What it is
The Rules Data Centers Answer To
Governance, risk and compliance covers the laws, certifications and board-level risks a data center operator manages.
- Grid rules: the fastest-moving area. Texas, FERC, Ohio and Virginia all set new rules for large loads in 2025 and 2026.
- Certifications: customers expect SOC 2 and ISO 27001; government work needs FedRAMP, now moving to the faster FedRAMP 20x; AI work increasingly asks for ISO 42001.
- AI rules: the EU AI Act's general-purpose AI obligations apply since August 2025; its high-risk deadlines were pushed to 2027 and 2028.
- Insurance: average insured project values rose from about $150 million to $3 billion in five years (Zurich); insurance covers perhaps a third to half of a campus's value, and a frontier AI campus can top $50 billion (Aon).
Flagship
Texas SB 6: The First Large-Load Law
- Scope: signed June 2025, it covers new loads of 75 MW or more on the ERCOT grid.
- Disclosure: applicants must reveal duplicate requests elsewhere in Texas and any on-site backup generation able to carry half their demand; site control and money come before a study.
- Emergencies: ERCOT can order loads with backup generation to curtail; non-critical new large loads are curtailed during firm load shed.
- Costs: the draft PUCT rule sets a $300,000 study fee above 250 MW and $50,000 per MW of security, $50 million for a 1 GW site.
- Audit: in August 2026 Governor Abbott ordered an audit of the queue, which held 474.7 GW, 420.8 GW of it data centers. See AustinIO on ERCOT large-load interconnection.
Rules
Laws, Orders and Standards
| Rule | What it requires | Status |
|---|---|---|
| Texas SB 6 | Loads of 75 MW+: disclosure, emergency curtailment, cost recovery; PUCT rule by end of 2026 | Enacted June 2025; rule proposed |
| FERC large-load orders | Six show-cause orders to grid operators for loads of 50 MW+; tariff filings due August 2026 | Issued June 2026 |
| FERC PJM co-location order | New services for loads sited at power plants, including non-firm service without capacity charges | Issued December 2025 |
| AEP Ohio data center tariff | New data centers pay for at least 85% of contracted demand for up to 12 years; pipeline fell from 30+ GW to ~13 GW | Approved July 2025 |
| Virginia | Site assessments before local approval; water reporting; governor's order ending by-right approval above 25 MW | 2026 session; order September 2026 |
| EU AI Act | General-purpose AI rules since August 2025; high-risk deadlines moved to 2027-2028 | In force |
| FedRAMP 20x | Faster federal cloud authorizations; new rules mandatory January 2027 | Rolling out |
| ISO/IEC 27001 and 42001 | Information security and AI management certifications | Voluntary |
| Uptime Tiers and TIA-942 | Design and operations ratings for data center resilience | Voluntary |
Record
Dataset Record
- Dataset
- Data center laws, grid orders, certifications and insurance
- Sources
- Texas Legislature, PUCT, POWER Magazine, Greenberg Traurig, FERC via Willkie and Mayer Brown, PUCO, Beveridge & Diamond, Virginia Business, Lewis Silkin, Zurich, S&P, Swiss Re, Aon via ENR
- Last verified
- October 2026