The Federal Data Center Enhancement Act sunsets September 30, 2026, leaving federal and contractor data centers without binding cyber or sustainability standards just as the AI buildout accelerates and local opposition surges.
The Federal Data Center Enhancement Act is set to expire on September 30, 2026, according to Wired's reporting, and as of mid-June neither the White House, the Office of Management and Budget, nor Congress has publicly moved to extend, modernize, or formally retire it. The 2024 law set the only binding federal floor for cybersecurity, energy efficiency, and water use across the government's own data centers and a slice of contractor-operated facilities. Letting it lapse by default is a policy choice the administration has not yet had to defend on the record.
The FDCEA was tucked into the 2024 National Defense Authorization Act and directed OMB to require independent energy assessments for new or significantly upgraded federal data centers (S.933, 118th Congress). Implementation guidance issued by the Biden-era OMB laid out how agencies were to weigh energy and water factors in design decisions (OMB M-25-03). Those rules have no statutory life after September 30.
According to Wired's reporting, current and former staff at the General Services Administration and OMB said the administration is not preparing a successor. A GSA employee put the moment in plain terms: "Never in the history of data center policies has a policy expired without another one having been painstakingly worked on for three years behind the scenes." The Unified Agenda at reginfo.gov, the federal government's primary regulatory tracking list, shows no entry for the FDCEA (reginfo.gov).
Sen. Jacky Rosen (D-NV), one of the law's original sponsors, acknowledged the sunset in an emailed statement to Wired and said her team is "looking at all options." Her office declined to detail a legislative path.
The lapse lands in the middle of the largest federal data center buildout in a generation. The Electric Power Research Institute estimates that U.S. data centers will consume at least 9% of national electricity by 2030 (E&E News on EPRI's estimate), roughly double the current share. Federal agencies sit inside that demand curve through AI contracts, secure cloud capacity, and high-performance computing refreshes, even though most of the projected doubling is driven by private hyperscalers.
Local resistance is already shaping which projects get built. A March 2026 Gallup poll found roughly 70% of Americans oppose new data centers in their area, with 48% strongly opposed and 46% saying they worry "a great deal" about the environmental impact of AI facilities. Google withdrew a 468-acre rezoning proposal in Franklin Township, Indiana, and Microsoft backed off a new Wisconsin data center, according to Gizmodo's reporting. The same write-up notes that activist Erin Brockovich has launched a crowdsourced map tracking community concerns about major AI data centers.
The cybersecurity piece of the FDCEA is the part most often skipped in the local-opposition coverage. The law included a federal baseline for cybersecurity across agency-operated and some contractor data centers, layering on top of existing federal cyber guidance. Once the statute sunsets, OMB's legal hook to enforce that baseline through its implementation memo goes with it.
Adjacent administration moves add texture without proving causation. The White House recently directed the Center for AI Standards and Innovation to pause public AI model review reports (Gizmodo on CAISI), and the new AI executive order shifts federal AI policy to a voluntary framework with 30-day pre-release access for frontier models, replacing an earlier 90-day draft. Read alongside the FDCEA's quiet expiration, they describe a narrower federal footprint over how the buildout is going, with no on-record rationale for the rollback.
The Government Accountability Office's annual FDCEA progress reports to Congress are the most likely record of what the law actually accomplished in its first two years, and a follow-up read of those reports would tell readers how many agency data centers completed assessments and where the program was already thin.
Three options sit in front of policymakers: extend the FDCEA as written, modernize it for AI-era loads with updated energy, water, and contractor-scope language, or let it sunset on a planned timeline with a documented rationale. The current path is a fourth option, silent expiration by default, and it is the one no administration staffer has yet had to explain in public. The first test will come when Congress returns and the appropriations cycle starts pricing the September 30 deadline into agency IT planning.