Asia’s invisible tariff: why AI capital is underweighting the markets that want it most 

The scale of the AI infrastructure build-out is now measured in trillions, though estimates differ by methodology, timing, and vintage. Goldman Sachs‘s May 2026 baseline model implies roughly $7.6 trillion in cumulative spend between 2026 and 2031 across compute, data centers, and power. McKinsey, in an April 2025 analysis that now looks conservative, put cumulative data center capex at nearly $7 trillion by 2030 – about $5.2 trillion of it AI-specific – and has continued to stand by that figure since. And Nvidia, on a different basis, projects AI infrastructure spending reaching $3 trillion to $4 trillion annually by the end of the decade. The order of magnitude is no longer in dispute: this is the largest concentrated infrastructure build in modern economic history.

Where it lands is the open question.

Look at where the money is going and a pattern jumps out. Microsoft is putting $17.5 billion into India through 2029. Blackstone and CPP Investments paid roughly $16 billion (A$24 billion) to acquire AirTrunk, the Asia-Pacific data centre platform, in 2024. Adani is committing $100 billion to Indian AI infrastructure by 2035. Microsoft is investing $15.2 billion in the UAE between 2023 and 2029. AWS is building a $5.3 billion data centre region in Saudi Arabia. Google Cloud and Saudi Arabia’s Public Investment Fund have jointly committed $10 billion to an AI hub with Humain. And the capacity is showing up in the numbers: operational data centre capacity in Johor, southern Malaysia, grew 53% year-on-year in 2025, with Melbourne up 37%, according to CBRE’s 2026 Asia Pacific Data Centre Trends & Outlook. The build-out is going global.

Now weigh that capital against the populations it’s meant to serve, and a puzzle appears. The largest-population markets of Southeast Asia – Indonesia, the fourth most populous country on earth; Vietnam; Thailand; the Philippines – are not being passed over. Billions are flowing in: Amazon has committed roughly $5 billion each to Indonesia and Thailand, Microsoft $1.7 billion to Indonesia, Google is building hyperscale capacity in Vietnam and has earmarked $1 billion for Thailand. And yet, set against the size of these markets – their populations, their fast-expanding user bases, their domestic demand – the capital is strikingly light. The runaway concentrations are forming elsewhere – in Johor, a single Malaysian state pressed against Singapore; in Melbourne; across the Gulf. These winners have very little in common with each other. Johor has cheap power, abundant land, and proximity to a major demand hub. Melbourne and the Gulf are expensive, distant from Asian users, and far harder to build in. If geography or cost were doing the work, the same kind of place would keep winning. They aren’t.

The mismatch is not random. Put two maps side by side – the map of where AI capital is concentrating, and the map of how the internet’s underlying address space is governed – and the same pattern appears in both. Power availability, geopolitics, and English-language convenience each matter, but they don’t fully account for the gap. What they leave unexplained traces to the foundations of the internet: the way IP addresses are allocated, the institutions that control that allocation, and the legal-political layer those institutions answer to. The Asia Pacific was the first region on earth to exhaust its free pool of IPv4 addresses, in 2011, years ahead of North America or Europe. It is also the only region that inserts a layer of national registries – each incorporated under its own country’s laws – between the regional authority and the networks beneath it. The result is a foundation older in its scarcity, more fragmented in its structure, and more politically entangled than anywhere else in the world. It behaves like an invisible tariff – paid in delay and regulatory risk, not just dollars.

The IPv4 layer: Asia hit the limit first, and it shows

The simplest input to the internet is addressable IP space.

The IPv4 layer: Asia hit the limit first, and it shows The simplest input to the internet is addressable IP space. APNIC, the Asia-Pacific regional internet registry, was the first of the five RIRs to run out of freely allocatable IPv4. On 15 April 2011 – four years before ARIN in North America, eight before RIPE in Europe – it stopped filling open-ended, need-based requests and moved to rationing a reserved final block, the 103/8 pool. Under that regime every applicant receives the same fixed allocation regardless of need: first a /22 (1,024 addresses), then, under prop-127 in 2019, a /23 – 512 addresses, the maximum any account, new or existing, can now be delegated.

