Environment, Health & Safety (EHS) Across Build & Operate

Every earlier chapter in Part 6 designed a hazard into the building. Chapter 6.2 screened the slab for rack mass: about 3,000–3,300 lb wet for a GB200 or GB300 NVL72 rack, and roughly 4,000 lb for NVIDIA's Vera Rubin NVL72. Chapter 6.5 put lithium BESS in rooms with their own detection, cooling and deflagration venting. Chapter 6.7 set the rigging paths those racks travel, and Chapter 6.8 wrapped acoustic enclosures around gensets running on stored fuel. Here those hazards stop being lines on a drawing and become things that can kill or maim a person, and the discipline shifts from engineering a margin to operating a program. An arc-flash study is a deliverable. An arc-flash program is a labeled equipment register, an energized-work permit system, a PPE-to-incident-energy mapping, and a re-study trigger that fires whenever someone changes a breaker setting. The first protects you on the day it is signed. Only the second protects the worker who opens a switchgear door three years later.

EHS earns a full chapter in 2026, not a paragraph in a code-compliance appendix, because the AI build changed the hazard profile faster than safety programs adapted. The move to 800 VDC distribution (Chapter 4.7) adds lethal contact-voltage shock to a DC-bus hazard that already demanded tool control and arc protection at 48 V. Direct-to-chip liquid (Chapter 5.4) puts pressurized glycol and dielectric fluids in the same enclosure as energized electronics. On-site gas generation (Chapter 4.8/4.9) drops a small power plant, with its own combustible-gas and process-safety regime, onto a campus whose EHS staff were trained for IT, not for turbines. And concurrently maintainable facilities, with the maintained equipment de-energized (Chapter 12.1) mean the workforce maintains an operating building under planned isolation and controlled work conditions. Energized work stays an engineered exception under the applicable electrical-safety program. Each of these is a goodput or density decision elsewhere in this guide, and each lands here as a managed hazard.

Treating the arc-flash study as a one-time engineering deliverable is a program failure. The study computes, at every piece of equipment, the incident energy (in cal/cm²) a worker would absorb in an arcing fault, the arc-flash boundary (the distance at which incident energy falls to 1.2 cal/cm², the onset of a second-degree burn), and the arc-rated PPE required inside it. It is valid only for the protective-device settings, fault currents and one-line topology that existed the day it was run. Re-coordinate a relay, swap a transformer, add a UPS module or energize a new feeder, and the incident energy at downstream gear can move. Review any change that can affect the results before anyone relies on the study for work on the affected gear. If the review shows the numbers moved, update the analysis, then the labels and PPE to match. NFPA 70E (2024), 130.5(G), requires an accuracy review within five years and an update for system changes that can affect the analysis. The program turns that requirement into a trigger wired to your management-of-change process, so no power-chain modification closes out until its arc-flash impact has been evaluated.

The current edition is 70E-2027 (issued 2026-04-16, effective 2026-05-06), though the edition your employer's electrical-safety program adopts is the operative one. Its most operationally consequential change is new 130.2(A)(2). When an Energized Electrical Work Permit is required and the permit specifies shock or arc-flash PPE, at least one additional person trained in emergency response must be present, stationed outside the greater of the limited-approach and arc-flash boundaries. Staff that person into every permit-required task of this kind, and treat a missing person as a hold condition. The 2027 edition also adds dedicated DC-hazard coverage (new Article 310), though it is still not an 800 VDC design standard.

AC arc-flash intuition does not transfer to the 800 VDC world that dense racks are driving toward. In a 60 Hz AC system the current passes through zero 120 times a second, which helps a breaker extinguish the arc. A DC arc has no current zero and can persist as long as its source and gap sustain it, so protective devices must be rated to interrupt it. That makes DC arcs harder to clear and DC incident energy harder to bound. IEEE 1584-2018 covers three-phase AC systems from 208 V to 15 kV and excludes DC, so a DC bus needs its own incident-energy analysis matched to the installation. NFPA 70E's DC annex is informative only. In the 2024 edition, Annex D.5 lays out Doan's maximum-power method and points to Ammerman's DC calculations. Stokes/Oppenlander and Paukert give you arc characteristics, one input to a larger calculation rather than an incident-energy answer by themselves. All of these methods need more validation.

