For two years the governance conversation about AI has centred on models: what they can do, what they may be used for, who is accountable when they fail. Through 2026 a second regulatory front has opened underneath that debate, aimed not at the models but at the buildings they run in. Data centre regulation is no longer an energy-sector niche. It is becoming part of the compliance surface of any organisation that trains, hosts or heavily consumes AI at scale, and the rules now differ sharply by continent.
The picture at a glance
| Jurisdiction | Instrument | Status | Core obligations |
|---|---|---|---|
| Germany | Energy Efficiency Act (EnEfG) | In force (amendment drafted) | Binding PUE caps, waste heat reuse, 100% renewables from 2027, annual publication, fines to 100,000 euros |
| European Union | Energy Efficiency Directive (EU) 2023/1791 | In force, transposition patchy | Annual energy performance reporting to national authorities and the European Database on Data Centres |
| Australia | Australian Standards for AI (announced) | Announced 15 Jul 2026, bill expected early 2027 | Underwrite own new power supply, pay full connection costs, demand response, water efficiency |
| United States (federal) | Ratepayer Protection Pledge | Voluntary (4 Mar 2026) | Seven signatories commit to covering the cost of new generation their demand creates; no legal enforcement |
| United States (states) | Large-load tariff and ratepayer laws | Enacted in several states, 27 considering | Cost allocation to data centres, special rate classes, water and energy disclosure, local moratoria pressure |
Germany: the strictest law actually in force
Germany's Energy Efficiency Act (Energieeffizienzgesetz, EnEfG) is the sharpest instrument in the field and the one most likely to surprise AI teams whose infrastructure footprint touches German soil. It applies to data centres with a non-redundant rated connection capacity of 300 kW or more, which captures commercial colocation and enterprise facilities well below hyperscale.
The obligations are specific and dated. Facilities that began operating before 1 July 2026 must achieve an annual average power usage effectiveness (PUE) of 1.5 or better from 1 July 2027, tightening to 1.3 from 1 July 2030. Facilities commissioned from 1 July 2026 must reach a PUE of 1.2 within two years of commissioning, and must reuse a minimum share of their waste heat: 10 per cent from July 2026, 15 per cent from July 2027, 20 per cent from July 2028. Electricity had to be 50 per cent renewable from January 2024 and must be 100 per cent renewable from 1 January 2027. Operators had to establish an energy or environmental management system with continuous measurement by 1 July 2025, certified from January 2026 for larger sites, and must publish key energy information for the previous calendar year by 31 March each year. Violations carry fines of up to 100,000 euros.
One moving part deserves attention. On 9 April 2026 the Federal Ministry for Economic Affairs and Energy published a draft amendment that would ease the caps for existing facilities (1.5 to 1.6 from 2027, 1.3 to 1.4 from 2030) and lift the new-build target from 1.2 to 1.3, partly in response to the practical difficulty of retrofitting older stock. The draft is not law. Until it passes, the current thresholds stand, and organisations should plan against the law as written rather than the relief as proposed.
The EU layer: reporting first, standards next
Above the national laws sits the recast Energy Efficiency Directive, (EU) 2023/1791, which requires member states to compel data centres to report energy performance data annually: total and IT energy consumption, PUE, water usage, waste heat reuse and related indicators, feeding a European Database on Data Centres. The operational cadence that matters to operators is the 15 May annual reporting deadline covering the prior year.
Transposition has been slow. The implementation deadline of 10 October 2025 passed with most of the bloc behind, and the European Commission opened infringement proceedings against 26 member states, Germany among them, which is precisely why Berlin is fast-tracking its April 2026 amendment. For AI governance purposes the direction is clearer than the enforcement: the EU has decided that data centre energy performance is reportable, comparable, public-interest information, and the database creates a benchmark regulators and customers will both read.
Australia: from expectations to announced law
Australia moved in two steps. In March 2026 the government published five non-binding expectations of data centre and AI infrastructure developers covering national interest, the energy transition, water use, skills and local capability, operating through Commonwealth assessment prioritisation rather than regulation.
Then on 15 July 2026, in the Prime Minister's address announcing an Office of AI and a set of Australian Standards for AI to be legislated, the expectations hardened into announced binding rules for large data centres: a legal obligation to underwrite their own new power supply, to pay the full costs of grid connection, to reduce power consumption when required (demand response), and to meet water efficiency requirements. Legislation is expected early 2027. Until a bill is introduced the detail is announced policy rather than law, but the direction is explicit, and it aligns Australia with the cost-allocation logic already legislated in parts of the United States.