This is not a sign the region has run out of addresses. As of December 2025 the available pool still held about 3.1 million addresses – roughly 12,000 /24 blocks – and even the proposal arguing those addresses sit idle too long projected the pool would not be exhausted until around 2035. The constraint is the size of each allocation, not the supply: a /23 runs a single network, not a cloud region or an AI campus. An attempt to loosen that limit – prop-168, in 2026 – would have raised the cap from a /23 to a /22, but it failed to reach consensus at APNIC 61 in February 2026. The community has consistently chosen to conserve the pool for new entrants over enlarging allocations for growing networks – leaving the latter to acquire space on the open market – by transfer or lease.

Capping new allocations is now standard: ARIN limits a member to a /22, RIPE to a single /24. What differs is the route to the secondary market once an operator hits the cap. That market has two mechanisms – transfers, where registered space is bought and sold, and leasing, where a holder rents out space it is not using. APNIC provides for transfers, including between regions, and has done so for years. Its policy is silent on leasing: the published rules neither authorise nor prohibit it, which leaves operators that rely on leased space without a clear basis for doing so. In the other regions leasing carries far less of this uncertainty. The effect for APAC is a narrower and less predictable set of options than the cap alone would suggest – and LACNIC, in Latin America, is the only other region in a comparable position.

The two regions are also on different paths. LACNIC has moved to address it: its LAC-2025-5 policy proposal would bring leasing and transfers into formal policy. APNIC has no comparable proposal under consideration, and the question remains governed by unwritten local norms rather than published rules.

The shortage also constrains how companies can grow. Large IPv4 blocks aren’t available to purchase at all in the secondary market – and the smaller blocks barely are. IPv4.Global’s public listings, one of the few open marketplaces for IPv4 sales, run consistently thin. Inventory typically ranges from zero to perhaps a dozen small blocks at any given moment – /22s of 1,024 addresses or /24s of just 256 each. An operator wanting to scale into Asian markets cannot simply buy its way out of the constraint – there is nothing of meaningful size to buy.

This is the cost of operating on the modern internet, charged to APAC and LATAM operators as a structural friction the rest of the world has engineered away. No capex announcement or GDP figure records it, yet every business that needs routable address space in Asia carries it.

Most of the world engineers around the IPv4 constraint. In APAC it caps growth every time a business tries to expand.

The registry layer: seven NIRs, and who actually controls them

Here is where most outside observers stop reading, because the next layer of the problem requires understanding a structural anomaly that doesn’t exist anywhere else.

In Europe, an operator wanting IP address space goes directly to RIPE NCC. In North America, directly to ARIN. In Latin America, directly to LACNIC. In Africa, directly to AFRINIC. One relationship, one community-governed registry, one set of rules.

Asia-Pacific is different. APNIC operates through seven National Internet Registries – local bodies that sit between APNIC and the operator, handling allocations at the national level under their own local policies. This is the part of the internet’s address-space governance most engineers outside APAC have never had to navigate.

The seven NIRs are: CNNIC (China), IRINN under NIXI (India), IDNIC-APJII (Indonesia), VNNIC (Vietnam), JPNIC (Japan), KISA/KRNIC (Korea), and TWNIC (Taiwan). Three are run by industry associations. Four are arms of national governments.

VNNIC is formally an administrative agency of Vietnam’s Ministry of Information and Communications – not a community body but a government department. CNNIC has been overseen by the Chinese Communist Party’s Central Cyberspace Affairs Commission since 2014, the same body that oversees China’s censorship apparatus. IRINN operates under NIXI, a government-backed exchange. KISA is a Korean government agency.

