18 August 2026 – Australia and New Zealand businesses are increasingly exposed to AI resilience risks that sit beyond their own systems, including cyber incidents, compute capacity, data location rules, cloud and platform outages, supplier concentration and contractual failures, according to new research from DLA Piper.
The findings come from The AI Year, DLA Piper’s global investigation of the AI ecosystem, based on a survey of 975 leaders across 13 markets and five sectors.
The research found that 55 percent of ANZ respondents say cyber breaches have already disrupted their AI value chain, while 68 percent of AI adopters name cyber-attacks as a primary AI risk for 2026 – eight percentage points above the global average.
However, the region’s AI resilience challenge is broader than cyber. Seventy-nine percent of ANZ respondents are concerned about consolidation of power in the AI value chain, while 61 percent say compute and data location rules have forced them to rethink or delay AI projects. A further 48 percent of ANZ AI adopters name cloud or compute failures as a primary AI risk for 2026.
The findings land against a sharper public focus on the infrastructure required to support AI. In Australia, the Government has announced plans for Australian Standards for AI, including mandatory requirements for large data centres covering new power supply, grid connection costs, demand flexibility and water efficiency. Recent public debate in New Zealand has also focused on the electricity, water, consenting and community implications of new AI-related data centre development.
Ed Eisdell-Moore,a data and technology partner at DLA Piper in New Zealand, says AI resilience increasingly depends on infrastructure and suppliers that sit outside an organisation’s direct control.
“AI incidents may begin well beyond the organisation’s own perimeter – in a cloud provider, model provider or critical supplier. That makes AI resilience a legal, operational and procurement issue, not just a technology issue.
“Boards need a clearer line of sight across the AI value chain. They need to understand who the critical suppliers are, where data and compute dependencies sit, what audit or oversight rights exist, and what happens if a supplier, platform or data service fails.”
The research found that ANZ respondents expect future disruption to come from a range of sources, including tariffs and trade policy, hardware availability, contractual failures or misselling by AI providers, cost and availability of capital, access to robust data and inadequate insurance cover or liability protection.
The data also points to offshore concentration across key parts of the AI value chain, with the US and China featuring prominently as primary supplier locations. For ANZ respondents, the US is the primary base for 34% of cloud and AI platform suppliers, 25% of middleware and API suppliers, 24% of data centre providers and 42% of cyber security providers. China is also a material supplier location, identified as the primary base for 15% of cloud and AI platform suppliers, 23% of middleware and API suppliers, 26% of data centre providers and 13% of cyber security providers. Together, these figures underscore the extent to which many organisations rely on offshore suppliers for critical AI infrastructure and services.
Sarah Birkett, a partner at DLA Piper in Australia specialising in data, privacy and cyber security says organisations should expect AI resilience to become a more prominent part of procurement, contracting and regulatory scrutiny.
“AI value chains are becoming more complex and more concentrated at the same time. That creates fragility. Organisations may be deploying AI at speed, but they also need to know whether the underlying infrastructure, data rights, supplier commitments and incident response arrangements are fit for purpose.
“Resilience should be built into the commercial model from the outset. That includes due diligence, audit rights, data location controls, business continuity obligations, cyber incident provisions, liability allocation and clear exit or step-in options where appropriate.”
Eisdell-Moore says the point of difference for ANZ businesses will not be AI adoption alone, but the ability to scale AI with resilient systems, credible governance and accountable supplier arrangements.
“AI resilience is now part of enterprise risk. The businesses that move fastest will not necessarily be those that take the most risk. They will be those that understand the system dependencies early, allocate accountability clearly and build resilience into deployment from the start”, says Ed.
