The kill chain used to live in a hardened bunker at Ramstein. Now it runs on rented silicon in a warehouse next to a substation, drawing 100 MW and hoping the cooling loops hold.

Boyd gave us the framework forty-odd years before anyone ran a language model: observe, orient, decide, act. The OODA loop. Whoever cycles it faster wins. Ask any Iraqi MiG pilot circa 1991. What has changed is not the doctrine. It is where the loop physically executes.

We regulate power plants as though their failure stops the country. The same logic is arriving for data centres, because somewhere between Operation Cloud Hopper and Ukraine’s sensor-to-strike tempo, the orient and decide phases moved into server halls, and policy has not caught up.

The loop moved house

The OODA loop used to run at human pace with radios and grease pencils. Not anymore.

  • US Army leaders are planning for a European fight that could mean 1,500 targets per day. Col. Jeffrey Pickler’s verdict: the battlefield is “swimming in sensors, and we are drowning in data,” and no amount of bodies stuffed into a command post will process it manually (Military Times, Feb 2026). The observe phase outgrew the human orientation phase. Something has to close the gap.
  • Ukraine’s DELTA battle management system now integrates drone feeds, sensor data, and strike coordination on a single platform, with AI embedded to help commanders make faster, data-driven decisions (New York Times, Aug 2026). Its Avengers system analyses drone video and identifies military equipment in a video stream within seconds, filtering out the footage a human would otherwise have to watch. In May 2026, the Army Secretary told the Senate the US military has no system that integrates drones, sensors, intelligence, and strike assets as effectively as DELTA.
  • The Pentagon carved out a dedicated $13.4 billion budget line for autonomy and AI in FY2026, the first time these capabilities got their own category. China and Russia are running the same play.

AI owns two quadrants of the loop now. That is AI compressing orient and decide from hours to minutes, or seconds. The act phase is still ours, for now. Ukraine runs that loop on commercial cloud infrastructure, and Germany is openly studying the model for its own forces. The tempo advantage is real, demonstrated, and dependent on server halls with commodity hardware in them.

Follow the electrons

So where does the orientation cycle physically run? In a data centre. Probably one of the new AI factories, sited next to cheap gas and a fat transmission line.

Increasingly, next to a reactor. Big Tech has moved from passive electricity customer to anchor investor. Oklo’s pipeline exceeds 14 GW, including a 1.2 GW project with Meta in Ohio and a master agreement with Switch for up to 12 GW. AWS restructured a 17-year, $18 billion PPA with Talen for up to 1,920 MW from the Susquehanna nuclear plant. The preferred deployment model is co-location: reactor behind the fence line, no transmission queue, capacity added a module at a time. When your orient and decide phases need 24/7 clean power, you buy the fuel cycle.

And then it goes deep down the supply chain. In August 2026, the President declared a national emergency over bulk-power equipment: transformers, batteries, and solar inverters predominantly manufactured abroad, much of it from a country officially listed as a foreign entity of concern. Experts auditing Chinese solar inverters have reported undocumented communication devices not present in any product documentation. The FCC has banned new foreign-made inverter models outright, and the European Commission’s Economic Security Doctrine flags Chinese inverters as a high-risk dependency.

Which means your decision advantage now depends on:

  • Grid stability, or reactor availability, at a handful of concentrated nodes.
  • Transformers, batteries, and inverters with multi-year lead times, manufactured predominantly in jurisdictions you cannot audit, and already deemed an “unusual and extraordinary threat” by executive order.
  • A compute layer adversaries can attack with the same seam-exploiting tradecraft they have used for a decade.

Your targeting model can sit in an American facility, drawing American power, conditioned by equipment with foreign firmware, foreign silicon, and an update path nobody on your side of the fence controls. Security clearance applies to the tenant. It stops at the transformer.

The Pentagon just spent 60 days rethinking CMMC because third-tier suppliers are the soft underbelly of the defence supply chain. Fine. But the orient and decide phases of the national OODA loop now run on infrastructure that, in most jurisdictions, has no formal critical infrastructure status. That is an open hatch.

Slow the adversary’s loop and you win. Let them slow yours, whether by knocking out a transformer, poisoning a training corpus, or flooding an inference endpoint, and you lose before the first shot. Tempo is the weapon. The tempo lives in a warehouse.

The regulators are circling, slowly

To be fair, someone noticed:

  • The UK designated data centres as critical national infrastructure in late 2024. The immediate side effect: a grid connection queue that ballooned from 41 GW to 125 GW between Nov 2024 and Jun 2025, with 73 GW of it speculative phantom projects gaming the queue (WIRED). CNI status has consequences, and not all of them are good.
  • In the US, Executive Order 14318 treats AI data centres with over 100 MW of load as strategic infrastructure and speeds up permitting: transmission lines, pipelines, semiconductors, the lot. Good intention. Familiar pattern.
  • DHS rolled out ANCHOR-CI in July, and former CISA risk-management chief Bob Kolasky predicts OpenAI, Anthropic, and data centre operators will eventually be formally designated as critical infrastructure sectors (CyberScoop, Aug 2026). Eventually. Meanwhile China is compressing its own loop and we are still arguing about the org chart.

Same story as CMMC: right instinct, slow execution. Boyd’s whole point was that speed of iteration beats perfection of plan. Our regulatory cycle is losing to everyone’s decision cycle.

Designation is the easy part. Everything after is the hard part

Calling a data centre critical infrastructure is a press release. Working out what that means is where it gets complicated. These are privately-owned, commercially-operated, globally-interconnected facilities that host a slice of the national decision cycle. Five complications without clean answers.