In the four largest internet markets of Asia outside Japan and Taiwan, the body that decides whether your network gets address space is institutionally connected to the body that decides what content moves across that space.

The practical effect compounds across borders. An operator trying to maintain a regional presence across Indonesia, Vietnam, and India is dealing with three separate registries – IDNIC, VNNIC, and IRINN – each with its own membership criteria, pricing, justification requirements, IPv6 rollout pace, and political reporting line. These are not pass-through technical bodies. IDNIC-APJII serves more than 5,000 members including over 1,000 ISPs. IRINN reported 4,649 affiliates as of January 2026, having grown 64% over six years. They have institutional weight, local rules, and local priorities.

Aggressive regional IP filtering, when operators hit it, isn’t a platform-level choice in isolation. It is downstream of a registry layer where the rules are written nationally, the IPs are issued nationally, and the political reporting lines run to national ministries. Industry observers tracking registry-layer fragmentation across the five RIRs have flagged this same pattern as one of the most under-discussed structural shifts in the modern internet.

FUD and the unwritten rulebook

The visible legal layer in Asia is already complex: a country-by-country patchwork where even publicly visible information can be legally protected under data privacy laws in China, India, and Singapore, and where enforcement varies from heavy fines in Korea to a more guidance-focused approach in Japan. Every country sets its own rules on data privacy, copyright, and digital trespass, and the rules don’t harmonize.

China shows this institutional architecture in its purest form. The same government body – the Central Cyberspace Affairs Commission – sits above three things at once: IP address allocation (via CNNIC), data residency and cybersecurity (via PIPL and the Cybersecurity Law), and the licensing of every generative AI service that can operate commercially (via the CAC’s Interim Measures for the Management of Generative AI Services, effective August 2023). A data centre built in China serves customers whose right to operate is itself granted by the body that grants the data centre’s IP addresses. The address layer, the data layer, and the AI workload layer all answer to the same minister. Vietnam’s institutional shape mirrors this: VNNIC handles IP allocation, and the same Ministry of Information and Communications oversees data localisation and the country’s AI framework.

China resolved that overlap by removing foreign capital from the equation. Beijing’s June 2026 industrial blueprint commits roughly $295 billion (2 trillion yuan) of state-directed spending on AI data centres over the next five years, with state-owned operators China Mobile and China Telecom running the bulk of capacity and an 80% domestic-supplier mandate covering AI chips and supporting hardware. Alibaba’s and Tencent’s own private build-outs run separately and at comparable scale. The institutional overlap that would frighten Western capital simply doesn’t enter the equation – because Western capital is not part of the funding model. China is not paying the invisible tariff. It opted out of the market that charges it.

For every other market in the region, the overlap remains a risk input that foreign capital has to price. Vietnam has the same institutional shape as China – IP allocation, data residency, and AI content rules administratively close to one another – but Vietnam wants foreign hyperscaler investment, which means the overlap stays priced into every commitment Microsoft, AWS, or Google is asked to make. Indonesia, Thailand, the Philippines and Malaysia don’t have the China-style alignment between registry and AI content rules, but they have something subtler: regulatory cultures where decisions are made by unwritten norms rather than statute, and where what’s not explicitly permitted is not safely permitted either.

That dynamic shows up at the most elementary layer of the stack – long before AI workloads come into the picture. In the cross-border IPv4 leasing market, the recurring failure mode is not price, supply, or technical fit. It is that a prospective lessee – often a sizable ISP or hosting firm – cannot determine whether leasing addresses from a foreign holder is permitted. No statute prohibits it. No regulation addresses it. That is precisely the problem: in a regulatory culture built on unwritten norms, the absence of explicit permission reads as risk. Presented with evidence that nothing forbids the transaction, buyers do not relax – they ask whether someone from the registry or the ministry can confirm it. The deal waits for a blessing no one is formally empowered to give. Multiply that hesitation across thousands of infrastructure procurement decisions, and the cost is paid not in fees but in transactions that never happen.

