Preparing for the unknown: the global technology industry must brace for greater volatility

In 2002, a briefing by US Secretary of Defense Donald Rumsfeld presented a framework of risk assessment that caught the global imagination. In the ‘Rumsfeld matrix’, things that are known can be acted upon; things that are known to be unknown can be prepared for; but there are things “we don’t know that we don’t know”, and this latter category represents the greatest risk. 

The volatility that now characterises global trade is likely to intensify over the next few years, and the technology industry is especially exposed. Executives and investors across the technology landscape need to engage actively with known risks, but also give serious thought to the ‘unknown unknowns’. 

Analysys Mason has devised a risk matrix that sheds light on various risk categories that are likely to shape the next few years for technology services executive and investor agendas. It covers technological opportunities and risks, geopolitical tensions, friction in global trade as well as technological change.

Figure 1: Risk matrix for the global technology industry

We shed light on how the world’s interdependent supply chains will reconfigure themselves, how the impacts vary from region to region, and what the indirect consequences will be for players across the IT ecosystem. We go on to explore in detail likely reactions to the emerging global tariff regime, with a particular look at different scenarios for the European technology sector. 

As ‘known knowns’ force change, the most flexible technology players will be the most successful

Recent changes to tariffs are likely to shift delivery models in the USA 

US tariffs only apply to imports into the USA, meaning that the direct cost impact is US-centric. As the majority of IT hardware is made in the Asia–Pacific region, there are limited flows of hardware between the EU and the USA. In the near term, service delivery model shifts will occur mostly in the USA alone. Europe and Asia will mainly see indirect, supply-chain effects, applying where an element passes through the USA.

‘Reciprocal’ measures are applied to goods, but not software or IT services. Cloud services hosted by US data centres are therefore broadly unaffected. 

Figure 2: Tariff examples 

The service delivery model will face higher costs due to tariffs

• Managed infrastructure services: hardware prices will likely force customers to delay upgrades, stretch existing equipment, shift peak workloads to the cloud and renegotiate contracts. While hybrid cloud is currently growing, higher local hosting costs may reconsider a shift to more public cloud services.
• Infrastructure/platform as a service (IaaS/PaaS): tariffs on servers and networking equipment are squeezing cloud providers’ margins, delaying hyperscale builds, shifting investment towards supply-chain resilience and driving up long-term or hardware-heavy contract prices.
• Software as a service (SaaS): higher hosting and hardware costs will likely lead SaaS vendors to raise prices, add surcharges and adjust contracts. Buyers will demand return on investment (ROI) and flexibility, with more deals requiring C-suite approval.
• Edge computing and IoT: tariffs on edge devices are raising costs for factories and remote sites, with possible delays, reduced roll-outs and a pivot to domestic or exempt suppliers, software-defined solutions or refurbished equipment – slowing, but not stopping, edge growth.
• Managed AI and machine learning as a service (MLaaS): tariffs on AI hardware (for example, graphics processing units (GPUs), accelerators) from Asia raise infrastructure costs for MLaaS and managed AI services, likely threatening roll-out speed and affordability. Providers may absorb short-term costs but may face performance or pricing trade-offs if tariffs persist.

Managed service providers will need to pivot away from tariff-affected services

• Enterprise IT services: demand for consulting and IT services will likely fall as client budgets tighten. US federal and enterprise clients are expected to delay or cancel certain digital projects, putting pressure on deal pipelines and margins.
• Managed service providers focused on small and medium-sized businesses (SMBs): tariffs raise hardware costs, squeezing margins on fixed-price contracts. Agile providers are strengthening value-added services that are less reliant on hardware and building pricing flexibility. Trusted advisory roles are likely to be especially important in weathering the disruption.
• Managed security and network providers: hardware-based services (for example, firewalls, SD-WAN) will be hit hard by tariffs. Providers and customers will largely pivot to cloud-based, software-defined security (SASE) and device-agnostic network management. Security service contracts remain stable as clients outsource to minimise capex.

