(Re)in Summary
- Asia-Pacific’s data centre boom pushed the regional pipeline to a record 19.4 gigawatts in 2025, creating opportunities for insurers but also a host of risks.
- Operators often underestimate business interruption, which can cost US$10m-20m a day at large hyperscale sites in the US, says AXA XL’s Guillaume Parard.
- Property policies need physical damage to trigger business interruption cover, so software failures may not be covered.
- Concentration risk is rising, with 78.6% of Malaysia’s operational IT capacity in Johor. In response, AXA XL has built its own accumulation methods for data centres.
As data centre development accelerates across APAC, insurers are looking beyond physical infrastructure to the increasingly interconnected risks that could bring operations to a halt.
“Leading operators generally understand traditional physical risks well. What can still be underestimated are business interruption, incidents without physical damage and the link between cyber and physical systems,” says Guillaume Parard, AXA XL’s Head of Property & Casualty, Asia.
These exposures can compound the costs of a physical incident, with business interruption potentially running to US$10m or US$20m a day for large hyperscale data centres, Parard says, citing the US market.
Even more concerning, many of the questions around non-physical risks remain extremely difficult to quantify and have yet to be fully addressed.
APAC’s data centre boom
Asia-Pacific remains one of the world’s most dynamic markets for data centre development. This is creating significant opportunities for insurers – but plenty of dangers as well.
“Data centres have moved from the back office to the boardroom. They are now critical to revenue, operations and customer experience, with rapid digitisation and AI adoption accelerating that shift across Asia,” says Parard.
Research from Cushman & Wakefield suggests the region’s development pipeline reached a record 19.4 gigawatts in 2025, while CBRE Research says direct investment in the region’s data centres reached US$11.6bn.
As projects grow in scale and complexity, operators need reliable insurance capacity and technical support throughout the lifecycle of a data centre, from construction and commissioning through to operation.
“What can still be underestimated are business interruption, incidents without physical damage and the link between cyber and physical systems.”
Guillaume Parard
Head of P&C, Asia at AXA XL
For insurers, that means having accurate exposure data to assess risk and deploy capacity, while structuring programmes that reflect the scale of hyperscale campuses. It also requires a more joined-up approach to underwriting – bringing construction, power resilience, cyber, catastrophe and recovery risks into a single assessment.
APAC is not a single market, however, and the next wave of development is likely to be shaped by local considerations such as access to power and land. These factors are already influencing where new capacity is being developed.
While established data centres in places such as Singapore, Japan and major Chinese cities will certainly remain important, future growth is expected to come from India and Southeast Asian markets.
“Asia’s diversity means assessing data centre risks locally within a consistent regional framework,” says Parard. “Power quality, grid access, permitting, water availability, climate hazards and infrastructure maturity vary widely.”
“The focus must shift from protecting the building to keeping digital services running.”
Guillaume Parard
Head of P&C, Asia at AXA XL
Keeping the lights on
Data centres can face disruption from multiple sources, from constraints on power supply and failures in on-site generation and battery systems to breakdowns in shared infrastructure. Regulatory changes, water availability, cooling resilience and the reliability of surrounding infrastructure can also affect the continuity of operations.
Cybersecurity adds another layer of complexity, encompassing not only the protection of data but also the operational technology that controls critical systems such as power and cooling.
“The focus must shift from protecting the building to keeping digital services running,” says Parard. “Construction, energy, cyber and business interruption risks belong in one resilience plan.”
The energy transition is also becoming an increasingly important part of this assessment.
The International Energy Agency expects global data centre electricity demand to more than double by 2030, with nearly half of this increase provided by renewables.
As a result, data centre operators are taking greater control of their energy supply, reducing their reliance on the grid but adding new layers of operational risk.
“A campus with its own generation, storage, substations and data halls may rely less on the grid, but one fire, control fault, fuel interruption or commissioning delay can affect the whole facility,” says Parard. “Insurers therefore need to assess the data halls and power systems as one connected risk.”
Unanswered questions
The scale and criticality of data centres mean any disruption can carry significant costs.
“For insurers, this turns a traditional property risk into a mix of construction, operational, energy, cyber and business interruption exposures,” says Parard. “A minor cooling, software or power-control fault can quickly disrupt several organisations. Physical damage may be limited, but downtime and reputational costs can be substantial. The priority is keeping services running, not simply protecting assets.”
Yet there remain a number of unanswered questions.
Traditional property policies covering data centres generally provide business interruption cover when there is physical damage to insured property, whether caused by a catastrophe, fire or equipment breakdown. But a software-related malfunction may not meet that trigger.
This issue is not entirely new to insurers. Many insurance policies for traditional material damage do not automatically cover software-related failures. What makes data centres different, though, is the scale of the potential consequences. A data centre represents a huge concentration of IT infrastructure and value, meaning that a malfunction that might result in a relatively contained loss elsewhere could cause significant business interruption at a data centre.
“That’s why we’re having those conversations at the moment,” Parard says. “For a data centre, just saying it’s not insured is not satisfactory enough for many stakeholders.”
Some might suggest broadening the definition of material damage to encompass more triggers. But that would create a much wider range of potential scenarios for insurers, many of which may not yet be fully understood, so couldn’t be appropriately priced and managed.
This would be opening a “Pandora’s Box” of unexpected claims scenarios with unforeseen consequences, says Parard, and is therefore something that needs to be carefully thought through, as the risk landscape continues to evolve.
“Capacity should reflect risk quality and concentration, not headline values alone.”
Guillaume Parard
Head of P&C, Asia at AXA XL
The concentration challenge
The geographic shift in development also creates another challenge for insurers: concentration risk.
As developers gravitate towards locations with sufficient power, land and connectivity, multiple insured data centres can become exposed to the same infrastructure dependencies and regional catastrophe risks. This increases the potential for correlated losses, where a single event can affect several insured facilities at once.
This concentration is already evident in Malaysia, where the Malaysian Investment Development Authority reports that 78.6% of the country’s operational IT capacity is located in Johor.
For insurers, this increases exposure to shared power, infrastructure and catastrophe risks. A disruption that might once have affected a single facility could, as development becomes more concentrated, have implications across an entire local data centre ecosystem.
This has prompted AXA XL to develop bespoke accumulation methodologies for data centres because traditional approaches do not capture the concentration and interconnectedness of these risks in sufficient detail. The insurer is also fine-tuning its pricing and building its understanding of potential loss scenarios, some based on modelling and others on emerging experience from actual incidents.
These assessments ultimately feed into decisions about how much capacity insurers are willing to deploy and how that capacity is structured. Large projects often rely on layered insurance programmes, with different insurers providing cover at different levels of loss, while reinsurance helps insurers manage wider accumulation across their portfolios.
“Capacity should reflect risk quality and concentration, not headline values alone,” says Parard.
New solutions
Many of the risks data centres are exposed to are familiar, but their scale and interconnected nature are changing.
Traditional property, business interruption, construction all risks and delay-in-start-up insurance remain essential, but insurers are increasingly being asked to adapt these products to address the growing complexity of data centre operations.
For instance, AXA XL is seeing a rise in demand for more precise business interruption cover for reduced operations caused by power restrictions, underperforming on-site power and shared-infrastructure failures without physical damage.
Clients are also increasingly asking for lifecycle programmes, which follow projects from design and construction all the way through to operation, and tailored structures for portfolios spanning several markets.
“AI will continue to increase density and technical complexity,” says Parard. “For insurers, the strongest projects will be those that combine reliable power, resilient design and disciplined risk management.”
