The Rules Expire. The Data Centers Keep Coming.

On September 30, 2026, the only federal law that sets cybersecurity and sustainability standards for new federal data centers expires with no replacement. The Trump administration is redirecting AI oversight toward a 30-day voluntary review by the same companies building the models. Gallup found 7 in 10 Americans oppose local data centers. The AI boom is outrunning the regulatory frame.

State of Surveillance Editorial Team

Rows of black server racks stretching down a darkened data center hall, with the small status LEDs of the equipment glowing in the low ambient light
Photo via Unsplash

TL;DR: The Federal Data Center Enhancement Act (FDCEA) of 2023, the only federal law that set cybersecurity and sustainability standards for new federal data centers, expires September 30, 2026 with no replacement in the pipeline. A GSA employee told reporters: "Never in the history of data center policies has a policy expired without another one having been painstakingly worked on for three years behind the scenes."[1][2] The Trump administration has redirected AI oversight toward a voluntary framework that gives frontier model companies access to the federal government 30 days before wider release. CAISI, the renamed Center for AI Standards and Innovation, has been told to pause its public reports on AI model reviews while the new executive order is implemented.[1] A Gallup survey from March 2026 found 7 in 10 Americans oppose constructing data centers for AI in their local area, including 48% who are strongly opposed.[1] The data center is the substrate of the AI surveillance economy. The rule book for the substrate is expiring, and the replacement is being written by the companies building it.

What the FDCEA Actually Did

The Federal Data Center Enhancement Act was passed in late 2023 as Title X of the National Defense Authorization Act for Fiscal Year 2024. Its job was small and concrete: any federal agency planning to build a new data center, or to undertake a major upgrade of an existing one, had to arrange an assessment by a certified data center energy-efficiency specialist, and had to consider energy and water use in the design before committing funds.[1][3]

It also set baseline cybersecurity standards for federal data centers, including the contractor-operated ones. That made the law the only federal-level rule that pulled federal AI infrastructure into a single compliance frame, however thin.[3]

The Office of Management and Budget implemented the law as a precondition for appropriated funds. An agency that wanted to put a new federal data center on the books had to file the assessment first. It was not a heavy regulatory regime. It was the floor. The floor expires September 30.[1]

The September 30 Cliff

Sunset clauses are normal in federal law. The unusual part of the FDCEA expiration is the absence of a successor. The norm, for two decades of federal data center policy, has been a multi-year successor bill worked quietly through the Office of Management and Budget, the General Services Administration, and Congressional appropriators before the old law's clock runs out.[1]

A GSA employee, speaking to reporters, put the break with precedent bluntly: "Never in the history of data center policies has a policy expired without another one having been painstakingly worked on for three years behind the scenes."[1]

What the cliff means in practice is also concrete. Without the FDCEA in force, there is no statutory requirement that a new federal data center be assessed for energy and water use before construction. There is no single federal baseline for the cybersecurity of contractor-operated federal data centers. Each agency falls back on its own internal procurement rules, which vary widely and which historically lag the threat landscape by years.[1]

For the AI build-out, the timing is bad. Federal data center capacity is the substrate for the AI models that the same administration has named, in a separate court filing, as "vital national security infrastructure." More on that tie-back in a moment.

CAISI's Pause and the 30-Day Voluntary Review

The Center for AI Standards and Innovation, the renamed AI Safety Institute that lives inside the National Institute of Standards and Technology, is the federal body that ran pre-deployment model reviews for the largest US AI labs. CAISI was the closest thing the federal government had to an AI review board. It is not the EU AI Office. It was a public-report venue, not a binding approval gate.[4]

The Trump administration has directed CAISI to pause its public reports on AI model reviews while the new AI executive order is implemented. The new framework is voluntary, and the central feature is a 30-day pre-release window: frontier model companies give the federal government access to their latest models up to 30 days before the wider public release, framed as a way to "strengthen the cybersecurity of critical infrastructure."[1][5]

Read the trade carefully. The old public report was a one-way disclosure: the lab gave the government a model, the government published a public review. The new framework is two-way, undisclosed: the lab gives the government early access, the government does not publish a public review, and the 30-day window creates an information asymmetry in the government's favor. The lab still ships. The government still gets the keys early. The public report, the part that gave journalists, researchers, and downstream users a way to see what the model does, is the part that disappears.[1][5]

The cybersecurity-of-critical-infrastructure framing is the tell. The same framing recurs in the Trump administration's defense of the DOJ's "vital national security" argument for keeping xAI's unpermitted gas turbines running at Colossus 2 in Southaven, Mississippi. In that filing, the Department of Justice told a federal court that xAI's Grok is one of four AI models "supporting mission-critical operations across Secret and Top-Secret classified networks," and that forcing the data center offline would "directly threaten ongoing national security interests."[6]

The argument is being assembled in public court filings and executive orders at the same time. Data centers are critical infrastructure. AI models are critical infrastructure. The companies that build and run them are partners. The regulatory frame that constrained the build-out is expiring. The public reports that audited the models are being paused. The replacement is a handshake.

