Compliance, Certification & Governance

An AI data center earns nothing until someone is allowed to put a regulated workload on it. The chapters before this one decide whether the machine is secure. This one decides whether it is sellable: whether a bank, a hospital network, a defense prime, an EU regulator or a sovereign-AI program can lawfully place its data and models inside your walls. Compliance turns an engineering artifact into a commercial one, and its constraints reach back to siting, staffing and the wiring of your audit logs. The recurring error is to treat it as post-commissioning paperwork. The framework portfolio is an upstream decision, as upstream as the workload archetype in Chapter 1.1, because it dictates where data may reside, who may administer the silicon, and what evidence you must generate continuously from the day the first GPU is energized.

The chapter opens with the four framework layers: the commercial-trust baseline, the new AI-governance layer, the federal stack and the sector regimes, with what each certifies and what each costs. NERC CIP appears as a portfolio member, with a pointer to its engineering home. Next comes the case for compliance-as-code (OSCAL, FedRAMP's Key Security Indicators, continuous control monitoring) as the only model that survives at AI-factory scale, and the control crosswalk that lets one body of evidence satisfy many frameworks. The three parts that are hard at the physical layer close the chapter: audit logging at fleet scale, data residency and sovereignty, and the sector overlays that customers bring with them.

Compliance is not a ladder of SOC 2, then ISO, then FedRAMP, each a higher rung. It is four orthogonal layers, and a serious AI campus needs a chosen subset of each, driven by the union of its target customers' mandates. The commercial-trust baseline is what every B2B buyer expects. The AI-governance layer is brand new and rising fast. The federal/government stack gates public-sector revenue. The sector regimes ride along with regulated tenants. Each certifies a different thing, and confusing them is how operators over-spend on a stamp no customer asked for while missing the one that would have unlocked the contract.

SOC 2 (AICPA) is an attestation, not a certification. An independent auditor opines on whether controls against the common criteria for Security, plus any additional Trust Services categories scoped into the engagement, operated effectively. A Type II label alone does not establish availability, processing integrity, confidentiality or privacy coverage, so buyers must inspect the report's scope and system boundary. ISO/IEC 27001 is a true certification against a normative information-security-management-system (ISMS) standard, issued by an accredited body, valid three years with annual surveillance audits. It is the global lingua franca, expected by European and Asian buyers. The two overlap heavily in substance but differ in form: SOC 2 produces a detailed report a customer reads, ISO 27001 a certificate a customer trusts. Most operators serving a global market carry both, and the crosswalk between them is the first place compliance-as-code pays off.

The layer that did not exist three years ago is AI governance. ISO/IEC 42001:2023, the world's first certifiable AI-management-system standard, has become a common question in AI-vendor procurement. In the US, ANAB accredited the first ISO 42001 certification body in September 2024, so accredited certification has been on offer since then. The EU AI Act is the regulatory teeth. GPAI-model obligations became applicable on 2 August 2025, and the Commission's enforcement powers over GPAI providers applied from 2 August 2026. Article 101 caps those fines at €15 million or 3% of worldwide annual turnover, whichever is higher, alongside model-recall powers. The €35 million / 7% ceiling is Article 99's, for prohibited practices, and does not attach to GPAI supervision.

The 2026 simplification ("digital omnibus") package, Regulation (EU) 2026/1744 (published in the Official Journal on 24 July 2026, in force 27 July 2026), deferred the high-risk-system obligations: stand-alone (Annex III) systems comply from 2 December 2027, and AI embedded in regulated products from 2 August 2028 (European Commission; Council of the EU, 2026). GPAI models already on the market before 2 August 2025 have until 2 August 2027 to comply (Article 111(3) of the AI Act as consolidated on 27 July 2026). Article 50's transparency duties applied from 2 August 2026, and generative systems already on the market before that date must mark their output in machine-readable form by 2 December 2026. That marking duty is the one a model provider is most likely to flow down to an inference host by contract, alongside logging and traceability work. Determine whether the operator is an infrastructure host, model provider or system provider/deployer before assigning AI Act duties. ISO 42001 certification and infrastructure hosting alone establish neither the legal role nor conformity.

Use current editions for the assertion being bought. TIA-942-C, released in May 2024, is a data-center infrastructure standard that includes physical-security considerations. It does not certify weight confidentiality. ISO/IEC 27001:2022 with Amendment 1:2024 governs the scoped information-security management system, and the amendment addresses climate-action considerations, not a new AI security level. Keep the AI-management-system and AI Act role assessments separate.

