sigma insights 07/2026: Insuring AI: data centre value accumulation risks

The data centres powering today's AI infrastructure are growing in scale and complexity, challenging the insurance industry's ability to provide the cover demanded by financing. Construction costs for a single location can reach USD 20bn and increase further once technology is installed. This accumulation of value heightens the impact of physical risks, including natural catastrophes. Our modelling finds that more than a quarter of the US data centre capacity may be in locations experiencing ≥3 large-hail days per year. Over 40% of capacity could also sit in significant-to-very-high tornado-day zones. Water damage from cooling failures, power continuity vulnerabilities, and new fire ignition sources are additional emerging contributors to data centre risk.

Data centres are critical AI infrastructure, housing the physical technology behind the sector's rapid growth. Capital spending for the “big five” cloud service providers, also known as hyperscalers, ¹ is now widely forecast to exceed USD 600 billion in 2026, a 36% annual increase. Roughly 75%, or USD 450 billion, of that spend is directly tied to physical AI infrastructure housed in large data centres, such as servers or graphics processing units (GPUs). ² The data centre sector worldwide is forecast to expand at a 14% CAGR through 2030, with the US growing the fastest, according to JLL. ³ US construction spending on data centres has far outpaced growth in total non-residential construction (see Figure 1).⁴

Figure 1: US construction spending, monthly, 2014-2025

Demand for data centre insurance has grown accordingly. Global insurance premiums tied to data centres are expected to rise to USD 24.2 billion by 2030, up from USD 10.6 billion. ⁶ Re/insuring data centres at this scale is complex, both during construction but especially during the operational phase, as we explore in this report. While construction risk is primarily about creating the asset (challenges include physical perils, subcontractor interdependencies, and delay), operational risk is about keeping a high-value, multi-tenant critical system continuously available. Once GPUs, tenants, and services are in place, both the value and operational complexity increase, making business interruption (BI), loss of rent, and service interruption critical. We also see emerging exposure drivers in rising insured value on catastrophe-exposed locations.

The data centres being built to support AI workloads today are larger both in size and in engineering complexity than the smaller traditional constructions of the past. Those were familiar risks for insurers, whereas the new data centres are built as campuses with dense systems and tight operational interdependencies that compound risks in single sites. These capital-intensive projects require advanced cooling systems, high-voltage power and back-up infrastructure, sophisticated hardware and robust security software. ⁷ The full cost of construction can exceed USD 20 billion, ⁸ which can double after GPUs and other technology is installed.

The need for insurance cover for these large projects is driven by the multi-billion financing need. This creates demand for very high insured limits for a single data centre location. Financing institutions demand limits to cover the full cost of construction, even as maximum probable loss scenarios are much lower. ⁹ The re/insurance industry can only support a fraction of this limit at competitive rates for traditional construction risk policies.

Surety bonds on major builds, ^{10, 11} and subcontractor default insurance, are becoming increasingly important with this uptick in engineering complexity. Each site relies on numerous specialised subcontractors and defaults can cause delays and broader project disruptions.

In the US, the extensive land and renewable energy requirements of new data centres are increasingly driving their development in more natural catastrophe-exposed locations. This is an increasing risk, given sigma data shows insured losses from natural catastrophes are rising by 5-7% annually on average in real terms over the long term. ¹² These include areas at risk of severe convective storm (SCS), ¹³ which particularly impact the US and Europe and caused global losses of USD 51 billion in 2025.

The issue is compounded when developers build large clusters of data centres together, as is occurring in locations such as Abilene, Texas, and in Virginia. Placing multiple sites within a ~20-mile radius means a regional natural catastrophe event can affect a high density of insured value at once.

A substantial portion of US data centre capacity may also be located in places with elevated severe hail potential. Using Swiss Re’s CatNet® tool for assessing catastrophic risks, we analysed data on planned and existing data centre capacity (available from the US Department of Energy, by county) to find that over a quarter of US data centre capacity could be in locations experiencing ≥3 large-hail days per year, averaged over a historical 64-year period. ¹⁴ The concentration is similar when modelled under current climatic conditions. This is particularly important, as data centre construction makes them susceptible to water damage. Key factors include large footprints, low-sloped roofs, numerous surface penetrations for building services infrastructure, and the high sensitivity of equipment to humidity. The campuses also include critical outdoor equipment, which can be directly exposed to hail and debris impacts.

Figure 2: US data centre capacity (GW) by large-hail days per year

Figure 3: US data centre capacity (GW) by ≥EF1 tornado days per year

In the case of tornadoes, we estimate that ~40% of data centre capacity in the US could sit in significant-to-very-high tornado-day zones (≥ 3 days in a year with tornadoes ≥ (E)F1, or Enhanced Fujita 1), meaning the occurrence of an EF1+ is not improbable during a policy term.