1. Dual-use is not what it was at the refinery

Dual-use infrastructure is old news. A refinery makes jet fuel and heating oil. A substation feeds a base and a bakery from the same bus. So what is new here? Everything, structurally.

Electricity is a fungible commodity. A megawatt is a megawatt, and the military’s dependency on the grid is a dependency on quantity and availability. AI inference is a non-fungible cognitive function. The military depends on a specific model, trained on specific data, running specific software. If that model degrades, you cannot substitute another megawatt. The critical asset is not the building’s output. It is the logical artefact running inside it.

A refinery swaps crude slates and changes product mix, but it is still a refinery. An AI facility’s product is mutable software that changes daily. The critical function can move between racks, buildings, or clouds without anything physically relocating. There is no refinery equivalent of weights that fit on a USB stick and walk out a door.

Then the failure mode. Grid and refinery failures announce themselves. The lights go out. The critical failure mode in AI compute is integrity: silent poisoning, subtly degraded recommendations. Availability you can monitor. Integrity of an opaque model is genuinely hard to verify, and an adversary corrupting the orient phase stays invisible until the loop closes badly.

Finally, ownership. Utilities are regulated monopolies with duty-to-serve obligations, interconnection rules, and reliability standards baked into their licence. Hyperscalers and model providers owe you none of that. Commerce does not sign a tariff.

Traditional dual-use means many consumers of a uniform output. Here it means the military’s mission function and consumer services executing on the same mutable, privately-controlled software stack. There is no precedent for protecting that.

2. The clearance boundary is a fiction

CMMC spent years arguing about which tier-3 subcontractor touches controlled unclassified information. Meanwhile the physical substrate the kill chain runs on looks like this:

  • Over 80 percent of global solar module manufacturing and more than 95 percent of wafer production sits in China, per industry estimates through mid-2026.
  • Grid-scale transformers carry multi-year lead times and a concentrated manufacturing base. The August 2026 emergency declaration treats foreign supply of bulk-power equipment as a national security threat precisely because there is no fast domestic alternative.
  • The Texas Senate held hearings this spring on exactly this question, and the witnesses’ honest answer was sobering: no documented cases of foreign-controlled grid parts being weaponised, but software connectivity and remote access remain open doors nobody can fully audit.

So the defence establishment that suspended CMMC to rethink supply chain assurance is simultaneously moving its decision cycle onto compute infrastructure whose power conditioning, cooling, and network gear originate partly from adversarial jurisdictions. Data centre designation that audits the rack and ignores the substation is security theatre with a fence drawn in the wrong place. You certify what you can inspect, and you can only inspect what you can reach.

3. Sovereignty and concentration

Critical infrastructure has traditionally been domestically owned and geographically bounded. AI compute is neither. Frontier models train on globally distributed infrastructure, weights move across borders in seconds, and the semiconductor supply chain underneath runs through fabs, advanced packaging, and memory production that are not American. The NRC handled this for advanced nuclear by writing a new technology-neutral framework, 10 CFR Part 53. Nobody has written the equivalent for frontier compute, and the pace problem is worse: regulatory cycles measure in years, model capability cycles in months.

Also concentration. The UK’s grid-queue experience, 41 GW to 125 GW in seven months with most of it speculative, is what happens when critical infrastructure becomes an investment vehicle. Designation itself reshapes markets, and not always in the directions regulators intended.

4. Targeting, attribution, and the grey zone

Once a facility is formally critical to the national kill chain, its status under international law changes, and the adversary’s calculus simplifies. Why contest an F-35 when you can degrade the inference endpoint? Cloud Hopper proved nation-states go through the seams of trusted relationships: software supply chains, firmware, the HVAC vendor. Critical-infrastructure designation without matching operational hardening is a list of targets you have politely labelled for them.

5. Liability nobody wants to hold

If a compromised model weight poisons a targeting recommendation, who owns the liability? The model provider, the cloud operator, the integrator, or the officer who approved the strike? Designation implies protection obligations, but it assigns no accountability for failure. Until it does, every participant in that chain has an incentive to assume somebody else holds the risk. In the defence-industrial base, that assumption has historically been wrong in expensive ways.

What designation should actually mean

Not a certificate on a wall. We have seen how that film ends. Outcome-based requirements:

  • Segment the control plane. Model training, inference for operations, and admin infrastructure should not share a blast radius.
  • Hardened baselines for the facilities hosting operational AI. Boring tech, verified. The things that would have stopped BUCKSHOT YANKEE, not a checklist audit.
  • Supply chain scrutiny on grid equipment and accelerators alike, down to the inverter firmware. A country-of-origin sticker tells you nothing about whether the dependency chain is safe, and the bulk-power emergency declaration is the government admitting it out loud. NERC has been saying it for years.
  • Redundancy requirements. If your orientation loop has a single physical home, you have built a centre of gravity and printed its coordinates.

We learned the doctrine decades ago. Compliance theatre is not security. Verify your critical systems the way you would verify a wingman’s instruments: continuously, and assuming they are lying to you.

Bottom line

If a drone recommends a target and the recommendation comes out of a rack in Virginia, that rack is part of the weapon system. Act like it.

The kill chain and the critical-infrastructure list are converging on the same buildings. Getting those buildings onto the list is straightforward politics. Making the list mean anything, ownership, obligation, liability, protection, is the actual work, and none of it is solved. I don’t have a good answer. The question keeps me up at night, and it should keep you up too.

Sources: Military Times · New York Times · Ukrinform · CyberScoop · WIRED · Bulletin of the Atomic Scientists · Politico · Utility Dive · Jerusalem Post / Reuters · SolarQuarter · GovTech