The US federal layer is where compliance stops being a report and becomes a machine-readable, continuously validated obligation, and 2025–2026 is the inflection. FedRAMP 20x modernizes the federal cloud-authorization program and inverts the old model. The 20x Phase 2 pilot used 56 Low and 61 Moderate Key Security Indicators (KSIs); those are historical pilot counts. The pilots are over. FedRAMP's 20x page now shows Classes A, B (Low) and C (Moderate) as available, with finalized rules. Class D (High) is planned for Phase 4, around FY27. Rev5 closes to applications for new certifications on 11 June 2027, and FedRAMP says existing Rev5 offerings will get a transition path, still to be published (FedRAMP, 2026). Plan any new Low or Moderate package for 20x; Rev5 is an option only if you can file before that cutoff. High stays on Rev5 until Class D exists.

Both paths now require a Security Decision Record for Classes B–D, in human-readable and JSON form, and both have allowed optional adoption since 4 July 2026. The deadlines differ. Under the 2026 20x rules, the record also carries the KSI explanations, verification and validation; you need it to obtain a certification from 4 July 2026 and to maintain one from 1 January 2027. Under the 2026 Rev5 rule in the Consolidated Rules for 2026, you need it to obtain a certification from 1 January 2027 and to maintain one from 1 August 2027. On each path the grace period ends at the first independent assessment started after the maintain date. Automation supplies repeatable evidence; human explanations and independent assessment remain. If you intend to serve federal AI workloads, compliance-as-code is no longer a sophistication choice. It is the entry condition.

CMMC (Cybersecurity Maturity Model Certification) governs defense-industrial-base contractors handling Controlled Unclassified Information. The long rulemaking has closed: the 48 CFR final rule (DFARS Case 2019-D041) published 10 September 2025, and Phase 1 of the rollout began on that rule's 10 November 2025 effective date. The Phase 2 third-party-certification requirement, which would have made CMMC Level 2 mandatory for CUI-handling contracts from 10 November 2026, was suspended on 13 July 2026 for a 60-day review. DFARS Class Deviation 2026-O0025, Revision 3 (3 September 2026), carries the suspension into contracts. Requiring activities may now ask only for Level 1 or Level 2 self-assessments, so contracting officers remove or revise C3PAO and Level 3 requirements in active solicitations as soon as practicable, and in existing contracts by the next option exercise or scheduled administrative modification. The review window has run out, and as of mid-October 2026 no outcome had been published. Phase 1 self-assessment obligations remain in force, and the Level 3 and full-implementation milestones are paused with the suspension (DoD/DoW, 2025–2026).

For an AI campus chasing defense workloads, CMMC Level 2 means implementing the 110 NIST SP 800-171 Rev 2 requirements across systems that process, store or transmit CUI, and preserving evidence for the applicable assessment. US-person access restrictions come from contract terms or export controls. Physical separation is one way to scope the CUI environment, not a Level 2 mandate. Those choices ripple into staffing, network segmentation (Chapter 11.7) and tenant isolation (Chapter 11.6).

Read the rightmost column as the real cost. The audit fee is only part of the design burden each framework imposes, and the burdens do not add up kindly. A campus targeting the full portfolio inherits the union of every applicable constraint: the 110 NIST SP 800-171 Rev 2 requirements assessed by CMMC Level 2, machine-readable continuous evidence from FedRAMP, GDPR transfer mechanisms such as adequacy decisions, SCCs or BCRs, DORA operational-resilience duties for financial workloads, and a formal ISMS from ISO 27001. Identify the binding portfolio your target book of business actually requires. Then reuse evidence through a crosswalk that checks each requirement's scope and sufficiency, rather than chasing every stamp or running parallel programs that each re-collect the same logs.

NERC CIP, the Critical Infrastructure Protection standards, is the one framework on this list whose engineering substance lives elsewhere in the guide, so this chapter places it rather than re-derives it. Chapter 4.3 is the canonical home for substation ownership, transmission interconnection, and the CIP registration analysis prompted when an AI campus becomes a transmission-connected load or operates on-site generation. The point here is its place in the compliance portfolio. Multi-hundred-megawatt campuses are grid actors for planning, because synchronized load loss materially affects reliability, and NERC made that explicit after a run of load-loss events. The 2024 Virginia event saw six successive faults on a 230 kV line over 82 seconds, roughly 1,500 MW of total customer-side load reduction across the sequence, and a ~1,260 MW drop at the third voltage depression that stayed off for hours. It was one of the load-loss events that informed NERC's rare May 2026 Level 3 alert. The alert was followed by a larger event: on 22 July 2026 a single fault near Ashburn, cleared normally, took about 3.8 GW of demand off PJM's grid when sites transferred to backup. That is roughly 2.5 times the size of the 2024 event.