A tornado’s swath and debris field can readily traverse separated structures in the same campus, damaging multiple buildings simultaneously. A single event can lead to a loss higher than would be expected under a man-made single-location maximum probable loss assumption, where typically only one building or part of it is damaged. In a worst-case track scenario, a tropical cyclone passing through a dense market such as Texas could drive loss accumulation, with wind and flooding affecting many campuses and shared infrastructure at the same time. 

Fire has been a primary driver of loss severity in traditional data centres. While it accounted for only 10.9% of loss events, it was responsible for 42.3% of loss costs, according to FM’s 15-year study. In new builds, we see a key operational change in the integration of lithium-ion battery backup units (BBUs) into server racks. These BBUs create an ignition source “that did not previously exist” within data processing equipment rooms, which can raise the intensity and frequency of fire losses. ¹⁷

This changing trend can be seen in FM’s loss prevention evolving guidance, which now recommends increased fire and equipment protection for new data centres (see Table 1). The 2026 full revision increased the recommended fire-resistance rating for walls from one hour to two hours to limit conflagration, as well as introduced more stringent sprinkler expectations. Beyond downtime, uncontrolled thermal events risk employee safety and structural damage. Recent examples include a government-wide shutdown in Korea and a Singapore incident involving an explosion. ¹⁸

Table 1: Evolution in features of data centres and accompanying safety requirements (selected)

The 2026 loss prevention guidance now also includes a comprehensive liquid-cooling section. Liquid-related losses represented nearly 24% of total data centre loss costs, according to a 15-year FM review ¹⁹. Fire-related sprinkler leakage accounted for 9.3% of loss costs, while another 10% came from escaped liquid damage introduced by new cooling systems. Modern high-performance GPUs generate significantly more heat than traditional servers due to their high power consumption. As a response, more effective direct-to-chip liquid cooling replaced traditional air cooling. The increased scale and complexity of cooling networks create risks of water damage from improper installation or maintenance, if contractors lack specialised data-centre experience with large-diameter pipes and networks.

Water stress and local water-related policy actions can also directly limit operations. If municipalities reduce water supply due to droughts or capacity issues, the site may have to shift cooling modes or temporarily shut down to prevent equipment damage.

The largest driver of BI risk for data centres is power supply, accounting for 45% of outages, according to the Uptime Institute Global Data Center Survey. ²⁰ Power-hungry GPUs and high-efficiency cooling significantly increase power requirements.  

Traditional servers needed 5-15 kilowatts per rack, but AI servers can require more than 100 kilowatts per rack. ²¹ There are even discussions of restarting decommissioned conventional nuclear plants to meet data-centre power demand. ^{22, 23} Where grid connection cannot be secured fast enough, developers are now building power stations on site, which presents new hazards. ²⁴ Reports suggest that roughly 30% of planned data centre capacity in the US could have power generation on-site.²⁵  Some hyperscalers now deploy dedicated behind-the-meter plants to avoid grid congestion. Battery energy storage systems (BESS) are also being integrated into data centres, but bring significant fire, explosion, and toxic gas hazards. Key considerations include the operation of on-site power generation and storage, and whether a credible third party is involved, given that power generation has not been a core activity for data centre developers.

Cyber risk in data centres varies by operating model. Facilities hosting customer information are attractive targets and can present high exposure to cyber-attacks. This was demonstrated by recent incidents that caused service disruption. ²⁶ While hyperscalers are often perceived as lower risk due to their complete control over infrastructure, growing internet connectivity of operational technologies such as power, cooling, security, and monitoring systems is creating new cyber vulnerabilities across modern data centres. ²⁷

Accumulation transparency is key, as insured portfolios can unintentionally build concentration. Large data centres are sometimes presented to risk carriers in separate insurance programs (eg, separately for building, equipment, power plants), making capacity accumulation difficult to track for insurers. This could allow a single loss event to impact several insurance programs. Large data centres also concentrate many tenants and insured interests within a single physical footprint, often behind common critical systems such as power, cooling and fire protection. This increases the likelihood of multiple concurrent claims arising from one occurrence.

The data centre industry is evolving from a relatively low-hazard electronic equipment occupancy to complex, high-energy-density facilities requiring sophisticated, multi-layered protection strategies. ²⁸ In some cases, new infrastructure is rolled out before researchers have had the chance to fully assess associated hazards, and before prescriptive regulations are available to mitigate them. ²⁹

Insurers have deep experience with traditional data centres, but only a few large, next-generation facilities are fully operational yet, making empirical loss experience limited. In this environment, underwriting success depends not only on capacity, but on specialised technical assessment and disciplined accumulation management.