microsoft Azure should be designated and one on whether the DMA fits cloud). Directorate-General for Communications Networks, Content and Technology, Brussels. Observation year 2025. Accessed 2026-11-03.back
- 28Armbrust, M. et al., Above the Clouds: A Berkeley View of Cloud Computing, Technical Report UCB/EECS-2009-28, 10 February 2009 (report page and abstract). University of California, Berkeley. Observation year 2009. Accessed 2026-11-03.back
- 34UNVERIFIED, not opened: Barroso, L.A., Clidaras, J. and Hölzle, U., The Datacenter as a Computer: Designing Warehouse-Scale Machines, third edition, Morgan and Claypool, 2018, cited from memory. Observation year 2018. Accessed 2026-11-03.back
- 31UNVERIFIED, not opened: Masanet, E., Shehabi, A., Lei, N., Smith, S. and Koomey, J., Recalibrating global data centre energy-use estimates, Science 367, 984 to 986, 2020, cited from memory; the page returned an access error. Observation year 2020. Accessed 2026-11-03.back
- 8Li, P., Yang, J., Islam, M.A. and Ren, S., Making AI Less Thirsty: Uncovering and Addressing the Secret Water Footprint of AI Models, arXiv:2304.03271, v1 April 2023, v5 March 2025 (abstract page; projection of 4.2 to 6.6 billion cubic metres of water withdrawal in 2027; accepted by Communications of the ACM per the page). arXiv, Ithaca. Observation year 2023. Accessed 2026-11-03.back
- 32UNVERIFIED, not opened: Satyanarayanan, M., The emergence of edge computing, Computer 50(1), 30 to 39, 2017, cited from memory. Observation year 2017. Accessed 2026-11-03.back
- 33UNVERIFIED, not opened: Shi, W., Cao, J., Zhang, Q., Li, Y. and Xu, L., Edge computing: vision and challenges, IEEE Internet of Things Journal 3(5), 637 to 646, 2016, cited from memory. Observation year 2016. Accessed 2026-11-03.back
- 29Cloud Native Computing Foundation (ed.), CNCF Annual Survey 2024 (report page; tenth annual survey; 750 respondents in fall 2024; Kubernetes percentage not on the page). CNCF, San Francisco. Observation year 2024. Accessed 2026-11-03.back
- 11UK Competition and Markets Authority (ed.), Cloud services market investigation (case page; final decision published 31 July 2025; recommends prioritising strategic market status investigations of Microsoft and AWS; board decision expected in the first quarter of 2026; the decision documents were not opened). Competition and Markets Authority, London. Observation year 2025. Accessed 2026-11-03.back
- 1UNVERIFIED, not opened: IEA (ed.), Energy and AI (data centres about 415 TWh in 2024, about 1.5% of global electricity; about 945 TWh in the 2030 base case; about 1,200 TWh in 2035 with a range of 700 to 1,700), taken from search-result summaries; the report pages returned access errors. International Energy Agency, Paris. Observation year 2024. Accessed 2026-11-03.back
- 2Shehabi, A. et al., 2024 United States Data Center Energy Usage Report, Lawrence Berkeley National Laboratory, published 19 December 2024, DOI 10.71468/P1WC7Q (publication page; the page gives authors and a scenario range to 2028 but no figures; figures read in the DOE summary [3]). Lawrence Berkeley National Laboratory, Berkeley. Observation year 2023. Accessed 2026-11-03. doi:10.71468/P1WC7Qback
- 3US Department of Energy (ed.), DOE releases new report evaluating increase in electricity demand from data centres (20 December 2024; about 4.4% of US electricity in 2023; 6.7 to 12% projected for 2028; 58 TWh in 2014 and 176 TWh in 2023). US Department of Energy, Washington. Observation year 2023. Accessed 2026-11-03.back
- 4Central Statistics Office (ed.), Data Centres Metered Electricity Consumption 2024 (statistical release of 10 June 2025; 22% of metered electricity in 2024, 21% in 2023; the GWh table was not in the content read). Central Statistics Office, Cork. Observation year 2024. Accessed 2026-11-03.back
- 5Google (ed.), 2025 Environmental Report (PDF; fiscal year 2024; data centre electricity consumption up 27%, data centre energy emissions down 12%, fleet PUE 1.09 against a stated industry average of 1.56, water consumption up 28%; company-reported). Google, Mountain View. Observation year 2024. Accessed 2026-11-03.back
- 6Microsoft (ed.), 2025 Environmental Data Fact Sheet (PDF; fiscal year ended 30 June 2024; Table 6 electricity consumed within the organisation 29,829,540 MWh in FY24 and 23,567,502 in FY23; Table 9 water consumption 5,807 ML in FY24 and 7,844 in FY23 after a new estimation approach; company-reported, section 1 reviewed by an external firm). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
- 7Amazon (ed.), 2024 Amazon Sustainability Report (PDF; AWS global PUE 1.15 in 2024 against a stated public cloud industry average of 1.25 and 1.63 for on-premises data centres, citing IDC; AWS water use effectiveness 0.15 L per kWh in 2024; company-reported). Amazon, Seattle. Observation year 2024. Accessed 2026-11-03.back
- 9UNVERIFIED, not opened: Uptime Institute (ed.), Global Data Center Survey 2025 (average PUE 1.54; power the cause of 45% of outages), taken from search-result summaries; the survey page returned an access error. Uptime Institute, New York. Observation year 2025. Accessed 2026-11-03.back
- 20Amazon Web Services (ed.), Summary of the Amazon DynamoDB Service Disruption in the Northern Virginia (US-EAST-1) Region (post-event summary; 19 October 11:48 PM to 20 October 2:20 PM PDT; latent race condition in the DNS management system for the regional endpoint; services and times listed; operator report). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
- 21Google Cloud (ed.), Incident report for the Service Control outage of 12 June 2025 (status page; 10:51 to 18:18 PDT by the incident header; mini report gives different times; policy data with blank fields caused a null pointer crash in Service Control; operator report). Google, Mountain View. Observation year 2025. Accessed 2026-11-03.back
- 22Cloudflare (ed.), Cloudflare outage on November 18, 2025 (blog post; start 11:20 UTC; core traffic largely restored 14:30 UTC; full recovery 17:06 UTC; Bot Management feature file doubled in size and exceeded a limit of 200 features; not caused by a cyber attack, per the operator). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
