AI infrastructure is expanding across a world increasingly divided over how the technology should be regulated. For data center developers and operators, that fragmentation introduces a challenge beyond securing power, deploying compute, and bringing facilities online: ensuring that the resulting infrastructure can support workloads governed by different legal, security, and contractual requirements.

The scale of the buildout makes these distinctions increasingly consequential. According to the International Energy Agency, global data center electricity demand rose 17% in 2025, while consumption at AI-focused facilities increased 50%. The agency projects total data center electricity consumption will reach roughly 950 terawatt-hours (TWh) by 2030, nearly double its 2025 level of 485 TWh. Even so, grid constraints, equipment shortages, chip availability, and financing challenges threaten to delay projects, leaving substantial uncertainty over how much announced capacity will actually reach service.

At the same time, the regulatory environment is becoming more complex rather than more uniform. The European Union is implementing binding AI rules, the United States is pursuing policies to accelerate domestic infrastructure development, and competing international initiatives are taking shape around AI governance and supply-chain security. Although these measures impose very different obligations, their combined effect is to make verifiable operating controls, clear contractual responsibilities, and jurisdiction-specific requirements increasingly important in delivering AI infrastructure.

U.S. Policy Meets Local Development Constraints

In the United States, the Trump administration has made faster data center development a federal policy goal. Its AI Action Plan calls for accelerated infrastructure permitting, a grid prepared to support AI growth, and more secure facilities for sensitive military, government, and intelligence workloads. A July 2025 executive order, Accelerating Federal Permitting of Data Center Infrastructure, gives federal agencies a more specific assignment: identify ways to expedite reviews and support qualifying data center projects and their supporting infrastructure. Under the order, projects can qualify through several routes, including committed capital expenditures of at least $500 million or an incremental electrical load greater than 100 MW.

The order directs agencies to examine environmental review procedures, consider eligible projects for federal permitting schedules, and identify suitable federal land. It also covers supporting infrastructure such as transmission lines, substations, transformers, and switchgear, extending the permitting initiative beyond the data center campus to the electrical systems needed to serve it. These measures create opportunities to accelerate federal reviews, but do not eliminate other applicable approvals or guarantee that a project can proceed.

The White House's Ratepayer Protection Pledge, introduced in March 2026, addresses another constraint: who pays for the electricity and grid infrastructure required by large data centers. Participating companies committed to build, bring, or buy the power needed for their facilities, cover required delivery upgrades, and negotiate separate rate structures under which they pay for electricity and infrastructure brought online to serve them, even if actual consumption falls below projections. The pledge remains voluntary, with its practical effect dependent on agreements among developers, utilities, and state authorities.

Congress has pursued related legislation. On September 16, the House passed the Ratepayer Protection Act by a 417–3 vote, although the measure subsequently failed to advance in the Senate on September 30. If enacted, the legislation would require state utility regulators to consider standards for assigning the incremental costs of generation, transmission, and distribution upgrades to large-load customers. It would not require states to adopt those standards. The distinction underscores how much responsibility for translating federal energy policy into enforceable arrangements still resides with state regulators and utilities.

A separate December 11, 2025 executive order, Ensuring a National Policy Framework for Artificial Intelligence, targeted the growing patchwork of state AI regulations. It directed the Justice Department to establish an AI Litigation Task Force to challenge state AI laws the administration considers inconsistent with federal policy, while calling for a legislative proposal establishing a more uniform national framework. Significantly for data center developers, the order specified that such legislation should not preempt otherwise lawful state laws concerning AI compute and data center infrastructure, except for generally applicable permitting reforms.

That exception preserves an important distinction between regulating AI systems and approving the physical infrastructure that supports them. Even if Congress eventually adopts a more uniform federal approach to AI governance, state and local authorities would continue to play consequential roles in determining where facilities can be built and under what conditions.

Meanwhile, the administration has moved to address broader concerns surrounding AI development. After proposing an "AI Force" in September, Trump formally announced the Super Intelligence Force on October 4, naming Director of National Intelligence Jay Clayton to lead an interagency task force that includes Federal Trade Commission Chairman Andrew Ferguson and senior defense and personnel officials. The group held its initial meeting on October 15 and is intended to coordinate federal engagement with AI companies, critical infrastructure providers, and other stakeholders.

The task force represents a more defined federal initiative than the September proposal, although its formation has not established a new permitting procedure or mechanism for resolving opposition to individual data center projects. Its work is focused more broadly on AI governance, risks, and the application of existing laws.

The administration has also acknowledged the growing political importance of local opposition over electricity costs, land use, and water consumption. On October 21, Trump proposed that companies building data centers provide financial dividends to host communities, arguing that negotiated community benefits could make otherwise unpopular projects more acceptable. He also reiterated his position that large new facilities should provide their own electricity and make surplus power available to the grid or surrounding communities. How these statements will translate into enforceable requirements remains unclear.

