Sunday, 6 September 2026
European property investors have traditionally assessed infrastructure through physical factors such as electricity supply, transport connections, water networks and telecommunications. As buildings, transactions and public services become increasingly dependent on interconnected digital systems, another consideration is moving closer to the investment agenda: whether the technology supporting an asset and its surrounding infrastructure can continue operating when cyber defences fail.
Artificial intelligence is accelerating that change. A recent Deloitte analysis argues that increasingly capable AI tools are reducing the expertise and resources required to conduct sophisticated cyber operations. Tasks that once depended heavily on scarce specialist knowledge can increasingly be performed faster and at greater scale. For governments and operators of essential infrastructure, the consequence is a shift in emphasis from trying to prevent every intrusion towards deciding which systems are most critical, limiting the spread of successful attacks and restoring services rapidly when disruption occurs.
The implications extend beyond government IT departments. Modern property markets depend on digital systems for land registration, planning approvals, taxation, utility connections and numerous other administrative functions. Buildings themselves increasingly incorporate connected technology controlling heating, ventilation, energy consumption, security, access, lighting and other operational functions.
Recent European incidents demonstrate how vulnerabilities in this digital infrastructure can move directly into the property market. Romania’s National Agency for Cadastre and Real Estate Publicity was hit by a cyberattack in July 2026 that affected systems supporting property registration. According to CERT-EU, the incident disrupted real estate transactions nationally and left websites and applications unavailable for approximately a week. The attackers reportedly gained access using valid credentials before deleting data after an unsuccessful extortion attempt.
Slovakia experienced a similar problem in January 2025 when a cyberattack forced the country’s cadastral authority to shut down its information systems and temporarily disrupted services at land-registry offices. Because cadastral systems are required to register changes in ownership and other property rights, the incident demonstrated how technology normally treated as administrative infrastructure can become part of the mechanism determining whether transactions can proceed.
The Slovak Supreme Audit Office subsequently identified wider structural weaknesses in the country’s cadastral technology environment, including multiple systems that were not sufficiently integrated and included older infrastructure. Its findings connected the efficiency and reliability of land-registration services with the functioning of the real estate market and investment environment.
These incidents illustrate an emerging risk for investors. A building does not have to suffer physical damage for its liquidity or operation to be affected by a cyber incident. If the digital systems supporting ownership registration, permits, financing, utilities or municipal services become unavailable, the consequences can reach transactions and development activity.
The European Union’s regulatory response is moving in the same direction. NIS2 establishes cybersecurity requirements across 18 critical sectors, including energy, transport, drinking water, wastewater, digital infrastructure and public administration. Medium-sized and larger organisations falling within covered sectors are generally required to introduce cybersecurity risk-management measures and report significant incidents.
The directive also pushes responsibility further into corporate leadership. Cybersecurity is no longer intended to sit exclusively within technology departments, with management bodies given responsibilities concerning cybersecurity risk measures. Deloitte reaches a similar conclusion, arguing that resilience increasingly requires leadership to coordinate funding, operational priorities, accountability and recovery rather than treating cybersecurity purely as a technical function.
For the property industry, however, an important distinction is necessary. NIS2 does not automatically place ordinary office buildings, shopping centres, warehouses or residential developments within its scope simply because they use digital technology. Coverage depends on the organisation and activity concerned. Its indirect significance for real estate may nevertheless be substantial.
Data centres depend on electricity and telecommunications networks. Logistics facilities rely on transport and communications infrastructure. Industrial properties require electricity, water and increasingly sophisticated digital networks. Hospitals, laboratories and other specialist properties operate within sectors where service continuity can be critical. A property’s infrastructure exposure can therefore extend well beyond its site boundary.
Europe’s regulatory framework is still evolving. Member states were required to transpose NIS2 into national legislation by October 2024, but implementation has not been uniform. This creates an additional challenge for companies operating property and infrastructure portfolios across several European jurisdictions, where the practical regulatory environment can differ despite the common EU framework.
Buildings themselves represent another part of the equation. Commercial property has undergone extensive digitalisation as owners pursue lower energy consumption, improved tenant experience and more efficient building management. Heating and cooling equipment, access controls, sensors, security installations, energy-management platforms and other systems can now communicate across internal networks or with external services.
The commercial benefits are considerable, but greater connectivity can also create additional routes through which an attacker could potentially reach operational systems. The relevant property question is therefore becoming broader than whether corporate information is protected. Investors and operators may also need to understand what happens to the building when an important digital system is compromised or unavailable.
Deloitte argues that organisations should increasingly design around the possibility that some attacks will succeed. That involves isolating important systems, preventing attackers from moving easily between networks, maintaining reliable recovery arrangements and regularly testing whether essential services can be restored.
This approach has obvious parallels with traditional property resilience. Developers already provide backup generators for important buildings, multiple telecommunications connections for data centres and alternative systems where uninterrupted operations are commercially essential. Cyber resilience potentially extends the same philosophy into the digital architecture controlling those assets.
The European Cyber Resilience Act adds another dimension by introducing security requirements for many hardware and software products containing digital elements. Together with NIS2 and other EU initiatives, it indicates a regulatory movement towards treating cybersecurity throughout the technology lifecycle rather than relying solely on organisations to defend products after installation.
The technology supply chain is becoming equally important. Modern buildings can contain systems supplied, operated, updated and remotely accessed by numerous outside companies. Consequently, the resilience of an asset can depend not only on the property owner’s own cybersecurity arrangements but also on contractors, software suppliers, cloud services, building-management providers and equipment manufacturers.
Artificial intelligence increases the urgency without necessarily creating the underlying problem. There is not yet sufficient evidence to conclude that European commercial property is experiencing widespread AI-directed attacks against building systems. The more significant development is that AI can make established cyber techniques faster and more accessible while buildings and infrastructure continue to become more digitally dependent.
This combination could eventually influence property due diligence. Technical assessments before acquisitions normally examine structure, mechanical and electrical systems, maintenance requirements, environmental performance and expected capital expenditure. For complex digitally operated properties, investors may increasingly want to understand the condition of building-management technology as well.
That could include how critical operational systems are separated from wider networks, which third parties can access them, whether software continues to receive security support, how data and systems are backed up and how quickly essential functions can be restored following disruption.
Infrastructure due diligence could expand in a similar direction. Data-centre investors already examine grid redundancy and telecommunications connectivity closely. Logistics investors assess motorway access and transport infrastructure. Industrial investors consider electricity availability, water and other utilities. The resilience of the digital systems controlling or supporting those networks could gradually become another component of location risk.
It would be premature to suggest that buildings with stronger cybersecurity already command higher rents, lower yields or measurable valuation premiums across Europe. There is currently insufficient market evidence for such a conclusion. The more immediate consequences concern continuity of operations, transaction execution and future capital expenditure.
The attacks on Romanian and Slovak cadastral infrastructure show that disruption outside a property’s physical boundary can still affect the functioning of the property market. Cybersecurity is therefore beginning to resemble other infrastructure risks faced by real estate. Investors cannot eliminate the possibility of electricity failures, transport disruption or extreme weather, but they can assess exposure and determine whether appropriate resilience exists.
As AI reduces the cost of sophisticated cyber capabilities and European property becomes increasingly connected, the same principle may have to be applied to digital infrastructure. The next stage of property resilience may depend not only on whether buildings can withstand physical disruption, but also on whether the technology connecting buildings, utilities and public services can continue functioning and recover quickly when it cannot.
