Authored by Catherine Banet, CERRE Academic Director and University of Oslo
Rapid growth
The data centre market has experienced exponential growth over the past decade. In Europe, this expansion is primarily driven by artificial intelligence (AI) and cloud demand, met by both hyperscaler self-build – the fastest-growing segment – and colocation, which remains larger and is increasingly used by hyperscalers and neoclouds. According to CBRE, total market capacity is expected to reach 13 GW by the end of 2026, representing a 20% increase on 2025. New contracts for AI-focused European colocation data centre capacity more than quadrupled in the first half of 2026. The European Data Centre Association (EUDCA) forecasts cumulative investment of €176 billion between 2026 and 2031. Growth prospects are also strong as reasoning models and large language models (LLMs) continue to develop.
Data centres as critical infrastructure
Medium- and large-sized data centres (DCs) are treated as critical infrastructure, providing the physical and technical infrastructure for services on which society and an increasingly digitalised economy depend. This role is acknowledged by the inclusion of DCs in the scope of the NIS2 Directive on cybersecurity. The NIS2 Directive identifies data-centre service providers as entities in a sector of high criticality; qualifying providers are generally classified as “essential entities”. The definition of data centres in NIS2 also makes clear that their critical function extends from data storage in servers to all the facilities and infrastructure for power distribution and environmental control. Data centres are, however, not automatically considered “critical entities” under the Critical Entities Resilience Directive, and whether DCs receive that designation depends on national implementation and the sectoral role they perform. Finally, the Regulation on Digital Operational Resilience for the Financial Sector (DORA) applies to financial entities and can cover data centre and cloud operators where they provide ICT services to the financial sector.
Data centres are important for digital sovereignty and sovereign AI. Where data is stored, processed and transmitted, who operates the underlying infrastructure, and which legal and technical dependencies a country accepts are all core factors that countries are likely to regulate.
Most countries have developed national data centre strategies to support the growth and strategic role of the sector. The EU also aims to at least triple its data centre capacity over the next five to seven years to strengthen digital sovereignty and technological independence (AI Continent Action Plan). However, the growth of data centres presents common challenges across jurisdictions.
Common challenges, common response?
High electricity prices, long grid-connection queues, environmental and ESG requirements, including water use, access to land, and growing local opposition have slowed the expansion of data centres in key “FLAP-D” markets, such as Amsterdam, Frankfurt and Dublin. In response, the industry has been expanding into “beyond FLAP-D” markets, such as the Nordics and regions around Warsaw, Madrid, Milan, Rome, and Vienna, which offer favourable conditions for access to land, grid capacity and fibre connectivity. Despite this re-orientation of expansion potential, the development of data centres faces many of the same challenges everywhere. When not harmonised at EU or EEA level, however, regulatory responses have diverged.
Alternative regulatory approaches to data centres: decision factors
As with other industries and technologies, the need to regulate arises from the many benefits, interests and concerns associated with unconstrained growth in data centres. Here too, the objective should not be to halt all development, but to find the right balance between regulatory obligations and incentives, i.e. sticks and carrots. This requires prior agreement on the desired vision for the industry and its outcomes.
A core question to start with is whether the regulation of data centres should follow a technology- and industry-neutral approach. Many of the issues arising from data centre activities are subject to permitting procedures that apply across sectors. This is the case, for example, with access to land, environmental pollution, grid connection, cybersecurity, data protection, waste heat re-use, and contribution to flexibility. Instead of designing a separate permitting regime solely for data centres, it may be easier and more efficient to introduce specific criteria into existing permitting procedures. An advantage of this approach is that competent authorities are already in place to ensure compliance.
Another preliminary question is the extent to which data centre development should be steered through planning tools or left to market forces, subject to permitting criteria. So far, there has not been any detailed planning of data centre development. The closest approach is the promotion of clustering.
When setting requirements, they should serve a clear purpose and be imposed in a targeted manner. Regulation has so far focused primarily on disclosure requirements, but individual EU Member States are starting to adopt tighter requirements in an uncoordinated manner. A relevant question is where harmonisation is needed in Europe to protect common interests relating to the internal market, competitiveness and security. Value creation at national and local level is often mentioned as a key political objective, and may form part of the broader policy vision. The question is what forms of value data centres should be required to deliver. If the objective is local employment and infrastructure, this can be part of permitting requirements set at national level and of local land-use planning regimes, usually under the competence of municipalities. If the objective is to capture economic value from data centres, as with other economic activities, taxation and fees are probably more suitable tools. For the public sector, public procurement rules are an obvious choice. Incentive-based regulation could also efficiently steer value creation in the desired direction.
If national or European ownership is deemed necessary, there should be clarity about what is to be owned, why ownership is required, and which entity is targeted. A blanket approach to ownership could be counter-productive, as foreign investment and expertise are still essential to the development of the data centre industry. The data centre industry involves multiple actors, including developers, operators, enterprise customers and suppliers. Here again, a targeted approach seems more appropriate, such as through data-localisation rules (data must remain in-country or in-region); cloud certification, under which a provider is required to be EU- or nationally controlled; foreign-investment screening; and notification of ownership in critical infrastructure.
Despite a growing trend towards regulatory oversight, there is still a lack of a coherent regulatory model for data centres in Europe. Countries are currently proceeding in an uncoordinated manner. The combined objectives of sustainability, competitiveness, data sovereignty and security call for a more advanced model than those adopted by European countries to date. Member States should remain responsible for shaping national data centre requirements, but sharing best practices and harmonising legislation where needed would help to establish a minimum common regulatory framework for data centre development in Europe, given its strategic importance. The EU appears to be moving in this direction with the proposed Cloud and AI Development Act, aiming to establish data-centre acceleration zones and defining four assurance levels of Cloud and AI sovereignty, the rating scheme for data centres to promote transparency in DC markets and the public consultation on minimum performance standards to harmonise criteria applied by Member States. All these initiatives, at both national and EU levels, should be evaluated against the decision factors highlighted above.