For developers, these federal measures affect different decisions in the site-development process. The permitting order offers qualifying projects a potential route toward faster federal review of campuses and supporting infrastructure. The Ratepayer Protection Pledge puts electricity procurement and grid-upgrade costs into negotiations with utilities and states. The administration's newer initiatives acknowledge that community acceptance has become another consequential constraint on infrastructure expansion.

None of these measures, however, makes a contested site automatically developable. As illustrated by Virginia's changing data center development rules, the intersection of utility costs, permitting authority, and local opposition is already reshaping project economics. Federal support may help advance a project, but cannot substitute for local approvals, credible power arrangements, or community engagement. Developers still need to assess objections involving land, water, electricity rates, and environmental impacts before making major commitments to a location.

Global Policy Shifts

Internationally, AI governance is developing through several institutions at once, with increasingly divergent approaches to regulation, economic security, and international cooperation. The European Union has established enforceable obligations for covered AI systems, while the United Nations is building mechanisms for scientific assessment and policy dialogue. At the same time, the United States and China are advancing separate international initiatives that reflect competing priorities for AI infrastructure, supply chains, and technology governance.

These developments can be divided into four principal areas:

• European Union's AI Act: The EU's risk-based framework applies to providers and deployers of covered AI systems, with obligations for general-purpose AI models taking effect in August 2025 and many additional provisions becoming applicable in August 2026. Subsequent amendments under the AI Omnibus extended the application dates for certain high-risk systems, including specified critical-infrastructure uses, to December 2, 2027, and for AI embedded in specified regulated products to August 2, 2028. A data center does not become a high-risk AI system merely because it hosts AI workloads. Developers and operators must instead determine whether their own AI applications are covered and what infrastructure-related information their tenants may require to demonstrate compliance.

• United Nations' scientific panel and Global Dialogue on AI Governance: The UN General Assembly established both mechanisms in August 2025, with the Global Dialogue first convening in Geneva in July 2026. The scientific panel provides independent assessments of AI's capabilities, risks, and impacts, while the dialogue brings governments and other stakeholders together to discuss subjects including AI safety, access to compute, and cooperation among national regulatory approaches. Neither body establishes or enforces requirements for data centers, although their work could inform future national policies and international standards.

• United States' Pax Silica: This State Department initiative brings international partners together around secure AI supply chains, including semiconductors, critical minerals, energy, networking, and data center infrastructure. Pax Silica reached 24 signatories in June 2026, reflecting growing interest in coordinated investment and trusted technology ecosystems. For developers, its immediate significance lies in the participating governments' priorities for infrastructure security, supply-chain resilience, and investment partnerships rather than a new set of binding facility regulations.

• China's World Artificial Intelligence Cooperation Organization: China and 28 other countries signed the founding agreement for the World Artificial Intelligence Cooperation Organization (WAICO) in July 2026. Headquartered in Shanghai, the organization aims to coordinate international AI development and governance, with particular emphasis on international cooperation and broader access to AI technology. It has not established binding technical or operating standards for data centers. Developers considering investments in participating countries therefore have another emerging policy institution to monitor, rather than a defined WAICO compliance regime requiring immediate design changes.

The differences among these approaches became particularly visible during September's UN Security Council discussion of AI governance. OpenAI CEO Sam Altman and Anthropic CEO Dario Amodei joined other technology leaders in urging greater international cooperation and safeguards as increasingly capable AI systems create new security and operational risks. U.S. representatives, however, opposed centralized international AI governance, emphasizing national authority and technological competitiveness.

Subsequent diplomacy demonstrated that rivalry does not necessarily preclude limited cooperation. During President Xi Jinping's September visit to Washington, the United States and China announced a bilateral Super Intelligence Dialogue to exchange views on AI-related risks and benefits, along with a communication channel for AI incidents. Those arrangements provide a mechanism for engagement, but do not establish a common regulatory framework for AI infrastructure or the systems it supports.

For data center developers and operators, the distinction between binding legislation and international policy initiatives is essential. An enacted regulation may affect how a tenant deploys an AI system today, while a supply-chain declaration or governance forum may influence investment decisions, procurement requirements, and future standards without directly imposing new obligations on a facility.

Operators therefore need to plan around applicable laws and existing contractual requirements rather than assume that international diplomacy will eventually produce a single operating standard. As AI infrastructure becomes more geographically distributed, the ability to accommodate different regulatory and commercial expectations will become an increasingly important part of infrastructure planning.

Designing for Verifiable Operations

For an operator serving tenants across jurisdictions, a claim about where a workload runs must be one that the responsible service provider can substantiate. That means identifying who can administer the workload, how data moves between regions, where backups are maintained, and which records document those arrangements.

A tenant promising to run a workload within a particular jurisdiction needs assurance that its data, backups, and access arrangements satisfy the applicable requirements. Workload placement alone cannot establish where a backup resides or from where an administrator can access a system. Those questions must be addressed across compute, storage, network paths, security controls, and third-party access, with responsibilities established during procurement and verified before service begins.

Not all of those controls necessarily reside with the data center operator. A colocation provider may be responsible for physical access, facility security, and designated infrastructure services, while a tenant or cloud provider controls the applications, storage configuration, backup locations, and logical access to workloads. The operating agreement must distinguish between what the facility provider can verify directly and what remains within the tenant's systems.