The shock side is starker, and at 48 V it runs opposite the arc and thermal side. Under US 29 CFR 1910.333(a)(1), the de-energization exception for live parts below 50 V to ground also requires no increased exposure to electrical burns or arc explosions. Use your rack's actual voltage to ground; NVIDIA's cited DGX GB power shelves are nominally 50–51 VDC. Either way, a conductive dropped tool across the NVL72's paired busbars meets a stiff parallel supply: NVIDIA rates the GB200 NVL72 busbar circuit at 1,400 A (about 67 kW at 48 V), and the bolted-fault current is far higher (Chapter 7.13). Arc exposure is quantified from available fault current, clearing time, working distance and task, and PPE follows the study. At 800 VDC, Ohm's-law screening at an illustrative 1,000 Ω body resistance gives about 800 mA. Actual current and injury depend on contact impedance, path and duration, and the missing current zero still makes the DC arc harder to clear. The voltage step that Chapter 4.7 justified on efficiency grounds therefore adds a lethal shock regime. It does not create the need for arc discipline, because the 48 V bus already had it.

At every voltage class, what protects the worker is not the PPE in the cabinet but the program control that keeps the study, the labels and the worker's training in step with the as-built power chain. Workers can mistake a nominal 48 V bus for low total risk, even though conductive tools can bridge its high-current conductors. Keep tool control and study-selected arc-rated PPE in the task plan. Carry the low-risk habit to 800 V and the error also includes electrocution. → the voltage architecture itself is set in Chapter 4.7; the resilience model that requires isolating the maintained component while the other paths keep carrying load is Chapter 12.1.

Lockout/tagout is the bedrock control for equipment that could energize or move unexpectedly: isolate the energy source, lock it in the safe state, tag it, and verify zero energy before a hand goes near it. A conventional plant can often de-energize a whole system to work on it. A concurrently maintainable AI data center normally isolates only the maintained equipment while another path serves IT. The Tier III/IV site-infrastructure premise is that required capacity components and distribution paths can be removed for planned maintenance while the IT load keeps running (Chapter 12.1). That is a feature for uptime and a trap for LOTO, because the worker is isolating one leg of a system whose other legs are deliberately, continuously live. LOTO must draw boundaries around back-feed from a parallel UPS or genset, stored energy in capacitor banks and DC buses, and the closed-transition path that could re-energize an 'isolated' bus during an automatic transfer. Concurrent maintainability is engineered to keep exactly those boundaries hot.

Generic LOTO procedures are therefore not safe here. The facility needs equipment-specific energy-control procedures for every maintainable boundary, written against the actual one-line and transfer logic, naming every isolation point and every stored-energy source. The split is organizational. Individual LOTO (each worker applies their own lock) is unambiguous but does not scale to multi-trade work on a large lineup. Group LOTO (a lockbox holds the isolation and each worker adds a personal lock to the box) scales, but it concentrates accountability in one authorized person, and done loosely that becomes the failure mode in the incident report. And because the IT load cannot drop, the highest-consequence question is who owns the permit, and who has the authority to refuse the work when isolating a component would violate concurrent maintainability. Answer it in writing before the first live job, not on the floor at 2 a.m.

Trace every way the task can acquire energy. The motor's main feed reaches the drive. The DC link can stay charged after that feed opens. The separate control supply reaches the terminal enclosure. The water branch can retain pressure or drain under gravity after its valves close. The listed drive disconnect interrupts only one of those paths. Reject the task boundary and keep pump removal on hold, even if the BMS says “off” and the IT load is running normally.

The electrical qualified person and the mechanical authorized person revise one coordinated isolation. They identify and control both electrical supplies, follow the drive's discharge procedure, verify absence of hazardous voltage at the work boundary with suitable test equipment, and prove the tester by the applicable procedure. They isolate, depressurize and drain the water branch, prevent reaccumulation, secure moving parts, and apply the personal/group-lock arrangement to every exposed worker. Only then can the accountable work controller release the removal. Operations accepts the temporary loss of redundancy; it cannot trade that risk for an unverified energy state.

What releases the work: every source reaching the task is identified, controlled and verified. Discovery of even one omitted source reverses the release. A 24 V control supply can initiate motion or bridge a hazardous boundary, so its label does not settle the task. OSHA 1910.333(b)(2)(ii)–(iv) supplies the electrical de-energization and verification basis. The mechanical energy-control program follows 1910.147(d)(5)–(6) and (f)(3) where applicable. Work authorization belongs to this chapter's program; Chapter 5.13 sets the hydraulic boundary, and Chapter 14.12 covers the maintenance procedure and retest.