CIP obligations attach to a registered function and in-scope BES Cyber Systems, not to campus MW. Where an operator has both, CIP's cyber-physical asset-inventory, access-control and incident-reporting obligations become mandatory and audited, a distinct and sometimes surprising line item in the governance budget. That may change: NERC's Board approved criteria for registering large computational loads on 8 October 2026. They remain a proposal until FERC approves the filing (due by 31 December 2026), and what a registered load would owe under CIP is not settled. The companion CLO-001-1, CLO-002-1 and CLO-003-1 standards passed final ballot in October 2026 and await NERC Board adoption and FERC approval. They set modelling, performance and disturbance-monitoring duties for sites of 50 MW or more supplied at 100 kV or above, and none of them is a CIP standard (Chapter 4.3). The grid-interactive engineering that prompts that analysis is in Chapter 4.10.

Manual evidence alone gets hard to keep current at AI-factory scale. A point-in-time audit that samples controls once a year cannot describe a fleet of tens of thousands of accelerators whose firmware, configuration and tenancy change weekly. The federal program saw this first, which is why FedRAMP 20x is built on continuous validation with automated and human evidence, alongside independent assessment. It is also why OSCAL (the NIST Open Security Controls Assessment Language) is the connective tissue. OSCAL expresses controls, implementations and assessment results in machine-readable JSON/XML/YAML, so implementations and assessments share a structured format. The format itself neither collects evidence nor proves a control. The decision is whether to adopt this model from day one or bolt it on later. You can retrofit, but it is punishing: every control, telemetry source and audit-log pipeline wired for human consumption must be re-instrumented for machines, and the habit of essay-writing is hard to unlearn.

The mechanism that makes this tractable is the control crosswalk: a single mapping from one body of collected evidence to the requirements it can support. A control that proves "all administrative access is MFA-gated and logged" can support a SOC 2 CC6 criterion, an ISO 27001 Annex A control, a FedRAMP KSI and a CMMC SP 800-171 requirement simultaneously. Each still needs its own scope, period, exceptions and assessor sufficiency decision. Collect the evidence once, in OSCAL, and the crosswalk fans it out to every report. Run separate programs and you collect it four times, with four chances to drift out of sync. The crosswalk is where compliance-as-code turns from a federal obligation into a cost-saving discipline for the whole portfolio.

Hardware provenance is now auditable, and that is the newest demand on the compliance program. Federal authorizers and serious enterprise buyers no longer accept "we bought it from a reputable vendor." They want the evidence chain, and you cannot reconstruct it after commissioning. The OCP S.A.F.E. program is the emerging standard. Under this Open Compute Project framework, device vendors commission an accredited Security Review Provider (eleven approved SRPs on the program’s provider list as of 16 October 2026, with Atredis Partners, IOActive and NCC Group among the first) to produce a standardized short-form firmware-security audit that travels with the device on the OCP Marketplace. The value to an operator is de-duplication: instead of every buyer re-auditing the same BMC firmware, the conformance review is performed once and consumed many times. From 2026-10-01 a S.A.F.E. review must itemize its S.O.L.I.D. requirement gaps in the long-form report, so coverage against the per-product-type requirements is visible to the operator inheriting the review rather than implied by the endorsement.

Supplier evidence now has a legal clock in the EU. Since 11 September 2026, the Cyber Resilience Act requires manufacturers of products with digital elements to report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform. Each actively exploited vulnerability or severe incident is reported in three steps: an early warning within 24 hours, a notification within 72 hours, and a final report, due 14 days after a fix or mitigation is available for a vulnerability, or one month after the notification for an incident. Products sold in the EU, such as BMCs, switches and NICs, can fall under it. The Act's main product-security requirements apply from 11 December 2027. Write into BMC, network and firmware supply contracts that the supplier copies you on those notifications when it files them, and route them into the same evidence store and incident path (Chapter 11.12) as your own findings.