The EU AI Act makes that division of responsibility particularly important. Its requirements for covered high-risk AI systems include logging, documentation, human oversight, robustness, and cybersecurity, subject to the law's applicable implementation dates. These obligations attach to the relevant providers and deployers of AI systems, rather than automatically to every company hosting them. A data center operator may nevertheless be required by contract to provide physical-access records, security evidence, or information about infrastructure location so that a tenant can substantiate its own compliance.

A further distinction concerns data residency. The AI Act is not itself a general requirement to keep all AI workloads or associated data within the European Union. Geographic restrictions may instead arise from data-protection law, national-security requirements, sector-specific regulations, or customer agreements. For infrastructure providers, the practical requirement is to identify the applicable obligations and establish which party has the technical means and contractual responsibility to satisfy them. The distinction is already visible in Microsoft's parallel development of sovereign cloud regions and AI factory campuses, which addresses different customer requirements for localized data handling, compliance, and large-scale computing.

Consider a colocation operator supporting a European financial-services tenant deploying a regulated AI application. Depending on the workload and applicable requirements, the tenant may need documented controls over data location, privileged access, backup arrangements, and maintenance activity. The operator could be responsible for facility-access records and physical security evidence, while the tenant remains responsible for its AI application, data handling, and logical access controls.

In that situation, neither party benefits from a service agreement that simply promises compliance without identifying the systems and records needed to demonstrate it. The contract needs to specify which controls apply, who operates them, who retains the associated evidence, and how the information can be retrieved for an audit or regulatory inquiry.

The same principle applies to backups and third-party maintenance access. A contractual restriction on location or access is meaningful only if the underlying operating configuration supports it. If a tenant requires evidence of privileged access, the parties need to establish which systems generate the records, who maintains them, and whether they can be produced when required.

Rules for general-purpose AI models create another point of contact with the physical facility. Under Article 55 of the EU AI Act, providers of general-purpose AI models posing systemic risk must ensure an adequate level of cybersecurity protection for both the model and its physical infrastructure. A tenant providing such a model may consequently request evidence from its data center operator concerning physical access, security procedures, or incidents affecting the environment where the model operates.

Those requests do not transfer the model provider's statutory obligations to the data center. They do, however, create operational expectations that can influence facility contracts, security documentation, and the procedures required to support regulated customers.

For operators, this is where fragmented AI governance becomes a practical infrastructure challenge. Regulatory obligations may originate with the tenant or model provider, but the evidence needed to satisfy them can depend on physical facilities, network arrangements, operational procedures, and the capabilities of third-party service providers.

Establishing these boundaries before deployment can reduce uncertainty over compliance, improve accountability, and prevent disagreements when customers or regulators request evidence of how a workload has been operated.

Capacity That Can Be Delivered

The competitive question raised by U.S.–China AI rivalry is ultimately an execution question for infrastructure teams. At September's PTC’DC gathering in Reston, Virginia, industry discussions emphasized the importance of investment in compute, power, and secure infrastructure to maintaining U.S. competitiveness. The subsequent UN debate and bilateral diplomacy illustrate another dimension of that challenge: the need to operate capacity across an increasingly fragmented international policy landscape.

As demonstrated at the 2026 Open Compute Project Global Summit, delivering AI capacity increasingly requires coordinated engineering across computing, networking, power, cooling, security, and infrastructure operations.

For developers, the definition of deliverable capacity is consequently becoming more demanding. Securing electrical service, installing equipment, and commissioning a facility remain fundamental milestones. But customers operating across multiple jurisdictions may also need documented assurances about security controls, workload location, access responsibilities, and the division of compliance obligations between themselves and their infrastructure providers. 

These requirements do not necessarily call for entirely different physical data center designs in every jurisdiction. They do call for greater precision in specifying the controls a facility can support, the evidence its operator can produce, and the contractual boundaries governing the services delivered.

A facility's operational responsibilities do not end when its racks are energized. Tenants need to understand which controls the operator maintains, which records it can provide, and where responsibility for the AI system remains with them. Developers that define those boundaries in design specifications and service agreements can bring capacity to market with fewer unanswered questions about how it will be operated across jurisdictions.

Ultimately, the projects best positioned to advance will be those that can demonstrate both physical and operational readiness: a credible energization sequence, funded grid upgrades, engineered power and cooling at the intended IT load, documented infrastructure controls, and clear responsibility for security and compliance.

As the global AI buildout accelerates, the ability to deliver usable compute will increasingly depend not only on how quickly infrastructure can be constructed, but on whether its operation can be documented, supported, and verified under the requirements of the markets it serves.

At Data Center Frontier, we talk the industry talk and walk the industry walk. In that spirit, DCF Staff members may occasionally use AI tools to assist with content. 

Keep pace with the fast-moving world of data centers and cloud computing by connecting with Data Center Frontier on LinkedIn, following us on X/Twitter and Facebook, as well as on BlueSky, and signing up for our weekly newsletters using the form below.