Investment will be restricted and procurement will move to more favourable areas

• AI investment in the USA: tariffs inflate core data-centre equipment and construction materials (such as servers, steel, racks and transformers) which will extend equipment lead-times substantially. The squeeze is likely to stall or trim many co-location and edge projects, strain the limited stock of high-voltage equipment, push power-grid upgrade timelines beyond 2026, and throttle the expansion of AI-ready data-hall space due to the schedule risk and capital uncertainty more than the headline duty. Start-ups will likely take the sharpest hit: more expensive co-location contracts and cloud pass-throughs inflate their cost of goods likely by 5–15%, stretch burn-rates, delay break-even and prompt venture capitalists to demand stricter cloud-spend discipline or multi-cloud hedges before releasing fresh capital.
• Data-centre foreign direct investment (FDI) in the Association of Southeast Asian Nations (ASEAN): hyperscalers will likely continue channelling long-term FDI into Malaysia’s Johor/Selangor and Vietnam’s Bac Ninh/Binh Duong (Google and Microsoft alone have committed more than USD4 billion since May 2025) to create multi-hundred-megawatt ‘cloud regions’ for a Southeast Asian market. This region has the fastest-growing expenditure on cloud and AI in the world. Lured by 10- to 15-year tax holidays, fast-track permits, green power purchase agreements and zero import tariffs on servers and networking equipment, they can land hardware duty-free, in stark contrast to the USA. Thailand’s Eastern Economic Corridor is poised to follow suit, while land- and carbon-constrained Singapore remains a high-latency control plane rather than a major expansion site.
• Procurement: procurement has already adapted to create workarounds for tariffs. Originating in China/ASEAN and shipping straight to the USA attracts tariffs, but including a final test component in Mexico allows tariff-free imports. Boards and GPUs are often assembled in Malaysia, Vietnam or Thailand; once the servers are fully racked, they are certified in Mexico and then qualify for duty-free entry into the USA under the United States-Mexico-Canada Agreement (USMCA) as they meet the USMCA’s ≥60% regional-value and substantial-transformation rules. This avoids the 25–125% China-linked duties, retains the chip carve-out (where semiconductor-related items are exempt), and spreads supply risk across three jurisdictions. 

The ‘known unknowns’ point to unpredictability and risk in the supply chain, and players’ resilience will be key

Uncertain geopolitical threats and ambiguity are a major driver of risk for technology services

• Retaliation to tariffs: there is speculation about new trade deals being struck in response to the tariffs, both in terms of circumventing China to preserve US trade and in terms of replacing the US market with others. It is possible that a plurilateral ‘tech goods free lane’ will emerge inside the World Trade Organisation. At the time of writing, it is not clear if the direct retaliatory tariff (34%) will be imposed by China on the USA before a deal is reached between the two countries. The implications of a breakdown in negotiations could be dramatic, especially if China chooses to weaponise essential and unique exports such as rare-earth minerals or gallium.
• Durability of semiconductor exemption: the chip carve-out could be vulnerable to further changes from the US Department of Commerce’s Bureau of Industry and Security or the National Security Staff Committee, which both play key roles in the export and trade policy framework. In order to fall under different tariffs, server motherboards or packaged AI accelerators might be re-classified as ‘chips’ or ‘systems’. A collapse of the current carve-out workaround would have serious consequences on cost models for every planned GPU cloud.
• Cyber risk: cutting IT budgets leaves firms at greater risk of cyber attack. Risk/reward profiles for cyber attacks are unfortunately rising, including those seeking access to sensitive technological and business model information (for example, Nvidia). The fragmentation of managed IT services along national lines is likely to result in ‘cyber-security silos’, benefiting regional security providers but potentially reducing the quality of cyber services on a broader regional scale.

