Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Risks and capability

Four cloud risk objects open the portfolio. Order carries no rank. Each is read across driver, exposure, vulnerability, capacity, cascade and consequence.

8 min read0 figures1 table28 notesNR-XTECH-CLOUD-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1Cloud is shared infrastructure with a physical footprint
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
    1. 4.1 Risk objects
    2. 4.2 Capability ladder
  7. 5Shared control-plane fault with diverging sovereignty rules
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

4.1Risk objects

Each risk is read across the chain from hazard to consequence, with its status and evidence-quality level.

  1. InferredEQL 4RSK-XT08-INF-001

    Shared control-plane failure

    Driver
    internal faults at large providers202122
    Exposure
    services that depend on one provider or region
    Vulnerability
    hidden dependencies; single-region designs
    Capacity
    operator post-event reports; DORA oversight1720
    Cascade
    INF → DAT → FIN, HLT
    Horizon
    1 to 5 years

  2. InferredEQL 3RSK-XT08-ENE-002

    Local grid constraint

    Driver
    rising data centre load124
    Exposure
    regions with high data centre share
    Vulnerability
    slow grid connection; local opposition
    Capacity
    permitting proposals; efficiency reporting1819
    Cascade
    ENE → INF
    Horizon
    1 to 5 years

  3. Expert inputEQL 2RSK-XT08-WAT-003

    Water stress at cooling sites

    Driver
    cooling demand and warm climates68
    Exposure
    facilities in water-stressed areas
    Vulnerability
    non-comparable water metrics
    Capacity
    operator replenishment and air-cooling choices56
    Cascade
    WAT → ENE → INF
    Horizon
    1 to 10 years

  4. InferredEQL 3RSK-XT08-GOV-004

    Fragmented sovereignty and concentration

    Driver
    competition reviews and sovereignty rules111218
    Exposure
    cross-border workloads; public procurement
    Vulnerability
    diverging rules; lock-in before switching charges end16
    Capacity
    Data Act switching rights; sovereign offerings1623
    Cascade
    GOV → INF, FIN
    Horizon
    1 to 5 years

4.2Capability ladder

Existence is not readiness. Each of the fifteen capability functions is placed on the ladder by the strongest public evidence for cloud at the global level.