The operator's decision is whether to make these artifacts first-class in the compliance program or treat them as security trivia. Get it wrong and the bill arrives late and large. A federal authorizer or a sovereign-AI customer asks for the firmware provenance chain, the SBOM and the root-of-trust attestation history for the accelerators, and an operator who did not capture them at receiving and burn-in (Chapter 13.8) cannot produce them. Capture provenance as the hardware enters the building, bind it to a hardware root of trust, and carry it in the same OSCAL evidence store as everything else. By 2026 it is no longer a security nicety but a line item in the authorization package.

Every framework on the list demands an audit trail, and at AI-factory scale the trail is itself an engineering problem. "Log everything" is unaffordable and unsearchable: a 100,000-GPU campus generates control-plane, data-plane, OOB-management, physical-access and environmental telemetry at a volume that overwhelms a conventional SIEM. The decision is what to log immutably, how long to retain it, and where it may physically reside. A tenant's contract or export-control overlay sets the last, and for EU personal data so do GDPR transfer mechanisms. A US-federal contract may require logs retained and queryable on US soil. Where personal-data logs subject to GDPR are transferred to a third country, an applicable Chapter V route is needed, and contractual location or access restrictions apply separately. Defense CUI logs stay inside the contractually defined CUI scope and any export-controlled access boundary. The single-pane SIEM fantasy fractures along the same jurisdictional lines as the rest of the campus.

The required property is retention and integrity appropriate to the applicable obligation: audit records protected against unauthorized alteration and deletion, with detectable changes and preserved originals where the regime permits an audit-trail method. In an insider-threat or incident scenario the logs are the evidence (Chapter 11.9). Write-once storage, cryptographic chaining and out-of-band collection to an enclave the production operators cannot reach are candidate mechanisms, and a hash chain alone detects changes but does not prevent deletion. These same audit logs are the raw material for detection and incident response. The security-operations treatment is Chapter 11.12, and the unified incident-command model that consumes them is in Chapter 14.11.

Residency and sovereignty are where compliance reaches back and rewrites the site plan. Sovereignty has three distinct meanings that diverge, and most operators conflate them. Physical residency means the data is stored and processed within a defined jurisdiction. It is the easiest to satisfy and the weakest guarantee. Operational sovereignty means the people and systems that administer the data are also within the jurisdiction: no foreign-national administrator, no remote operations center in another country, no support engineer who can pull data across a border. Control-of-stack sovereignty is the strongest: no foreign vendor, government or court can compel access to the data, regardless of where it physically sits. It can fail even when physical residency holds, if the hardware, software or operator is subject to a foreign jurisdiction's extraterritorial reach. A review of 775 non-US data-center projects (Richardson et al., 2025; data to Q3 2024) estimated that, weighted by investment, US companies operate about 48% of them, so building in-country does not by itself keep a facility out of foreign legal reach.

In Europe, control-of-stack sovereignty has a certificate. France's ANSSI SecNumCloud 3.2 qualification requires the provider to be immune from non-EU law: its head office must be in the EU, and non-EU entities may hold no more than 24% of its capital and voting rights individually or 39% collectively. The EU-wide EUCS scheme dropped its sovereignty criteria in 2024. The Commission's Cloud and AI Development Act proposal of 3 June 2026 would bring them back as public-procurement assurance levels, the highest modelled on SecNumCloud (Chapter 3.12). Germany's BSI C5 is a different instrument: a security attestation with jurisdiction-transparency criteria, not a sovereignty test. It still gates the vendor list, because cloud processing of German health and social data has required a current C5 attestation since 1 July 2024 (§393 SGB V). Decide whether you will qualify before you choose the operating entity and the hypervisor and remote-management vendors. The ownership test is passed or failed by the company, not the hall.

The three meanings fork at siting and procurement. A customer buying physical residency can be served from a leased hall in-region. A customer buying operational sovereignty forces you to staff the campus with in-jurisdiction personnel and route all administration through in-region operations, which can collide with the US-person access restrictions a defense contract or export-controlled data imposes if you try to serve both books from one site. A customer buying control-of-stack sovereignty may reject your hardware vendor, your hypervisor or your remote-management path entirely. Export controls compound this. The 2025 AI Diffusion Rule was rescinded before its compliance date in May 2025, and as of October 2026 BIS country, end-user and end-use controls govern whether the same accelerators are routine in one jurisdiction and license-gated or denied in another. The controls follow the chips after their first sale: reselling H100-class or later accelerators through an ITAD broker can need a licence, and the seller stays liable if the buyer diverts them (Chapter 14.9). Sovereign-AI demand, meaning national programs that require the entire stack be domestically controlled, is a fast-growing slice of the market. It is the one segment where compliance, not engineering, is the binding constraint.

