Posts on X on October 18, 2026 say that Iran's Parliament Speaker, Mohammad Bagher Ghalibaf, announced a new body called the Persian Gulf Data Authority. The claim, as relayed by aggregator accounts, is that it will "monitor the resources provided to artificial intelligence firms" in the region and track and restrict the flow of finance, equity, land and energy to tech companies he says are aiding military invasions. Governments or investment funds that help those firms would, the posts say, face enforcement from Tehran.
Here is the short version of our check: we could not find the announcement in a news report, a parliamentary text or an Iranian state-media piece we could open. The claim traces to social posts and aggregator summaries. What is well documented is the context: Iran has repeatedly threatened Gulf data centres this year, and AWS facilities in the UAE and Bahrain were hit by drones in March.
Claimed versus verified
| Claim | What we found |
|---|---|
| Ghalibaf announced a "Persian Gulf Data Authority" | Relayed by X accounts and an aggregator on October 18. A search for the name returned no news report, no official text and no state-media article. Unverified. |
| It will restrict finance, equity, land and energy to AI firms | Same single-chain source. Nothing says what legal power it has or how it could be enforced outside Iran. Unverified. |
| Governments or funds that help such firms will face enforcement | Same source. No named targets, penalties or legal basis in anything we could open. Unverified. |
| Iran has threatened Gulf data centres and AI facilities | Confirmed. Al Jazeera reported on October 13 that security chief Mohsen Rezaei warned cables, data centres and AI facilities could be attacked if war with the US resumes. |
| Data centres in the region were struck in 2026 | Confirmed by AWS statements quoted by Al Jazeera: two UAE facilities "directly struck" in March, and a strike near a Bahrain site "caused physical impact". |
Treat the Authority as a claim until Iranian officials, the parliament or an outlet with a named reporter publishes the text or a direct quote. Two cautions apply. A statement by a parliament speaker is not the same as a law or an agency. And even a real body inside Iran would have little direct reach over a Gulf state's sovereign fund or a US cloud provider.
What the record does show
The Al Jazeera explainer, by Nils Adler, gives the clearest recent timeline:
- March 2026. Al Jazeera cites the semi-official Tasnim agency saying the Islamic Revolutionary Guard Corps published a list of "new targets", including cloud infrastructure belonging to Google, Microsoft and Oracle in Israel and some Gulf states. The same month the IRGC named 17 US firms on Telegram, including Google, Meta and Apple, and the Emirati AI company G42.
- March 2026, strikes. AWS said two of its facilities in the UAE were "directly struck" by drones, and a strike near one in Bahrain "caused physical impact to our infrastructure". Abu Dhabi Commercial Bank said its app was unavailable due to a region-wide IT disruption, though it did not link that directly to AWS.
- September 2026. AWS said it could not restore several sites in Bahrain and one in the UAE, having "exhausted every option" for some data hosted in Bahrain.
- June 2026. A memorandum of understanding between Iran and the US ended most active hostilities, but attacks on ships near the Strait of Hormuz continued.
- October 13, 2026. Rezaei's warning about cables, data centres and AI facilities if war erupts again.
The OECD AI incident monitor logged the October threat as a hazard, meaning a credible risk of harm, not a realised incident, since no destruction followed the statement.
Why AI infrastructure is the target
An analyst quoted by Al Jazeera, Andreas Krieg of King's College London, says Rezaei's warning "is not simply threatening another set of targets" but "identifying a new category of strategic infrastructure that connects Gulf economic diversification directly to American technological power." He calls it "fundamentally about deterrence", aimed "as much at Abu Dhabi, Riyadh and Doha as at Washington".
That framing fits the claimed Authority, if it exists. A body aimed at funding flows would be a way to pressure Gulf governments and investors with economic threats instead of drones. But that is an inference about a body we cannot confirm.
The exposure is real because of how the region has bet on AI. Al Jazeera notes that G42 is building Stargate UAE with OpenAI, Nvidia and others within a planned 5-gigawatt UAE-US AI campus, that Saudi Arabia's Public Investment Fund launched Humain in May 2025, and that Microsoft said in September it would invest more than $10 billion across Kuwait, Qatar, Saudi Arabia and the UAE through 2030 with a focus on "digital resilience". Krieg says the threats will not "fundamentally reverse" these ambitions but "change the economics and geography of AI investment."
The cables are part of the same story
Data centres are not the only choke point. According to Al Jazeera, citing TeleGeography estimates, more than 90 percent of data capacity between Europe and Asia passes through cables under the Red Sea, entering through the Bab al-Mandeb strait, which is about 26 km wide at its narrowest. In September the Iran-backed Houthis seized the port of Mocha and territory around the strait; on October 5 Yemen's internationally recognised government said it had retaken positions, which the Houthis denied.
Alternatives are being built. Iraq signed a contract on September 10 with Qatar's Ooredoo for an overland route to Europe, and Ooredoo's international arm agreed on October 7 to buy fibre from iQ Networks, subject to government approval. Microsoft said in September it would invest more than $400 million in subsea and land connectivity across the Middle East by 2030. Rest of World, citing an unnamed source, reported that Google and Meta had begun sending some traffic through Iraq; neither responded to Al Jazeera.
How this fits the wider pattern of attacks on AI infrastructure
Physical and political pressure on data centres is now a recurring theme on this blog:
- Drone strikes on Russian cloud provider Yandex's facilities, covered in our posts on the Sasovo data centre strike and the third Vladimir strike and force majeure outage.
- Community resistance to new sites, such as the Thane, India protests over water and power and the San Francisco moratorium.
- Grid and siting pressure that changes where capacity gets built, like Microsoft pulling out of the Nscale Loughton site.
- State influence operations tied to Iran, which OpenAI tackled in its report on Russian and Iranian false-front operations.
The Gulf case is different in kind because it combines physical strikes, a threat to cables, and a possible financial-pressure instrument aimed at investors.
What to do if you run workloads in the region
You do not need the Authority to be real to act on the documented risk. Practical steps, drawing on the resilience points analysts raised:
- Keep a copy outside the region. AWS said it "exhausted every option" to restore some Bahrain data; Krieg says real resilience needs "geographical redundancy, potentially including facilities outside the Gulf".
- Map your connectivity. Know whether your traffic uses Red Sea cables, and what the fallback route is.
- Review power and cooling single points of failure. Krieg notes an attack need not destroy servers to render a facility inoperable, because it depends on power, cooling and telecoms.
- Read sources, not summaries. Wait for the text of any new Iranian measure. If you run AI agents against cloud infrastructure, tools such as AgentBeam, the agent security platform from the explainx.ai team, can stop agents before they take dangerous actions during an outage or an incident.
- Check contract language. Force majeure and data-residency clauses behave differently when a region is a conflict zone.
How to read a claim like this
Three habits help when a geopolitical headline about AI spreads faster than the reporting behind it. First, ask who the speaker is and what office they hold: a parliament speaker can announce an initiative, but creating an authority normally needs legislation or a government decision, and the posts do not mention either. Second, ask whether the claim has more than one independent chain: here every version we saw traces back to the same social posts. Third, separate capability from intent. Iran has shown it can reach Gulf facilities with drones, but an economic blockade of AI investors depends on whether Gulf governments and funds change their behaviour, and nothing we found suggests they have.
It is also worth noting what the claim would not change on its own. Existing projects such as Stargate UAE, Humain and the Microsoft investments are funded and powered by sovereign and corporate actors that Iran does not control. A new Iranian body could add diplomatic pressure, but its practical effect would depend on enforcement we cannot see.
What would change our assessment
We will update this post if any of these appear:
- A direct quote from Ghalibaf or a parliamentary document naming the Authority.
- Coverage from a named outlet with its own sourcing, or Iranian state media text.
- Details on enforcement: named companies, sanction lists, or asset restrictions.
- A reaction from a Gulf government, a sovereign fund or a cloud provider.
Until then, the confirmed picture is the threats and the strikes, not the Authority.
Related reading
- Yandex Sasovo data centre drone strike: claimed vs verified
- Yandex Vladimir: third strike and force majeure
- Thane, India: protests over a 22-hectare Amazon data centre
- San Francisco's data centre moratorium
- Microsoft pulls out of Nscale Loughton
- OpenAI bans Russian and Iranian influence operations
Accurate as of October 18, 2026. The Persian Gulf Data Authority claim was unconfirmed at the time of writing.