UII UPDATE 328 | JANUARY 2025
In October 2024, Uptime Intelligence noted a trend for governments to classify data centers as critical national infrastructure (CNI), recognizing that their services are vital at all times, particularly in the aftermath of major incidents such as earthquakes, fires and floods.
The reasons for this are clear. Due to growing dependence on IT, data center failures can ripple through the financial, transportation and government systems, causing widespread chaos. By designating data centers as CNI, governments can provide support during crises. In the future, they could also set conditions designed to prevent failures — or to pursue other objectives.
At the same time, governments view data centers as drivers of economic growth, particularly in the current boom for AI infrastructure. They want to foster strong national data center markets in an increasingly competitive global landscape; CNI status is one way to channel public sector support into the industry.
While CNI status is expected to deliver favorable access to power and land, government support rarely comes without some conditions.
Data center operators receiving government support, even if informal, will increasingly be expected to make a significant contribution to the economy, operate with greater transparency, and comply with specific regulations, particularly those concerning resiliency and sustainability.
Some countries, such as the UK and Germany, have explicitly designated data centers as CNI, while others, such as the US, “implicitly” include certain data centers because they are essential to CNI-listed services such as telecommunications and finance. Singapore has also expanded the scope of its Cybersecurity Act to cover more data centers in its critical information infrastructure designation.
In some countries, CNI plans include communication services that rely on data centers.
Governments around the world are strongly supporting AI, hoping to improve public services, drive economic growth and create new jobs. Some are achieving this through direct investment and sovereign wealth funds, while others are providing support through specific measures, such as the following:
Once a data center is designated as CNI, the operator will be subject to increased transparency requirements to provide government with the information needed to effectively include facilities in national contingency plans. For instance, planners might need to know the criticality of IT workloads at a facility to assess its priority for electricity or fuel during power cuts.
Measures to ensure the security and resiliency of infrastructure are already being stepped up around the world. For instance, the EU addresses cybersecurity risks with its Networks and Information Systems (NIS) Directive — data centers were added to the updated version, NIS 2, passed in early 2023 (see Are data centers on top of NIS 2 cyber compliance?). The adoption of NIS 2 or equivalent measures in other countries, such as the forthcoming Cyber Security and Resilience Bill in the UK, means data centers will be subject to a regulator with powers to investigate, inspect and test facilities.
Other resiliency mandates include the Digital Operational Resilience Act (DORA), which applies to financial institutions in the EU.
In the US, some regulations are set to emerge as part of state-level sustainability and planning measures. For example, the proposed New York State Sustainable Data Centers Act would require data center operators to power their facilities with a share of renewable energy in line with the state’s climate goals and subsidize any extra energy costs to the community. The bill also proposes that construction of a facility should be preceded by at least two public hearings. Meanwhile, in Virginia, multiple bills are being discussed to address a range of data center issues, including planning, siting, on-site generation and tax incentives.
The precise meaning and implications of CNI or similar status vary by country and are often not disclosed to the public. Early experiences with data collection for the EU’s European Energy Directive have shown that some operators are uncomfortable sharing information. Large cloud service providers, in particular, protect their operational data as business confidential and have argued that releasing it would conflict with existing privacy agreements.
Increased government support is likely to result in stronger design and operation requirements for data centers, such as the use of sustainable power or participation in grid regulation mechanisms. These measures may be difficult or expensive to implement, especially in regions where grids are constrained.
For example, in the US, plans for world-leading AI campuses mandate that they are powered by clean power (or that fossil fuels with carbon capture). Additionally, the operators of these campuses must finance the necessary power infrastructure, and AI providers are required to apply “high labor standards and safeguards.” However, any change in government — in this case, from Biden to Trump — might present new challenges for investors and operators, such as a shift in design requirements that could have a huge cost implication.
Tighter regulations for data centers are an inevitable companion to a more strategic role in national infrastructure and economies. The goal is to ensure a secure, reliable and sustainable foundation for important national services. Data center operators should be prepared to engage constructively with governments to demonstrate their ability to meet the requirements of CNI and to harness the benefits that come with this status.
Other related reports published by Uptime Institute include:
Critical national infrastructure status: what does it mean?