The sector regimes ride along with the tenant and overlay the baseline. HIPAA (US healthcare) requires a Business Associate Agreement when the provider acts as a business associate, and the current Security Rule makes encryption an addressable implementation specification for e-PHI. HHS proposed in January 2025 to make encryption required; no final rule had issued by October 2026, so design to the stricter text. PCI DSS (payment-card data) uses the validation method set by the compliance-accepting entity, and eligible service providers can use SAQ D instead of a QSA-led ROC. DORA (EU financial sector) subjects an ICT provider to direct ESA oversight only after designation as critical, while financial-entity contracts impose applicable operational-resilience and third-party-risk requirements on other providers. FINRA/SEC records rules require either compliant WORM storage or an electronic recordkeeping system meeting the audit-trail alternative that amended Rule 17a-4 introduced (87 FR 66412; effective 3 January 2023, compliance date 3 May 2023). Pick the mechanism the tenant's regime actually calls for instead of forcing WORM media by reflex.

NIS2 can attach to an operator’s own covered service: Implementing Regulation (EU) 2024/2690 names data-center service providers among the covered digital-infrastructure entities. Determine entity and service definitions, size and exceptions under Directive Articles 2–3, and jurisdiction under Article 26, before assigning management accountability, supplier requirements and an incident-notification path to a national authority (the response process is Chapter 11.12). NIS2 takes effect through national law, and transposition is recent and uneven. In July 2026 the Commission began EU Court of Justice cases against Ireland, Spain, France and the Netherlands for not fully transposing the Directive. The Netherlands' law then came into force on 15 August 2026. For each host country, check the national act, the competent authority and the registration deadline, because the Directive text alone will not tell you.

The operator carries these duties only when its service meets a regime's applicability test or a tenant contract flows them down. They add encryption, retention or BCP/DR constraints (Chapter 12.3) that the facility must already satisfy when the regulated tenant arrives. Map the sector overlays your target tenants will bring before commissioning, so each service is built to its applicable overlay rather than retrofitted to it.

Two more EU regimes bind the operator itself rather than arriving with a tenant. Under the Energy Efficiency Directive and Delegated Regulation (EU) 2024/1364, every data center with 500 kW or more of installed IT power reports PUE, WUE, energy reuse and renewable share to an EU database each year. Germany's EnEfG adds legal PUE and energy-reuse floors (Chapter 15.7). A neocloud selling to EU customers offers a data-processing service under the Data Act: its switching duties have applied since 12 September 2025, and from 12 January 2027 it may charge nothing for switching, egress included (Chapter 9.8). Buyers' diligence asks about both alongside the security certificates.

The same governance failures recur, because each comes from treating compliance as downstream paperwork rather than an upstream design constraint:

• Certification theater: collecting stamps no customer required. Pursuing a framework because a competitor has it, while the binding portfolio for your book of business goes unmet. Derive the portfolio from the union of target-customer mandates, not from a marketing checklist.
• Manual evidence at machine scale. Running a spreadsheet-and-screenshot compliance program against a fleet whose state changes weekly. It passes the first audit, drifts immediately, and collapses the moment continuous monitoring becomes mandatory under FedRAMP 20x.
• Residency as an afterthought. Selling "sovereign" capacity that satisfies physical residency while the remote-management path, the backup site or the vendor support channel quietly defeats operational or control-of-stack sovereignty. The customer's auditor discovers it, not yours.
• Unowned shared-responsibility seams. Leasing capacity without a written control-ownership matrix, so the OOB-logging or firmware-attestation control belongs to no one until an authorizer asks who owns it.
• Provenance you cannot reconstruct. Skipping firmware-security audits, SBOMs and root-of-trust attestation capture at receiving, then being unable to produce the evidence chain when a federal or sovereign customer demands it.

Sell the service after its legal entity, data classes, jurisdictions and control owners map to the obligations that apply. Reuse an artifact when it answers the same scoped requirement; obtain separate evidence when it does not. Overpromising certification or residency adds contract exposure without creating the missing control.