The United States: a voluntary pledge and a state-level wave
There is no binding federal data centre statute. What exists federally is the Ratepayer Protection Pledge of 4 March 2026, signed by Amazon, Google, Meta, Microsoft, OpenAI, Oracle and xAI, committing signatories to cover the full cost of the new electricity generation their demand requires. It has no legal enforcement mechanism, and federal attention concentrates on facilities above 100 MW, well above the size at which state and local concerns begin.
The binding action is in the states, and it is substantial. Oklahoma enacted the Data Center Customer Ratepayer Protection Act of 2026, requiring electric companies to create large-load tariffs that keep data centre costs from migrating to household bills, including stranded-cost recovery if a large customer departs. California, Ohio and Utah have enacted large-load laws of their own, South Carolina and Maryland legislated rate negotiation in 2025, Minnesota created a dedicated water permitting requirement for data centres, and 27 states are currently considering large-load legislation. Maine is positioned to become the first state to pause new construction outright, with a moratorium under consideration through November 2027, one of 21 moratorium bills filed in 2026.
The composition shift tells the story better than any single bill. In 2024, 58 per cent of state data centre bills were tax incentive measures; by 2026 that share had fallen to roughly 15 per cent, while transparency and disclosure bills rose from under 2 per cent to 25 per cent and water-use bills from 12 to 24 per cent. The era of subsidise-and-ask-nothing is over at the state level, whatever the federal posture.
What this means for AI governance teams
The practical consequence is that infrastructure has entered the AI risk register, in five specific places.
1. Vendor due diligence now has an energy chapter. If your AI runs on cloud or colocation capacity in Germany or elsewhere in the EU, your provider carries EnEfG and EED obligations whose failure modes (fines, forced efficiency works, publication of poor metrics) are your supply chain risk. Ask providers for their PUE, their reporting status and their renewables position; in the EU this data is increasingly reportable anyway.
2. Capacity planning inherits legal timing. German new builds from July 2026 carry the strictest efficiency envelope; Australian projects announced now must anticipate the early-2027 legislation; US projects face state-by-state tariff design. Model training runs and inference expansion planned years ahead should price these constraints in.
3. Water is a first-class metric. Water-use disclosure went from fringe to a quarter of US state bills in two years, Australia named water efficiency in its announced standards, and the EED reports water alongside energy. AI governance reporting that covers model risk but ignores water and energy exposure is describing a shrinking share of the actual risk.
4. Board reporting should connect the layers. A board that has just learned to ask about model inventories (as APRA now expects of Australian regulated entities) should also see the infrastructure dependency picture: which critical AI workloads run where, under which energy regimes, with what concentration risk.
5. The direction of travel is convergent. Three continents arrived from different politics at the same three instruments: efficiency standards, cost allocation to the operator, and disclosure. Organisations that instrument energy, water and efficiency data per workload now will meet each new jurisdiction with evidence in hand rather than a scramble.
Frequently asked questions
Does data centre regulation apply to companies that only use AI, not run it?
Not directly, in general: the obligations bind operators. But the exposure passes through contracts and concentration. If a critical operation depends on AI hosted in a facility that fails an efficiency deadline or a permitting fight, that is an operational risk for the customer, which is exactly how frameworks like APRA CPS 230 in Australia treat material service providers.
Is there a single global standard to align to?
No. The closest to a common denominator is the metric set the EU database uses (PUE, energy consumption, water, waste heat, renewables share). Instrumenting those per facility and per major workload covers the reporting logic of every regime described here.
Will the German caps really be enforced at current levels?
The April 2026 draft amendment proposes modest easing for existing facilities, and Germany is under EU infringement pressure to complete transposition, so change is likely in some form. Planning against the law as written (1.5 from July 2027 for existing sites) remains the defensible position until an amendment passes.
Sources
- White & Case, Data center requirements under the new German Energy Efficiency Act
- Orrick, German Energy Efficiency Act draft amendment (9 April 2026)
- Columbia Climate Law Blog, How Germany regulates data center energy use
- MultiState, State Data Center Policy 101 (2026)
- Tech Policy Press, Where state AI legislation stands halfway into 2026
- Prime Minister of Australia, AI in Australia's Interests (15 July 2026)
General information, not legal advice. Statuses were current at 21 July 2026; the German amendment, the Australian bill and multiple US state measures are in motion, so verify the instrument before relying on a threshold.
