What pharma should be doing now

For five days this series has been a diagnosis. $660 billion of hyperscaler capex, six chokepoints in the chip supply chain, a grid that was not built for this load, gas turbines sold out through 2030, nuclear deals that mostly do not deliver before then, and an Irish regulator who has effectively redrawn the bargain between digital infrastructure and the European state.

The diagnosis is the easy part. The harder question for any pharma or life sciences board is what changes in the operating model when compute, power, water, and regulation stop being separate problems.

Five things, in the order they tend to surface.

One. The 2024 unit economics no longer hold

Most pharma AI business cases on board agendas this year were built between mid-2024 and early 2025. They assumed cost per token would continue falling, GPU availability would broaden, vendor competition would discipline pricing, and renewable matching would handle the carbon footprint. None of those assumptions survives contact with the 2026 picture.

HBM prices are up roughly 20% year on year. CoWoS advanced packaging is sold out through mid-2026. Gas turbines carry $25 million non-refundable reservation fees for 2030 delivery slots. Dominion Energy's data centre rate class will charge hyperscalers for 85% of contracted distribution and transmission capacity from January 2027 regardless of utilisation. The CRU's Irish framework requires data centre developers to fund their own dispatchable generation and contract their own additional renewables. All of these costs eventually find the customer.

The implication is straightforward. Any AI deployment plan still using last year's cost-per-inference benchmark is overstating the return and understating the cliff. The number to model in 2026 is not what your provider charges now; it is what they will need to charge in 2027 and 2028 to recover the infrastructure they are building this year.

Two. Compute residency is the next regulatory layer, not the previous one

For ten years the European pharma data conversation has been about data residency. Where is the patient record stored, where is the trial data hosted, what does GDPR require, what does the EU AI Act require. That conversation is mature.

The next layer is compute residency. Which physical data centre runs the training, which grid powers it, which fuel mix sits behind the grid, and which jurisdiction can compel access to it. The Cloud and AI Development Act, now scheduled for Q4 2027 under the Joint Roadmap signed by the Commission, Parliament, and Council on 23 April 2026, will eventually create a "highly critical use cases" category that requires EU-anchored compute. Pharma R&D, manufacturing operational technology, pharmacovigilance, and regulated commercial workloads are all candidates for that category.

The strategic question is not whether to wait for CADA. It is whether to design the next-generation hub-and-spoke compute architecture now, with EU-anchored capacity for regulated workloads and global capacity for everything else, or to be retrofitting it under legislative pressure in 2028. The cost differential is meaningful, and the firms that move first will have first call on the limited EU-region capacity that genuinely qualifies.

Three. CSRD location-based reporting is going to surface the cloud carbon problem

The Corporate Sustainability Reporting Directive is the binding instrument that links AI infrastructure to the boardroom. Companies in scope must report Scope 1, 2, and 3 emissions using both location-based and market-based methodologies. The location-based number is the actual grid mix where the workload runs. The market-based number is what the hyperscaler claims through its renewable PPA portfolio.

The cloud carbon disclosure tools available in 2026 do not yet meet a CSRD-aligned auditor's standard. Microsoft's Azure tool publishes both methodologies, which is the right answer. AWS and Oracle predominantly publish only market-based. Google publishes location-based but with carbon-free energy percentages rather than direct gCO2/kWh values. None of the tools currently provide auditable Scope 3 visibility into upstream electricity, embedded chip carbon, or the actual data centre cooling overhead.

For a pharma firm that will report under CSRD from FY2025 financial year onwards, this gap becomes material in the 2027 reporting cycle. The procurement function, the IT function, and the sustainability function need to be in the same conversation now, with vendor reporting requirements baked into the next round of cloud contracts. The firms that wait will end up restating.

Four. Vendor concentration risk is now a physical risk, not a commercial one

The standard cloud vendor risk register treats Azure, AWS, and GCP as substitutable, with effort. Move the workload, accept the migration cost, hedge the price negotiation. That model worked when capacity was elastic.

In 2026 it does not. The HBM is allocated to specific customers through 2026. CoWoS slots are committed. The 2nm wafers are spoken for. Gas turbine reservations are sold out through 2030. Dominion's GS-5 rate class locks 85% of contracted capacity. The Irish CRU framework anchors generation to import.

What this means in practice: the GPUs your hyperscaler runs your workload on today will not exist at scale anywhere else for at least eighteen months. Vendor switching is not a 2026 option for AI workloads at material scale, regardless of what your contract says. The risk register that treats this as a commercial migration is wrong. The actual risk is physical, and the mitigation is portfolio: workload allocation across providers from the start, not the right to move them later.

Five. The boardroom needs different people in the room

The cleanest summary of this series is that AI infrastructure decisions in 2026 are infrastructure decisions, not technology decisions. The expertise the pharma board now needs in the room when these decisions are made looks different from the expertise it called on in 2023.

The data scientist understands the model. The procurement lead understands the vendor contract. Neither understands the grid, the supply chain, the EED reporting cycle, the CRU connection policy, the CSRD location-based methodology, or the gas turbine queue. Until recently they did not need to. They now do.

The functions best placed to make these connected decisions are the ones that already understand industrial infrastructure: people who have run regulated operations under multiple jurisdictions, who are fluent in compliance regimes, who have negotiated capital projects, who understand sustainability reporting as a board obligation rather than a marketing exercise. The pharma sector has these people. They are usually not the ones currently leading the AI conversation.

That is the operating model question this series ends on. AI deployment in pharma over the next five years will be a multi-disciplinary infrastructure project, not a technology project. The firms that recognise this first will deploy faster, with sharper unit economics, with cleaner CSRD reporting, and with less risk of getting caught when the next chokepoint surfaces. The firms that treat it as a continuation of the 2024 conversation will be slower, more expensive, and more exposed.

The numbers in this series will move. Hyperscaler capex will rise or fall, the grid will adjust, gas will give way to nuclear at some point in the 2030s, the CRU framework will be tested in implementation, the CADA will eventually be tabled. The structural argument I am less sure will move. AI is now industrial. The boardroom that runs it should be too.

That closes the series. Six articles, one connected diagnosis. If the picture lands differently for your organisation than what I have described, I would genuinely like to hear it.