Cloud regions are arriving in the Gulf ahead of the migration

Every major hyperscaler now has committed capacity in the Gulf. AWS has a Saudi region on track for December backed by more than $5.3bn of planned infrastructure investment. Microsoft has confirmed a Saudi Arabia East region. Oracle, Google Cloud and others have their own commitments across Saudi Arabia and the UAE. The build-out is running ahead of the enterprise migration that will fill it, and the reason is regulatory rather than commercial. Saudi Arabia's Personal Data Protection Law is fully enforced with penalties up to SAR 5m per breach. The UAE requires full PDPL compliance by 1 January 2027. Egypt's regime becomes fully enforceable in October 2026. Layer on sector rules — central bank requirements for financial data, health authority rules for patient records, and national classification of what may leave the country — and a large share of regulated workloads cannot sit in Frankfurt or Ireland. For a hyperscaler, the question stops being whether Gulf demand justifies a region on its own economics. It becomes whether it can serve regulated customers at all without one. That is a different and much more urgent calculation. What a region does not solve is migration capacity. Local infrastructure removes a legal obstacle; it does not by itself move a workload. Moving a bank's core systems or a ministry's records into cloud is a multi-year programme requiring architects, security engineers and integration specialists who understand both the legacy estate and the target platform. Those people are scarce in every market, and Gulf demand for them is rising faster than almost anywhere. The pattern that follows is a familiar one in any market opening new capacity: infrastructure available first, migration on a longer schedule, and utilisation climbing over several years rather than in the first one. Systems integrators are the immediate beneficiaries. A market with more available capacity than in-house migration capability is a market for implementation services, and the regional integrators positioned for that work are among the quieter beneficiaries of the entire AI build-out. The other beneficiary is any company that needed local residency and could not previously get it. Regulated fintechs, health platforms and government suppliers can now build things that were legally impossible eighteen months ago. That is a real unlock, and it is a different story from the one the capital figures tell.