This isn’t manufactured FUD. It is the rational response of operators inside a system where the rules are real, the enforcement is variable, and the unwritten norms – which IP ranges trigger soft blocks, which content categories get throttled, which scraping patterns invite a regulator visit, which procurement decisions need a quiet nod from the ministry – are learned only by failing them. This is what decades of state-aligned investment in keeping decisions inside national borders looks like in operational reality.

The cost of this dynamic shows up in capital flow. India absorbs the largest aggregate AI commitments in the region. Japan, Korea, Taiwan continue to draw their share. Malaysia’s Johor corridor, Singapore-adjacent and operating under a written regulatory framework that is restrictive but legible, has become the region’s fastest-growing build-out. Indonesia and Vietnam – countries with comparable or larger populations and demand profiles – attract noticeably less, despite the demographic logic that would put them at the centre of any AI build-out. The difference isn’t power, language, or labour – it’s whether the rulebook is written.

Builders go where the rules are written.

The hyperscaler picture: capacity where the power is, not where the users are

Hyperscaler capacity in Asia is concentrating in power-advantaged corridors – Johor, Melbourne, Mumbai. But the demand it’s meant to serve sits somewhere else entirely.

The fastest growth is in Johor, Melbourne, and Mumbai – corridors that pair abundant power with legible rules – while mature hubs like Singapore and Hong Kong slow. What the list does not include is the dense-population markets the capacity might be expected to serve: Indonesia, Vietnam, Thailand, the Philippines. Capacity is tracking power and rule-legibility, not the location of users. Why those particular corridors win, and not the much larger markets next door, is what the rest of this piece explains.

Where the AI capital is actually going

Return to the commitments listed at the top of this piece and look at them through this lens.

The regional split matters more than the totals. North America is on track to absorb the largest single share of cumulative AI infrastructure investment through 2030. Asia-Pacific’s share is large in absolute terms but disproportionately small given the region holds over half the world’s internet users. And what APAC does absorb is heavily concentrated – India, Singapore, Malaysia, Japan, Korea, and Australia take the overwhelming majority. The dense markets of Southeast Asia outside Singapore – Indonesia (280 million people), Vietnam (100 million), the Philippines (115 million), Thailand (70 million) – collectively absorb a fraction of their demographic weight.

Power availability explains part of it. Geopolitics explains another part – Western hyperscalers operate in China only through licensed joint ventures with domestic partners (AWS via Sinnet and NWCD, Microsoft Azure via 21Vianet) and do not deploy their flagship AI services through those arrangements. Risk premiums attached to less stable jurisdictions also tighten investment committees. English-language operations, regulatory predictability, and proximity to legal frameworks the investor’s lawyers understand all matter.

But these explanations don’t cover the gap on their own. Vietnam has stable power and a government actively courting tech investment. Indonesia is a democracy with a large English-capable engineering workforce. The Philippines has both. None of them are absorbing the capital that pure demographic and economic models would predict.

The foundational layer is the explanation those models miss. In Vietnam, an operator deals with VNNIC – an arm of the Ministry of Information and Communications – and the same ministry oversees data and AI rules. The IP, data, and content-control layers are administratively close. In Indonesia, IDNIC is industry-run and structurally separate from AI policy, but the broader regulatory culture relies on unwritten norms – what’s allowed isn’t always defined, and what isn’t explicitly permitted reads as risk. In Australia, none of these conditions apply. In India, the layers exist but operate at arm’s length and under written rules.

For multi-billion-dollar infrastructure commitments stretched over years, that difference is decisive.