Risks to business are the primary effects of volatility

• IT budget impact: increased prices will likely decrease customer spend on certain managed IT services, especially related to hardware maintenance, driving a shift towards managed services that are considered critical, such as cloud, AI and security.
• Contracts and business models: customers of managed service providers are likely to face a more challenging contract environment, characterised by shorter quoting periods, escalation clauses and less pricing flexibility.
• Cost of capital: wider credit spreads and policy volatility raise the weighted average cost of capital (WACC) as lenders add tariff-change clauses or reduce tenor, increasing refinancing risk on existing debt and curtailing new greenfield projects.
• AI: rising data-centre construction costs are likely to increase the cost of managed AI services, threatening ROI on early-stage, still-unprofitable AI services. This trend may be counteracted by increasing AI investments and governmental subsidies.

The ‘unknown unknowns’ are likely to have significant effects, especially if unmitigated

The highest volatility comes from unpredictable risks:

• Climate and sustainability: the frequency and intensity of extreme temperatures/humidity, flood-destruction exposure and El Niño-driven droughts are pushing ASEAN sites towards liquid cooling, elevated floors and on-site water recycling. To mitigate increasing energy-related opex (Singapore prices carbon at SGD50/ton by 2030, for example), operators might prefer multi-tenant shared builds to spread capital and operational costs. 
• Cyber breach shock: the impact of cyber breaches can vary massively, but in the event of a compromise equivalent to the 2020 SolarWinds attack at a newly onboarded ASEAN original design manufacturer (ODM), the consequences would be serious: emergency firmware recalls, fast-track national data-protection laws and mandatory sovereign-cloud localisation, raising compliance overheads and stalling construction while operators vet alternative vendors. 
• China–Taiwan conflict scenario: any active conflict or blockade event would stall PCB/GPU lanes overnight, ignite an ‘ex-China’ supplier scramble, and spur sweeping export-control and data-sovereignty rules – driving up server prices, stretching lead-times beyond 12 months and inflating data-centre capex across every region that relies on Taiwanese silicon. 

The technology and IT services industry needs to adapt quickly to regulatory, economic and technology changes 

Of the various possible shocks to the global economy, the recent uncertainty over taxes and controls for trade into and out of the USA are especially pertinent. The tariff regime has been highly unpredictable, but the global technology industry is characterised by a dynamism that will help it to adapt quickly to new pressures, constraints and opportunities. However, some investment cycles are necessarily long, and certain adaptations will prove trickier than others.

Technological progress can counteract the risk posed by tariffs 

Recent changes in US tariff policies pose regulatory and economic risks. Technological progress can counterbalance some of these risks and create new business opportunities.

Regulatory risks come from nationally focused movements and tariff avoidance

Data sovereignty is rising up the agenda across ASEAN and the EU. Recent developments in EU legislation – notably the EU’s General Data Protection Regulation (GDPR), the AI Act, the Data Act and the Network and Information Security Directive 2 (NIS2) – are a clear sign of the importance of data sovereignty, privacy and transparency. 

Domestically/regionally hosted clouds are likely to become a major geopolitical objective, particularly as transatlantic relations come under strain. This important economic factor will accelerate demand for regional cloud hosting and, in turn, local data-centre construction outside the USA. Building data centres outside the USA allows providers such as AWS, IBM, Microsoft and Oracle to reduce exposure to tariffs, as equipment is not imported into the USA, insulating clients from hardware/materials cost inflation. 

This will become especially relevant if rules of origin (ROO) regulations are tightened, making it harder for China to route exports through Vietnam and Mexico to sidestep tariffs.

As supply chains are restructured to reduce dependence on China and circumvent the most onerous tariffs, partnerships with new third-party vendors will attract heightened regulatory scrutiny, with greater focus on vendor security and the risk of spyware and other malware.

Economic effects will come from the ability of the whole supply chain to move to low-tariff areas 

The extent of hardware and software/SaaS price inflation will hinge on tariff rates and on hardware vendors’ ability to shift production to lower-tariff jurisdictions. Modest tariffs can be partly absorbed by hardware makers and software/cloud providers; higher rates will likely be passed through, lifting prices across hardware and IT services like IaaS/PaaS, SaaS, public cloud, IoT and MLaaS.