7 in 10 Americans, 48% Strongly Opposed

The local politics of data centers are not subtle. A Gallup survey from March 2026 found that 7 in 10 Americans oppose constructing data centers for AI in their local area. Forty-eight percent are strongly opposed. The intensity of the opposition is the part that campaigns and zoning boards notice, because "strongly opposed" is the cohort that shows up at planning meetings.[1][7]

Local opposition has a track record of forcing changes. Berkeley delayed a Flock Safety drone and fixed-camera surveillance vote in March 2026 over the privacy implications, then shelved the contract in June after the mayor broke with the public-safety framing. Mountain View and Santa Clara have banned Flock outright. Multiple states are passing ALPR warrant requirements and surveillance pricing bans.[8][9]

The data center build-out is a different scale. A hyperscale data center draws the electricity of a small city and the water of a mid-sized farm. The community-level impacts (water tables, electricity prices, noise from cooling fans, the property-tax deals that pull revenue out of public schools) are not the same as a single pole-mounted ALPR. The opposition is the same kind of opposition, but the lever is local zoning, state environmental review, and the state public utilities commissions.[1]

The Gallup number is the structural ceiling on the AI build-out. The administration is not running a popularity contest on data centers, but the agencies that have to permit the new builds, the state public utility commissions that have to approve the transmission, and the county water boards that have to grant the consumptive use, all read the same polling.

The Surveillance Beat Read

The reason this story lands on the surveillance beat, instead of the energy beat or the technology beat, is the substrate argument. Every system that the State of Surveillance catalog tracks, ICE location surveillance, Palantir-powered deportation targeting, the facial recognition vendors that ship to local police, the AI assistants that process patient health records, the data brokers that sell location history to anyone with a purchase order, runs on data centers. The model is the brain. The data center is the body. Expiring the rules that govern the body means the brain runs without a frame.[10][6]

The same week the FDCEA expiration hit the news, the DOJ was in federal court in Mississippi arguing that xAI's Colossus 2 data center is too important to be touched by the Clean Air Act, on national-security grounds. A separate DoD declaration said the military used Grok Gov in recent strikes against Iran. The argument is that the AI infrastructure is itself a strategic asset, and the courts should not slow the build-out.[6]

Amazon announced a multi-billion-dollar data center in Missouri in the same news cycle. The number carries the same pattern: more data centers, more electrical load, more water demand, less of the rule book that constrained the old build-out.[1][11]

The Anthropic Fable 5 export-control story sits in the same news cycle, and the contradiction is on the surface. The federal government is telling one AI lab that its models are too dangerous to ship to China, and telling another AI lab that its data center is too important to regulate. Both arguments are built on the same premise: AI is the substrate of national power, and the substrate is not to be slowed.[12]

What This Means and What You Can Do

The federal regulatory frame for AI data centers is collapsing into a handshake. The September 30 expiration is the technical moment. The CAISI pause on public reports is the transparency moment. The DOJ's "vital national security" framing is the litigation moment. None of these moments fixes itself.

Three things you can do that are not symbolic:

  • Show up at the state public utility commission. Data centers need transmission approval, and state PUCs are the venue where the build-out is contested. Comments on rate cases, integrated resource plans, and data center siting dockets are the place where the energy and water cost of the build-out shows up as a number on a page. Find your state PUC's open docket list and subscribe.
  • Track the local zoning fight. The Gallup 7-in-10 number is the structural ceiling. Local zoning boards, county planning commissions, and municipal water boards are where that ceiling is enforced. The same communities that killed Flock contracts in Mountain View and Santa Clara are now looking at data center site plans. Show up.
  • Push for state-level data center standards. The federal frame is expiring. The state frame is the next layer. States have authority over siting, water appropriations, energy procurement, and (in many cases) data privacy. A state-level data center impact disclosure law is a tractable, modelable ask. The Surveillance Pricing Tracker and the State Privacy Legislation Tracker are the templates for state-level structural reform.

The 30-day voluntary framework is not the AI policy reform anyone asked for. It is the AI policy reform the AI labs asked for, written by an administration that has named the same labs as critical-infrastructure partners in federal court. The data flowing through the data centers is the data flowing through the surveillance economy. The rule book for the data centers is the rule book for the surveillance economy. The rule book is expiring.

References

  1. Gizmodo - US Government Reportedly Allowing Federal Data Center Rules to Expire (Bruce Gil, June 15, 2026)
  2. Hacker News - US Government Reportedly Allowing Federal Data Center Rules to Expire (37 points, 7 comments, June 15, 2026)
  3. Congress.gov - H.R.5646 Federal Data Center Enhancement Act of 2023 (118th Congress)
  4. NIST AI Risk Management Framework (nist.gov)
  5. The White House - Executive Order on Artificial Intelligence (the new voluntary framework, the 30-day pre-release access window)
  6. The DOJ Just Called Grok 'Vital' National Security Infrastructure (State of Surveillance, June 16, 2026)
  7. Gallup - Americans Oppose AI Data Centers in Their Local Area (March 2026)
  8. Berkeley Flock Vote Delayed Mayor Opposes Surveillance June 2026 (State of Surveillance)
  9. Silicon Valley Bans Flock Mountain View Santa Clara 2026 (State of Surveillance)
  10. Pentagon Commercial Location Data Troops Targeted Adtech National Security 2026 (State of Surveillance)
  11. Amazon Announces Multibillion Dollar Data Center in Missouri (Narracomm, June 16, 2026)
  12. Anthropic Fable 5 Mythos 5 Suspended US Export Control 2026 (State of Surveillance)