Constructing the digital future: Legal challenges in data centre projects

The energy challenge

Delivering data centre projects on time and within budget requires a robust approach to procurement and contract administration, much like any other construction project. However, data centre projects face unique challenges, particularly regarding power limitations.

The immense power demand of data centres is a significant obstacle for developers. Whilst capacities are starting to exceed 100 MW, energy supply in leading markets like Singapore continue to remain constrained. The lengthy timelines for bringing new supplies online and grid infrastructure upgrades often conflict with the aggressive construction schedules required for many data centre projects, making site procurement a significant project risk.

Power reliability is another major concern. Every minute of outage can cause severe disruptions for users, so having a reliable power supply and avoiding a single point of failure is critical. The Uptime Standards – performance criteria which classify data centres by these measures – have become a key point of differentiation. As a result, these standards often underpin the design and performance requirements of projects.  Nevertheless, non-compliance with design and construction standards remains a common cause of outages, the financial and reputational impacts of which can be severe for developers, and which can, in turn, lead to significant disputes.

Procurement challenges

Whilst concerns about energy consumption and the need for reliability are not new, these issues are more pressing than ever as demand continues to outstrip supply. This makes it essential to clearly define contractual risk allocation, requiring careful consideration depending on the procurement model used.

In this regard, the choice of procurement model, and related contractual arrangements, will depend on a range of factors including the nature of the client (eg, colocation v hyperscale), preferred technology as well as the scale or any constraints of its supply chain. There is no one-size-fits all approach, although complex and large-scale projects developed by established players are more likely to involve a disaggregated model, with the client retaining more control and coordination risk compared to alternatives such as a single point Engineering, Procurement and Construction or Design and Build only models.

When using a disaggregated procurement model, contractual 'gap risk' can emerge across the various design, supply, construction and commissioning contracts if they are not fully aligned, such as on matters relating to design and performance criteria. This risk is particularly relevant on data centre projects using an OFCI (or owner furnished contractor installed) model, where integrating key owner-supplied plant and equipment into the contractor's works involves a high degree of coordination between different parties. Further, interfacing various contract packages brings about programming challenges, making it imperative to allocate time-related risks and provide, if possible, for appropriate remedies on a 'back-to-back' basis with any upstream revenue contracts.

These inflationary pressures have placed contractors in a difficult position as they now face significantly higher costs to complete the same scope of work, and will no doubt be looking to relief from developers.

Regulatory uncertainties

Issues such as the geographical location of data centre facilities and whose data they are processing add further layers of complexity. Given the strategic importance of data centres, an increasing number of national governments are legislating for data centres, with some recent developments potentially impacting the feasibility of such projects and, in turn, giving rise to risk of related claims.

For instance, the UK has designated data centres as critical national infrastructure, which means that operators can now expect greater government support in relation to critical incidents (such as cyberattacks or extreme weather events). Whilst it remains to be seen whether the UK will further classify data centres as Operators of Essential Services (OES) under the Information Systems Regulations 2018, such designation could become fertile ground for change in law claims from operations & maintenance contractors, as data centre operators come under further financial strain in complying with the mandatory risk management obligations placed on OES.

Similar trends can be seen in other markets. In Singapore, the Ministry of Communications and Information has announced plans to introduce a new Digital Infrastructure Act (DIA). While the DIA is currently a work in progress, it is intended to address a broader set of resilience risks beyond cybersecurity, including technical misconfigurations and physical hazards such as fire and cooling system failures. Similarly, in the UAE, a first intergovernmental meeting took place in February 2025 to explore the impact of data centres on the local energy sector, triggering a discussion around regulating these facilities as part of national infrastructure planning.  

Conclusion

Although the number of data centres is expected to continue to increase to meet the growing global demand for digital services, investors in this industry face a major task in ensuring their investments remain adequately protected. The challenges around energy and supply chains are expected to persist, and regulatory changes seem inevitable, particularly in light of geopolitical tensions, environmental pressures and concerns about cyber security and the safety of data centre infrastructure.