The investment numbers underline how concentrated private AI capital has become. The Stanford HAI 2026 AI Index Report found US private AI investment – venture capital and private equity flowing into AI companies – reached $285.9 billion in 2025, against China’s $12.4 billion. That’s a 23x gap, widened from 11.7x the year before. But the comparison reveals a difference in funding models, not just funding totals. Stanford’s framework measures private and corporate AI investment globally – $344.7 billion in private VC and PE plus $237 billion in M&A, minority stakes, and IPOs, totalling $581.7 billion. China’s $295 billion state-directed plan sits outside that framework entirely: it’s government spending, not private capital. The US runs on private capital. China runs on state capital – though Alibaba’s and Tencent’s own private build-outs run separately and at comparable scale. The 23x gap measures who can attract the former, not who is spending more on AI overall. Most of that private money flowing globally lands in a small number of US-headquartered companies and a handful of sovereign initiatives in the Gulf and South Asia. The geography of who can attract private AI capital at scale is narrowing, not broadening – and the markets being excluded are disproportionately the ones whose foundations the market struggles to read.

India sits inside APNIC, the same regional registry as Indonesia and Vietnam. It operates through IRINN under NIXI, a government-backed body. By the structural argument above, it should face the same registry-layer friction. It does not, because India has been deliberately building out its policy base: written law, transparent allocation, codified data protection. IRINN’s growth and the DPDP (Digital Personal Data Protection) regime, whatever its ambiguities, are visible pieces of that pattern. Foreign capital responds to the institutional trajectory, not any single law.

India still carries confounds – a billion-plus population, an English-language workforce, geopolitical alignment with the West – so on its own it cannot fully separate these foundations from everything else that draws capital. Johor is a single Malaysian state of roughly four million people, with a smaller domestic market and thinner demographics than Indonesia next door. By demand logic, Indonesia – 280 million people, a fast-expanding user base – should win the regional build-out. Johor is winning it instead: data-centre capacity there grew 53% year-on-year in 2025, outpacing every other tracked hub in the region, while Indonesia draws a fraction of its demographic weight. The two share a region, a time zone, and a power-cost neighbourhood. What separates them is that Johor operates under a written, if strict, regulatory framework, and Indonesia under unwritten norms. When the less populous market wins, demand is not the variable doing the work. The rulebook is.

These foundations can be made workable. India has demonstrated that. But it requires deliberate state choice to make the registry layer, the IP layer, and the legal layer all readable from the outside.

Conclusion

Power, demographics, and geopolitics explain much of where AI infrastructure is landing in Asia – but not why the markets with the population and talent to anchor the build-out keep underperforming. Three foundational layers – IPv4 governance, the registry layer, and the regulatory layer – explain that gap. Foreign capital reads all three on every multi-year commitment. Where the rules are written, allocation is transparent, and the bodies that allocate IPs are separate from the bodies that license what runs on them, the capital arrives. Where any of those are missing, the capital prices the risk and goes elsewhere.

Most of the $7 trillion in AI and data-centre spend through 2030 lands in the United States, with Europe and China’s separate state-funded build-out absorbing the next-largest shares. Within Asia and the Middle East, the markets winning their share are the ones whose foundations can be read: India built it deliberately over years; the Gulf states deployed sovereign capital inside a clear regulatory framework; Malaysia’s Johor corridor pairs written rules with proximity to Singapore; and Japan, Taiwan, and Australia run address allocation through community or arm’s-length bodies kept clear of content and AI rules. Korea is the partial exception that proves the point: its registry sits inside a government security agency, yet it gates no AI workloads to the addresses it issues, so capital still reads it as legible.

The $7 trillion is going to be spent. Most of it has already chosen its destinations. The markets that wanted it had to make their foundations readable. In much of Asia, that work has barely begun.

And the asymmetry is unforgiving. Capital reads a country’s foundations in months; building it takes years. Every month a government leaves the rules unwritten is a month the build-out commits elsewhere – into campuses that will then run for a decade. Inaction postpones a country’s place in the AI economy, and the delay compounds every quarter. These foundations can be fixed – but the window to fix them before the capital commits elsewhere is closing.