Table 4.1Capabilities on the ladder of evidence: listed, exists, demonstrated, tested
FunctionRungLevelStrongest public evidence at baseline
Prevention and mitigationEXISTSoperator efficiency programmes and EU reporting rules5735
Monitoring and observationLISTEDoperators publish reports; no common cross-provider record2021
Early warningLISTEDno consolidated early warning of provider faults
Preparedness and planningEXISTSDORA and FedRAMP programmes1724
Redundancy and reservesLISTEDmulti-region designs exist; 2025 events show shared dependencies2021
ResponseEXISTSoperators restored services within hours in three reported events202122
Continuity of critical servicesLISTEDno consolidated evidence of tested failover or exit16
RecoveryEXISTSfull recovery was reported in each of the three events202122
AdaptationLISTEDpost-event changes reported by operators; not reviewed here40
Social protectionLISTEDnot applicable at baseline
Finance and insuranceLISTEDnot reviewed
Institutional coordinationEXISTScompetition authorities and EU institutions111217
Technical infrastructureEXISTSlarge installed base and standards2102530
WorkforceLISTEDno figure bound
Research capacityADEQUATEstrong literature on cloud and edge2831323334
A capability listed in policy is not a tested one; each rung is the strongest public evidence at baseline.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 20Amazon Web Services (ed.), Summary of the Amazon DynamoDB Service Disruption in the Northern Virginia (US-EAST-1) Region (post-event summary; 19 October 11:48 PM to 20 October 2:20 PM PDT; latent race condition in the DNS management system for the regional endpoint; services and times listed; operator report). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
  2. 21Google Cloud (ed.), Incident report for the Service Control outage of 12 June 2025 (status page; 10:51 to 18:18 PDT by the incident header; mini report gives different times; policy data with blank fields caused a null pointer crash in Service Control; operator report). Google, Mountain View. Observation year 2025. Accessed 2026-11-03.back
  3. 22Cloudflare (ed.), Cloudflare outage on November 18, 2025 (blog post; start 11:20 UTC; core traffic largely restored 14:30 UTC; full recovery 17:06 UTC; Bot Management feature file doubled in size and exceeded a limit of 200 features; not caused by a cyber attack, per the operator). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
  4. 17European Securities and Markets Authority (ed.), Digital Operational Resilience Act (page; applies from 17 January 2025; lists materials on critical ICT third-party provider designation; no designations on the page). ESMA, Paris. Observation year 2025. Accessed 2026-11-03.back
  5. 1UNVERIFIED, not opened: IEA (ed.), Energy and AI (data centres about 415 TWh in 2024, about 1.5% of global electricity; about 945 TWh in the 2030 base case; about 1,200 TWh in 2035 with a range of 700 to 1,700), taken from search-result summaries; the report pages returned access errors. International Energy Agency, Paris. Observation year 2024. Accessed 2026-11-03.back
  6. 2Shehabi, A. et al., 2024 United States Data Center Energy Usage Report, Lawrence Berkeley National Laboratory, published 19 December 2024, DOI 10.71468/P1WC7Q (publication page; the page gives authors and a scenario range to 2028 but no figures; figures read in the DOE summary [3]). Lawrence Berkeley National Laboratory, Berkeley. Observation year 2023. Accessed 2026-11-03. doi:10.71468/P1WC7Qback
  7. 4Central Statistics Office (ed.), Data Centres Metered Electricity Consumption 2024 (statistical release of 10 June 2025; 22% of metered electricity in 2024, 21% in 2023; the GWh table was not in the content read). Central Statistics Office, Cork. Observation year 2024. Accessed 2026-11-03.back
  8. 18Euronews (ed.), EU Cloud and AI Development Act gets mixed reception (news article of 22 June 2026; three pillars; aim to triple European data centre capacity in five to seven years; acceleration zones within six months; 12-month maximum permit procedure; four assurance levels; reactions; press report of the proposal, not the proposal text). Euronews, Lyon. Observation year 2026. Accessed 2026-11-03.back
  9. 19European Commission (ed.), Energy Efficiency Directive (policy page; states a data centre energy efficiency package planned for the third quarter of 2026 and links to reporting of data centre energy consumption; no threshold or dates on the page). Directorate-General for Energy, Brussels. Observation year 2026. Accessed 2026-11-03.back
  10. 6Microsoft (ed.), 2025 Environmental Data Fact Sheet (PDF; fiscal year ended 30 June 2024; Table 6 electricity consumed within the organisation 29,829,540 MWh in FY24 and 23,567,502 in FY23; Table 9 water consumption 5,807 ML in FY24 and 7,844 in FY23 after a new estimation approach; company-reported, section 1 reviewed by an external firm). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
  11. 8Li, P., Yang, J., Islam, M.A. and Ren, S., Making AI Less Thirsty: Uncovering and Addressing the Secret Water Footprint of AI Models, arXiv:2304.03271, v1 April 2023, v5 March 2025 (abstract page; projection of 4.2 to 6.6 billion cubic metres of water withdrawal in 2027; accepted by Communications of the ACM per the page). arXiv, Ithaca. Observation year 2023. Accessed 2026-11-03.back
