Data Centres: Who Bears The Loss When Critical Dependencies Fail?

Summary

Australia’s data centre pipeline is expanding rapidly as cloud, AI and digital infrastructure demand accelerates. AEMO has identified data centres as a material growth driver for electricity demand, while federal and state governments are increasingly focused on the energy, water, land use, security and community impacts of large-scale facilities. This makes data centres more than a property or technology issue: they are now a board-level governance, continuous disclosure and insurance risk issue.

Aggregation and Accumulation takeaways

• Insurers should assess data centre risk as a technology aggregation issue, not only as a property or cyber exposure.
• Aggregation risk may arise where multiple insureds depend on the same cloud, telecommunications, power or data centre infrastructure.
• One outage may produce related losses across property, cyber, business interruption, professional indemnity, D&O and financial lines.
• Accumulation analysis should consider exposure to hyperscalers and geographic concentration in data centre corridors, including Western Sydney and Melbourne.
• Stress testing, scenario planning and reinsurance programmes should be reviewed against cloud service provider failure, grid disruption and other common dependency events.

Why data centres are now a governance issue

AEMO’s forecasts and connection pipeline point to a significant increase in data centre electricity demand, and is subsequently attracting policy attention. Governments are considering how facilities should connect to the grid, support new generation and firming capacity, manage flexible demand and address broader concerns about energy, water, emissions, labour skills and shortages and community impacts.

That attention matters because data centres sit at the intersection of digital transformation, critical infrastructure and the energy transition. Their risk profile is not confined to construction, property damage or cyber incidents. It includes reliable and affordable electricity, timely network connections, cooling and water availability, telecommunications security, third-party technology services and contractual uptime obligations.

Implications for boards of data centre operators

For boards of data centre operators, the question is whether governance frameworks are keeping pace with these dependencies. Boards should ensure management regularly reviews grid reliability, electricity price volatility, delayed network connections, renewable transition risk and energy shortages during extreme weather. They should also test whether insurance arrangements respond to technology-driven interruption events, rather than only traditional property damage or equipment failure.

Operational resilience is likely to attract regulatory scrutiny. Boards should be able to evidence appropriate policies and procedures for business continuity, disaster recovery and critical service availability. Cyber governance should receive the same discipline: cyber investment, incident response, third-party risk and cloud concentration may all be examined after an outage or incident.

Energy and sustainability also require board attention. Data centres are large energy users, significant water consumers and land-intensive facilities often located near communities. Boards should consider energy sourcing, water consumption, emissions disclosure, community engagement and greenwashing risk. Disclosure may also arise around capacity constraints, construction delays, security incidents and ESG commitments.

Implications for insurance boards: technology aggregation risk

For insurance company boards, the message is not that data centres are simply a new asset class. The real risk is that they create interconnected infrastructure dependency capable of producing related losses across multiple lines simultaneously. Aggregation risk is moving beyond flood, fire and cyclone to technology aggregation involving shared cloud, telecommunications, power and data centre infrastructure.

Boards ought to assess potential exposure. How much exposure exists to Microsoft Azure, AWS, Google Cloud and other hyperscalers? How much is concentrated in Western Sydney, Melbourne and other data centre corridors? Could one event trigger losses across cyber, business interruption, professional indemnity, D&O, property and financial lines? Have cloud service provider failures been stress-tested, and does the reinsurance programme respond?

Data centre resilience is a governance, disclosure and aggregation issue. When critical digital infrastructure fails, losses may not remain within one asset, one insured or one class of business. They may move simultaneously through property, cyber, financial lines, professional indemnity, D&O and business interruption portfolios, testing whether boards understood the dependency before the event occurred.

Data centres sit at the heart of the modern digital economy, powering everything from cloud services and AI to financial systems and critical infrastructure. As part of our new data centre article series, we will explore the legal, risk and insurance issues shaping the sector.