The mechanical hazards of the build and operate phases are ordinary, which is why they kill people: the program fails through familiarity, not novelty. Falls are the leading cause of death in construction. Of 1,034 private-sector construction deaths in 2024, 389 were falls, slips and trips (BLS). A data-center build is fall-rich: open structural steel, elevated pipe racks for the facility water loop, rooftop heat-rejection plant, and mezzanines for electrical gear. The controls (guardrails, personal fall-arrest, controlled-access zones, a competent-person inspection regime) are well understood and routinely skipped under schedule pressure. The EHS program's job is not to invent new controls. It is to make the known ones non-negotiable on a critical-path schedule that is screaming for speed-to-power.

Heat exposure needs its own regulatory basis. As of 15 October 2026 the federal OSHA heat standard is still only proposed. Meanwhile OSHA enforces against heat hazards under the General Duty Clause, and its Heat National Emphasis Program has directed targeted inspections since 10 April 2026. Find the heat rules that cover your site by jurisdiction, industry and indoor or outdoor setting. Then build task controls and hold triggers from those rules and from your own exposure assessment.

Confined spaces proliferate in the AI build in ways an IT-trained operator may not expect: large CDU and tank interiors, thermal-storage and chilled-water reservoirs, deep electrical vaults and cable trenches, and the let-down and scrubbing vessels on a gas-conditioning skid (Chapter 4.9). Evaluate each space against the jurisdiction's confined-space definition and hazards; only a space that meets the applicable criteria is permit-required. Where entry is permit-required, controls include atmospheric testing as applicable, an attendant and a site-specific rescue plan. The statistic that should anchor the program: a large share of confined-space deaths are would-be rescuers who entered an untested space to save a downed coworker. The rescue plan is what stops one fatality from becoming two or three.

Heavy rigging completes the set: multi-tonne transformers, chillers, prefab power and cooling modules (Chapter 6.4), and the racks themselves. The guide's screening band is 3,000–3,300 lb for a wet GB200 or GB300 rack, carried into Chapter 6.7. NVIDIA's 16 March 2026 article puts the Vera Rubin NVL72 rack at roughly 4,000 lb and does not say whether that is a wet or shipping weight. Plan each lift from the handling data for the OEM configuration you buy, not from either figure. The controls are engineered lift plans, certified rigging gear, exclusion zones under suspended loads, and qualified signaler and rigger roles. The rigging path defined for civil reasons in Chapter 6.7 is, for EHS, a struck-by and crush-hazard corridor that the EHS plan has to own.

Liquid cooling did not just change the thermal design. It extends the facility's chemical-handling program into the IT coolant circuit. Many air-cooled halls already run chilled-water and cooling-tower loops with treatment chemicals. Direct liquid cooling brings the chosen fluid into the IT room, with its own handling, leak, exposure and disposal rules. The coolant chemistry you select in Chapter 5.4–5.5 carries its EHS burden with it: exposure controls, spill response, disposal and regulatory liability are a consequence of the cooling fork, not a separable add-on. Three families dominate, and they sit at very different points on the hazard map.

Propylene-glycol/water (PG25 and relatives) is the workhorse single-phase direct-to-chip coolant. Its acute toxicity is low (propylene glycol is far less toxic than ethylene glycol, which is why the industry standardized on it), so the dominant hazards are physical. It is conductive enough that a leak onto energized 800 VDC electronics is a fault and shock risk, it makes floors slick, and at scale a spill is an environmental-reporting event and a disposal stream. Single-phase dielectric fluids (synthetic or hydrocarbon) remove the conductivity problem: an uncontaminated fluid’s specified dielectric performance can reduce leakage-current risk, provided moisture, particles and hot surfaces stay inside its qualification limits. They bring back flammability or combustibility classification, vapor and dermal-exposure concerns, and a heavier disposal burden. Two-phase fluorinated fluids (the PFAS family) were until recently the high-performance immersion answer, and they are this section's cautionary tale.