Cloud hosting is especially exposed, as both construction materials and critical equipment are tariff-sensitive. While dominant cloud providers (AWS, IBM, Microsoft, Oracle) may absorb some increases, larger or persistent shocks are likely to be passed on to customers. This would raise the cost of AI workloads, potentially slowing innovation and pressure-testing AI-based business models. Increasing energy costs and recession fears due to tariffs will likely push clients towards more cloud cost optimisation.

Tariff-driven cost and supply constraints – compounded by higher capital costs – could slow data-centre build-outs, constrain available computing power, and further throttle AI expansion and innovation. 

Trade decoupling will centre on US–China trade, with hardware vendors shifting production to alternative Asian hubs. A significant rift with Europe is also possible if the EU implements a digital services tax on US technology firms.

Technological risks will come from competition, skills shortages and cyber-security attacks

US export controls on advanced chips and chipmaking equipment (for example, ASML lithography systems) have not prevented recent Chinese advances (for example, Huawei), suggesting that China will remain competitive. The principal risk to US leadership in AI is that Chinese firms will leverage both home-grown and US-developed large language models to narrow any gap with Silicon Valley. Reduced data-centre capex could cut available computing power and slow AI progress, but efficiency gains across AI models and data centres (for example, model compression, quantisation, distillation and faster inference runtimes) can partially offset the shortfall.

The global need for technological progress that meets production and productivity demand means that existing trends towards multi-cloud, hybrid cloud, edge computing, agentic and generative AI will intensify existing skill shortages. Third-party services have a key role to play (especially in the mid-market segments) in terms of providing transformative support.

As one example, there is a growing need for major, widespread investment in security measures. The recorded loss due to cyber crime is already huge (Bitkom estimated a EUR267 billion hit to German companies during 2023 alone), and is only expected to increase without substantial investment in countermeasures to close skill shortages. The increasing number and complexity of cyber threats, coupled with regulatory initiatives like NIS2 and the EU AI Act make plain the need for security operations centres, zero-trust methodologies, and AI-enabled endpoint detection and response (EDR). 

Figure 3: Risk factor likelihood and impact 

The effects of a US–EU trade war are likely to increase prices and slow progress 

As each trading bloc seeks to react to changes in global supply chains, there is a risk of an escalating trade war between the USA and the EU. Digital services would be a likely focus for new counter-tariffs which would influence the IT services market significantly. We have explored two possible scenarios for how tariffs might evolve and the key impacts. 

1. Tariff cap 

The EU bilaterally negotiates a tariff deal that maintains tariffs at no more than 15%, or that reduces export tariffs but also limits import tariffs for big techs to a minimum/zero, with the effect of: 

• slowing expansion of US-based cloud service providers in the short term only
• limited risk of customer loss due to existing US hyperscaler contracts
• a likely push towards private and sovereign cloud solutions (especially for compliance-sensitive industries).

2. Escalation

Rising political and economic pressure from both sides leads the EU to impose high reciprocal import tariffs of >20% for major technology companies, including on digital and cloud services, posing a significant risk to technology and IT service business models and investment cases, with the effect of: 

• a stark price increase and slower growth/adoption across major IT service business lines
• significantly slower growth of the cloud services market in Europe due to slower expansion of US-based cloud providers 
• falling hyperscaler-related revenue for IT services companies
• a strong mid-term increase in private and sovereign cloud as well as European public cloud alternatives.

Figure 4: Example scenarios on how tariffs will affect technology and IT services 

For over 40 years, Analysys Mason has played a leading role in helping executives and investors in the technology, media and telecoms (TMT) industry to prepare for and adapt to successive cycles of evolution and revolution in technological disruption. 

Analysys Mason has a team of experts dedicated to private-equity strategy and strategic value creation. Our specialists help technology executives and investors to prepare for and shape the next wave of volatility, creating sustainable value and future-fit technology champions. To find out more about the content of this article and our expertise in this area, get in touch with Christian Fischer and the Strategy team. 

The author also thanks Thomas Caslavka (Manager) and Hadrian von Kuenheim (Associate Consultant) for their valuable contributions to this article.