  12. 5Google (ed.), 2025 Environmental Report (PDF; fiscal year 2024; data centre electricity consumption up 27%, data centre energy emissions down 12%, fleet PUE 1.09 against a stated industry average of 1.56, water consumption up 28%; company-reported). Google, Mountain View. Observation year 2024. Accessed 2026-11-03.back
  13. 11UK Competition and Markets Authority (ed.), Cloud services market investigation (case page; final decision published 31 July 2025; recommends prioritising strategic market status investigations of Microsoft and AWS; board decision expected in the first quarter of 2026; the decision documents were not opened). Competition and Markets Authority, London. Observation year 2025. Accessed 2026-11-03.back
  14. 12European Commission (ed.), Commission opens market investigations into cloud computing services under the Digital Markets Act (announcement of 18 November 2025; two investigations on whether AWS and Microsoft Azure should be designated and one on whether the DMA fits cloud). Directorate-General for Communications Networks, Content and Technology, Brussels. Observation year 2025. Accessed 2026-11-03.back
  15. 16European Commission (ed.), Data Act explained (policy page; switching charges including data egress charges removed from 12 January 2027; transitional period 11 January 2024 to 12 January 2027; notice period not on the page). Directorate-General for Communications Networks, Content and Technology, Brussels. Observation year 2025. Accessed 2026-11-03.back
  16. 23Amazon Web Services (ed.), Opening the AWS European Sovereign Cloud (blog announcement of 14 January 2026; Brandenburg region; investment of EUR 7.8 billion stated; vendor announcement, weak evidence). Amazon Web Services, Seattle. Observation year 2026. Accessed 2026-11-03.back
  17. 7Amazon (ed.), 2024 Amazon Sustainability Report (PDF; AWS global PUE 1.15 in 2024 against a stated public cloud industry average of 1.25 and 1.63 for on-premises data centres, citing IDC; AWS water use effectiveness 0.15 L per kWh in 2024; company-reported). Amazon, Seattle. Observation year 2024. Accessed 2026-11-03.back
  18. 35UNVERIFIED, not opened: Directive (EU) 2023/1791 on energy efficiency, Article 12 on data centre reporting, Official Journal of the European Union, 2023, cited from memory; the page returned no content. Observation year 2023. Accessed 2026-11-03.back
  19. 24US General Services Administration (ed.), FedRAMP 20x (programme page; announced March 2025; phase 1 26 submissions; first pilot authorisations 6 March 2026; phase 3 wide-scale adoption active; new Rev5 submissions stop 11 June 2027, a future date that may change). FedRAMP, Washington. Observation year 2026. Accessed 2026-11-03.back
  20. 40UNVERIFIED, not opened: Microsoft (ed.), Azure Front Door incident reports of October 2025, cited from memory; the page returned an error and no figure is used. Microsoft, Redmond. Observation year 2025. Accessed 2026-11-03.back
  21. 10Synergy Research Group (ed.), Q2 Cloud Market Passes $143 Billion; Highest Growth Rate in Eight Years (release of 30 July 2026; Amazon 28%, Microsoft 20%, Google 15%; quarterly revenue USD 143.4 billion; growth 43%; definition IaaS, PaaS and hosted private cloud; industry analyst). Synergy Research Group, Reno. Observation year 2026. Accessed 2026-11-03.back
  22. 25NIST (ed.), The NIST Definition of Cloud Computing, NIST SP 800-145 (publication page; September 2011; five essential characteristics, three service models and four deployment models). National Institute of Standards and Technology, Gaithersburg. Observation year 2011. Accessed 2026-11-03.back
  23. 30ETSI (ed.), Multi-access Edge Computing (technology page; industry specification group; news item of 31 October 2025 on Phase 4 specifications and a white paper; no counts on the page). European Telecommunications Standards Institute, Sophia Antipolis. Observation year 2025. Accessed 2026-11-03.back
  24. 28Armbrust, M. et al., Above the Clouds: A Berkeley View of Cloud Computing, Technical Report UCB/EECS-2009-28, 10 February 2009 (report page and abstract). University of California, Berkeley. Observation year 2009. Accessed 2026-11-03.back
  25. 31UNVERIFIED, not opened: Masanet, E., Shehabi, A., Lei, N., Smith, S. and Koomey, J., Recalibrating global data centre energy-use estimates, Science 367, 984 to 986, 2020, cited from memory; the page returned an access error. Observation year 2020. Accessed 2026-11-03.back
  26. 32UNVERIFIED, not opened: Satyanarayanan, M., The emergence of edge computing, Computer 50(1), 30 to 39, 2017, cited from memory. Observation year 2017. Accessed 2026-11-03.back
  27. 33UNVERIFIED, not opened: Shi, W., Cao, J., Zhang, Q., Li, Y. and Xu, L., Edge computing: vision and challenges, IEEE Internet of Things Journal 3(5), 637 to 646, 2016, cited from memory. Observation year 2016. Accessed 2026-11-03.back
  28. 34UNVERIFIED, not opened: Barroso, L.A., Clidaras, J. and Hölzle, U., The Datacenter as a Computer: Designing Warehouse-Scale Machines, third edition, Morgan and Claypool, 2018, cited from memory. Observation year 2018. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 4: Risks and capability. In Exponential Technology Report 2026: Cloud, Edge and Distributed Computing (Baseline Edition 2026, Report No. NR-XTECH-CLOUD-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Cloud, Edge and Distributed Computing.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskExponential Technology

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices