Where is technology investment going in the GCC?

1 September 2026

Into compute, first and loudest. Gartner forecasts MENA data centre systems spending at $12.98 billion in 2026, up 37.3 percent after a 69.3 percent jump the year before. But software is the larger pool, $20.45 billion growing 13.9 percent, and software is the money a foreign vendor can realistically win.

The gigawatt headlines are real, and they are not your market

In Abu Dhabi, G42 is building Stargate UAE, a 1 gigawatt cluster inside a planned 5 gigawatt UAE and US AI campus covering roughly 10 square miles. It was announced in May 2025 with OpenAI, Oracle, NVIDIA, SoftBank and Cisco. The first 200 megawatts is under construction by Khazna, a G42 company, for delivery in 2026.

In Riyadh, the Public Investment Fund launched HUMAIN in May 2025 to operate the full stack: data centres, cloud, models and applications. In November 2025 AMD, Cisco and HUMAIN formed a joint venture targeting up to 1 gigawatt of capacity by 2030, with a first 100 megawatt phase due to begin operating in 2026.

And in July 2026 Abu Dhabi's MGX, backed by Mubadala and G42, closed a $49 billion fund against a $45 billion target, aimed at semiconductors, AI infrastructure and AI enabling platforms. Reported holdings include OpenAI and Anthropic.

None of this is a sales opportunity for a European software company. It is land, power, GPUs and contracts between consortia. Read it as capacity being installed next to your future customers, not as a pipeline you can bid into.

It is also worth keeping the scale honest. Saudi Arabia's Ministry of Communications and Information Technology reported national data centre capacity at 290.5 megawatts, after a 42 percent increase during 2023. Announced pipelines are measured in gigawatts. Installed capacity is measured in hundreds of megawatts. The distance between those two numbers is several years of construction.

Software is the bigger number, and almost nobody writes about it

Gartner's August 2025 forecast puts total MENA IT spending at $169 billion in 2026, up 8.9 percent. The segments:

Communications services: $63.46 billion
IT services: $36.89 billion, up 8.3 percent
Devices: $35.23 billion
Software: $20.45 billion, up 13.9 percent
Data centre systems: $12.98 billion, up 37.3 percent

Data centre systems grow fastest. Software is roughly 58 percent larger in absolute terms and grows at double digits with none of the coverage. Gartner's MENA definition is wider than the GCC, but the Gulf is what drives the growth in it.

Security is a sub-pool worth naming on its own. Gartner puts MENA end user spending on information security at $4.07 billion in 2026, up 10.1 percent, of which security software is $1.97 billion.

Saudi Arabia by itself: MCIT put the Kingdom's ICT market above SAR 180 billion in 2024. The US Department of Commerce values Saudi public cloud services at more than $2.7 billion in 2025 rising to $5 billion by 2027, and Saudi cybersecurity at $1.1 billion in 2025 rising to $1.8 billion by 2027.

Venture capital is moving in the opposite direction

This is where most people read the region wrong. Sovereign and government money is expanding. Venture money is contracting, sharply.

MAGNiTT's H1 2026 review recorded $1.35 billion raised by MENA startups, down 22 percent year on year, across 214 deals, down 41 percent. Saudi Arabia accounted for $219 million, down 74 percent. The UAE took $895 million, 66 percent of the regional total. Enterprise software raised $115 million across the entire region in six months. The ten largest transactions were 58 percent of all funding, and international investors fell from 55 percent of active investors in 2025 to 39 percent in the first half of 2026.

The practical lesson: do not enter the GCC looking for investors, accelerators or startup partners. That pool is shrinking and concentrating into a handful of large rounds. Enter looking for institutional buyers with approved budgets. The two are moving in opposite directions right now, and only one of them is your customer.

Where the government money is actually budgeted

Saudi Arabia's FY2026 budget sets expenditure at SAR 1,313 billion against revenue of SAR 1,147 billion, a deficit of SAR 165 billion or 3.3 percent of GDP. There is no separate technology line anywhere in it. Digital spending sits inside the sector budgets for health, social development, education, municipal services and public administration. That is where a software vendor should aim, rather than at anything with the word AI on the door.

Two commitments inside the budget statement are worth writing down. It projects the Kingdom's telecommunications and technology market at SAR 199 billion by the end of the fiscal year. And it commits to expanding Tawakkalna, the national government services platform, to 926 services by the end of 2026. A platform adding services at that rate is buying software continuously, not once.

The UAE federal budget for 2026 is AED 92.4 billion, approved on 27 October 2025 and up 29 percent on the prior year, with AED 34.6 billion for social development and pensions and AED 27.1 billion for government affairs. The federal budget is not the whole picture, because individual emirates run their own. Dubai's Universal Blueprint for Artificial Intelligence targets an annual contribution of AED 100 billion to the emirate's economy and a 50 percent improvement in government productivity.

The rule that decides whether you can take the money

The Saudi Cloud First Policy, issued by MCIT in October 2020, is the single most useful document a foreign SaaS vendor can read before pricing a Saudi deal. Three provisions matter.

It ranks delivery models in order of preference: SaaS first, then PaaS, then IaaS. A national policy that prefers your delivery model is not something you get in most markets.

It states that civilian government entities are not allowed to buy or build new data centre infrastructure, other than government owned providers such as the National Information Center. That pushes demand toward hosted services by design.

And it requires that all data in both the Government Cloud and the Commercial Governmental Cloud should be located geographically inside the borders of Saudi Arabia. Data is classified into four levels. Levels 1 and 2 go to the Government Cloud only. Level 3 needs National Data Management Office approval. Level 4 can go to an approved commercial provider. The policy covers all government entities except the central bank, the Ministry of Defence, the Presidency of State Security, the Ministry of Interior and the National Cybersecurity Authority.

Outside government, the US Department of Commerce reported in August 2025 that Saudi cross border data transfer rules are now actively enforced by SDAIA and the National Cybersecurity Authority, and that sensitive and personally identifiable data must be stored inside the Kingdom unless an exemption is granted. Its own conclusion was that global cloud infrastructure models may need restructuring to comply.

The UAE is materially different. Federal Decree-Law No. 45 of 2021 on the protection of personal data permits transfers abroad, under Article 22 to jurisdictions offering adequate protection and under Article 23 on contractual, consent and other listed grounds. There is no general localisation mandate. Its implementing regulations had still not been issued as of 2026, so in practice DIFC Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021 govern inside those two financial centres, and sector rules in banking, telecoms and healthcare bind elsewhere.

That difference is the most commercially significant fact in this article. The two largest GCC markets have opposite defaults on where your customer's data can sit.

What this means in practice

Sell into the UAE from your existing EU hosting. For most B2B software there is no federal requirement to move data into the country, so the cost of a first UAE customer is sales cost, not infrastructure cost. Validate demand before you spend anything on architecture.

Treat Saudi hosting as a bid requirement, not a strategic decision. If the target is Saudi public sector or a regulated buyer, in-country hosting is a line item in that deal, not a company milestone. Price it into the first contract and use a local hosting partner rather than building your own footprint. Vendors who discover this at shortlist stage lose to vendors who wrote it into the proposal.

Aim at the application layer. The gigawatts being built are being built by consortia with balance sheets no mid-sized vendor can match. What those facilities will need is software running on them, sold to hospitals, municipalities, schools, ministries and banks. That is the layer where a 20 to 200 person European software company competes on level terms.

Model the collection cycle honestly. Saudi Arabia's I'timad platform cut government payment order cycles from more than 100 days to 14, and settlement from more than 100 days to within 45, according to the Ministry of Finance in October 2024. That is a genuine improvement and it is still slower than a typical Polish enterprise contract. Plan working capital around it.

One more point for Polish software companies in particular. The buyers here are procuring products, not development capacity. A team used to building someone else's roadmap on a time and materials basis has to arrive with something named, priced and referenceable. That shift, from supplier to vendor, is harder than the market entry itself, and it is worth more once it lands.

Talk to us about your GCC entry

Sources

This article is commercial guidance, not legal or tax advice. Data protection, cloud and procurement rules in Saudi Arabia and the UAE change frequently. Verify the current position with qualified local counsel before making a commitment.

Planning a move into the Gulf? Tell us what you sell and what you have tried.

Start a conversation

Przeczytaj po polsku