Clifford Chance

Regulations targeted primarily at AI and high-end semiconductors impact the data centres which provide AI infrastructure. On 13 January 2025, the US Department of Commerce's Bureau of Industry and Security issued the Framework for Artificial Intelligence Diffusion, an interim final rule designed to safeguard US national security while promoting the responsible sharing of AI benefits with partner countries through expanding export controls on advanced AI chips and raising security standards.  The Framework categorises countries into three tiers with different access rights and security requirements for importing advanced AI chips and certain AI model weights. The Framework imposes relative shares and absolute caps on the number of AI chips that companies can export to each country, depending on whether they are Tier 1, 2, or 3 (Tier 3 being the most restrictive). By increasing the baseline of security standards at AI data centres, the Framework aims to ensure that the model weights of the most advanced AI models are stored outside the US only under stringent security conditions. The Framework stands to drive the construction of clusters of advanced integrated circuits in destinations that are considered to pose lower risks of diversion or misuse. Despite the rescission of many Biden-era AI orders, the Trump administration has retained the Framework, although has indicated that it may be reviewed and amended

Several jurisdictions require foreign direct investment clearances for investments in data centres. For example, the express inclusion of data processing and storage as "critical infrastructure" under the EU Framework  Regulation for the Screening of Foreign Direct Investments means that transactions involving data centres can often fall within the scope of national FDI regimes in EU Member States. The US has taken various measures to regulate investment flows concerning the development of critical technologies and critical infrastructure, with significant implications for data centres. Namely, the Committee on Foreign Investment in the United States (CFIUS) has recently sharpened its review stance, with the Department of Treasury issuing two Final Rules in November 2024 that expand CFIUS's real estate jurisdiction and civil enforcement powers. Foreign investors must duly consider whether transactions involving data centres (which often house high-end semiconductors necessary for advanced AI) trigger a mandatory filing or would benefit from voluntary disclosure to CFIUS – or risk a transaction later being called in for review. In May 2024, the Biden administration issued the first CFIUS real estate-related block, compelling the divestment of a cryptomining data centre near a US military base. Signalling a continued enforcement focus, on 21 February 2025, the Trump administration announced its America First Investment Policy. The Policy sets forth an agenda designed to attract investment in frontier US AI infrastructure from allies while simultaneously pursuing CFIUS reform to restrict foreign adversary access to critical US technologies, infrastructure and sensitive data, with particular focus on AI. The Policy also contemplates expanding the Outbound Investment Security Program, a new regime administered by Treasury (effective as of 2 January 2025) that regulates outbound US investment into the quantum computing, AI, and semiconductor sectors of "countries of concern." (For more information, see our publications: Framework for Artificial Intelligence Diffusion: A Step Forward for US Security and Economic Strength in the Age of AI and Streamlining Foreign Investment and CFIUS Processes: What You Need to Know.)

With data centres considered critical infrastructure in many jurisdictions, and a global trend toward strengthened cybersecurity and operational resilience regimes, data centre operators are navigating additional legal requirements regarding cyber governance, business continuity planning, incident handling, reporting to regulators and customers, and, in some cases, registration obligations. The European Union's Network and Information Systems (NIS) regime applies to data centres as in-scope digital infrastructure, and laws around the world, such as the proposed Hong Kong Protection of Critical Infrastructures (Computer Systems) Bill, increasingly impose legal obligations concerning security management. In the US, Biden EO 14141 – discussed above and so far retained by the Trump administration – directs agencies to generate cybersecurity measures for all leased federal sites to frontier AI data centres. Earlier this year China's Ministry of Industry and Information Technology issued a Notice on Strengthening the Security Protection of Clients' Data by Internet Data Centres – adding to the increasing number of laws, regulations, notices and guidance across the world that can apply to the safeguarding of data processed by data centres. In addition, cybersecurity regulations impacting other industries can in turn affect the contractual terms that customers seek to negotiate into their agreements with data centre operators.

Operators and customers remain focused on sustainability of power sources and efficiency of operation. In particular, hyperscalers (still) stick to their sustainability criteria and major data centre operators to their sustainability commitments. In the EU, the current measures promoting energy efficiency (including the Green Industrial Deal and the Energy Efficiency Directive) and requirements for regular reporting on key performance indicators (KPIs) for sustainability (in particular, the Corporate Sustainability Reporting Directive) are widely expected to lead to more requirements prescribing sustainability targets. This has already been adopted by Germany, where the Energy Efficiency Directive has been transposed to require data centres to source 50% of their energy from renewable energy sources, to be increased to 100% from 2027. In the US, even absent an overarching regulatory driver, many technology companies, such as Digital Reality and Equinix, have committed to powering their data centres with 100% renewable energy, while others, such as Amazon and GE Vernova, have announced their intent to electrify data centres and reduce carbon emissions. Parts of APAC are also encouraging improved data centre efficiency, including in Singapore through the Infocomm Media Development Authority  Green Data Centre Standard. In China, energy transition for data centres has been strongly advocated, exemplified by the Special Action Plan for Green and Low-Carbon Development of Data Centres. Additionally, China has implemented measures to enhance the disclosure of sustainability KPIs, with all three securities exchanges issuing their own guidelines on corporate sustainability reporting.

In some jurisdictions, arrangements to connect to the grid are highly regulated and can be time-consuming and cumbersome. To ensure timely connection, developers are prioritising these arrangements in the overall schedule, resulting in a "twin track" procurement structure of the grid connection works with the wider data centre campus construction arrangements, which requires close coordination. Power availability represents a key competitive advantage for data centre operators, who are increasingly exploring private power solutions. These solutions often involve sourcing electricity directly from various power providers through power purchase agreements (PPAs), allowing operators to secure a more reliable and potentially more cost-effective energy supply. By diversifying their energy sources, data centres can mitigate the risks associated with power shortages and fluctuating energy prices, thereby enhancing their operational resilience. PPAs are also essential in securing renewable energy to displace fossil fuels on the grid, a key part of data centres’ carbon reduction strategies. However, in many regions, including the US, there are stringent regulations governing the generation and distribution of electricity, which must be carefully considered when structuring such agreements. 

The attractiveness of data centres as an asset class has led to new types of investors entering the fray in recent years, including private equity, real estate funds and other financial investors. This important development has injected additional competition for prize assets. While the volume of deals led by financial investors continues to grow, strategic investors remain amongst the biggest player on the data centre deal-making scene – a recent study by TMT Finance found that strategic buys accounted for 69% of data centre transactions in 2024. 

Partnerships between utilities companies and data centre owners and operators have become increasingly common in the US and this trend is expected to expand globally. 

The "DeepSeek moment" in early 2025, when Chinese AI start-up DeepSeek unveiled a generative AI model that appeared to achieve similar results to leading large language models for a much-reduced dollar and computing power cost, had a dramatic impact on the valuation of many leading tech companies. Deep Seek's breakthrough challenged the prevailing assumptions that bigger and better AI means more computing power, which had been a key driver for data centre expansion since the beginning of the generative AI boom. The sustainability of data centre capacity expansion is ultimately determined by the growth in demand for computing power, and as the technology develops, dealmakers need to be mindful that assumptions can shift regarding how AI works and how power-hungry it may prove to be. Some investors are looking at holistic ways of ensuring sustainability in data centre investments, such as financing renewable power projects for the data centres or investing in energy storage technology.