Whatever the chemistry, the operate-phase program has the same skeleton: a maintained SDS library and chemical inventory; exposure controls and PPE matched to the fluid; secondary containment and spill kits staged at the loops; a spill-response procedure matched to the adopted NFPA 75 edition and the liquid-cooled equipment you install, including the de-energization sequence for a conductive-coolant leak onto live gear; and a disposal and recycling stream with the manifesting and reporting the local regime demands. You choose this program when you choose the coolant, so price the spill, exposure and end-of-life liability into the cooling fork rather than discovering it on the floor.

A campus that owns its substation and HV yard (Chapter 4.3) inherits a hazard class most data-center EHS staff have never managed: medium- and high-voltage work, utility-grade clearances, induced-voltage and step-and-touch-potential risk across the ground grid, and switching where a wrong move flashes over at energies no PPE survives. The installation's actual function sets the OSHA scope. Work performed as electric-power generation, transmission or distribution falls under 29 CFR 1910.269, and customer premises-wiring work falls under Subpart S. The control here is not better PPE. It is the qualified-worker program: documented, demonstrated competency for each person allowed inside the HV boundary, refreshed on a cadence, including remote racking and switching. Use a written switching order and remote operation where practicable to establish isolation before maintenance, and keep workers outside the assessed arc-flash boundary.

The workforce question is make versus buy. In-house HV qualification gives operational control and faster response, but it demands a sustained training, tooling and competency-audit program that is hard to keep current at a single site. Contracting the utility or an HV specialist for substation work supplies qualified personnel but adds interface and response-time risk. Keep three things separate and document each: who owns the equipment, who has switching authority, and which individual workers are qualified for each task on each piece of equipment. Qualification is specific to the task and the equipment, whoever owns the gear. Contracting also does not hand off the host's duties. Where 1910.269 applies, the host and contract employers exchange information about the installation and its hazards and coordinate work rules before work starts. Coordinate all three with the 4.3 ownership model. They need not coincide, but any gap left between them becomes the incident. Get it wrong and you have either workers operating beyond their qualification or a campus that cannot perform routine switching without waiting on a third party. → the substation ownership and NERC-compliance framing is Chapter 4.3.

The behind-the-meter generation strategies of Chapter 3.5 and the fuel-supply engineering of Chapter 4.9 put a process-industry hazard on the campus: combustible gas, pressurized vessels, fuel storage and rotating prime movers. OSHA Process Safety Management applicability depends on a covered process, a listed-chemical or flammable-material threshold, connected or co-located process scope, and any exemptions under 29 CFR 1910.119; inventory alone does not settle it. For generation, one exemption usually decides the question: 1910.119(a)(1)(ii)(A) excludes hydrocarbon fuels used solely for workplace consumption as a fuel, unless the fuel is part of a process that contains another highly hazardous chemical the standard covers. Gas burned in your own generators often fits that exemption. Selective catalytic reduction (SCR), the exhaust cleanup on many gas engines and turbines, runs on ammonia, and that ammonia raises a separate test: the standard lists anhydrous ammonia at 10,000 lb, and solutions stronger than 44% ammonia at 15,000 lb, so choosing between anhydrous ammonia, a weaker aqueous solution and urea is also a PSM decision. EPA's Risk Management Program has separate ammonia thresholds of its own, and they extend to weaker aqueous solutions than PSM reaches, so test the reagent against both. Data-center operators rarely arrive prepared for this regime. PSM is not a checklist. It is process-hazard analyses (HAZOP/LOPA), mechanical-integrity programs, management-of-change discipline, operating procedures, contractor-safety management, pre-startup safety reviews and incident investigation: the full apparatus of running a small process plant.

The decision is binary and early: determine PSM applicability before first fuel, in a written analysis that works through each of the tests above, the SCR ammonia included. If you are in, stand up the program ahead of commissioning rather than discovering the obligation during an inspection or, worse, an incident. Even below the PSM threshold, on-site gas brings combustible-gas detection, relief and venting, hot-work permitting, and the process-safety interlocks of Chapter 4.9 into the EHS program. This is the cleanest example in the chapter of a goodput and availability decision made elsewhere (firming the power with on-site generation) cascading into an EHS obligation that has to be owned here. → the energy-supply strategy is Chapter 3.5; the gas-process and fuel engineering is Chapter 4.9; commissioning the generation and microgrid controls is Chapter 13.4.

Release work only from verified isolation and the crew's demonstrated qualifications, with operations owning any loss of redundancy. If either is missing, delay the task. A longer maintenance window costs less than asking a worker to discover an omitted energy source by contact.