Building and financing digital infrastructure

How five shifts in demand, financing, power, government and community consent are reshaping digital infrastructure risk and project finance.

Digital infrastructure has moved into a new phase. Over the past year, five shifts have changed not just who is buying and funding capacity, but how projects are powered, governed and permitted to proceed. New tenants bring different demands and shorter credit histories. Private capital is taking a larger role. Power is becoming a core project variable. Governments are intervening more directly. And local communities are increasingly shaping whether projects can be built at all.

Taken together, these changes are redrawing the risk profile of digital infrastructure. Some exposures can still be allocated in contracts, transferred through insurance or capital markets, or held on the balance sheet, but only if they are understood early and structured deliberately.

Part 1: Five shifts transforming digital infrastructure risk

What has changed. A growing share of new capacity is contracted by young, fast-growing, privately financed companies such as AI labs, neoclouds and independent platforms, alongside the hyperscalers who dominated the first wave. Their own customer commitments are often short compared with the leases they sign.

Their needs within a data centre don’t look the same as incumbents: a data centre built for a frontier lab’s training workload may not meet what an enterprise colocation customer needs, so an operator has fewer alternatives if the first tenant leaves and, in a colocation environment, fully customizing to each tenant is not economically viable.

Customers are also becoming increasingly demanding. Uptime guarantees of four nines on power and cooling are increasingly standard, and delay in increasing capacity carries sharp financial penalties that may not flow through to every vendor agreement beneath the lease. The most demanding terms in current negotiations frequently come from the newest entrants.

What it does to the risk position. The project is committing to more, for longer, against a counterparty it knows less about. The debt, the power contract, the delay and performance remedies, as well as the insurance programme, are all sized against the customer contract. Where that contract is signed with a company two or three years old, there is no trading record to price it against, so the question gets settled by structure instead: what guarantee, collateral, prepayment, surety or credit insurance stands behind the commitment, and who pays for it.

What has changed. Private capital and infrastructure investors fund a growing share of this new demand, and many of these assets sit in their portfolios as infrastructure, with long-dated contracts behind them. The cash flows are contracted, but the asset is built in layers with different lives. Most of the value sits in computing with a life of five to six years, inside buildings and power systems that last decades, and what the facility is worth at the end depends on whether it can be re-let or reconfigured to someone other than the tenant it was designed for.

Capital itself is not the constraint; it is available in volume and lenders are still originating.But the security, contracted cash flow, the appraised value of the facility, in some deals the GPUs themselves, leads back to the contract in every case. So, the credit decision turns on the contract, the counterparty behind it and the risk position of the project.

What it does to the risk position. What lenders require shows the direction of travel. They ask for cover to the project’s full contract value through construction and into operation. They want to see how a site performs under stress, with diligence, valuation and loss analysis increasingly required before construction is fully under way. And where the counterparty is newer, they ask for investment-grade guarantees, upfront collateral or the chips as security. Risk structure therefore affects what a project can borrow and at what price, and unlike the tenant, the grid or the regulator, it is one of the few inputs the project controls.

What has changed. Generation attached to the site has become a significant route to power. The push has come mainly from the United States, where connection queues run for years and developers now often build or contract their own generation rather than wait for an external supply. The International Energy Agency estimates that 15 to 27 GW of data centre load may be served by onsite gas by 2030, for example.

Outside of the US the power challenge manifests differently. Availability isn’t the only issue. Self-supply is in some cases becoming a condition of connection rather than a way around it, while regulators are setting the terms ensuring that sustainability is not sacrificed in powering the digital infrastructure build out.

Across Europe there are several examples, Ireland ended its connection moratorium in December 2025. This was done on the condition that a large data centre provides dispatchable generation or storage matched to its full import capacity, separately connected and metered, and trades it in the wholesale and capacity markets so that it is available to the grid when the site does not need it. Spain indicates that it will require sites above 1MW to match most of each hour’s consumption with newly built Spanish renewable energy. Germany requires unsubsidised renewable power in full by 2030.

A project that cannot get a grid connection when it needs one has three routes: wait, contract power from a partner, or generate some of its own. Each moves a different risk onto the project.

What it does to the risk position. With captive power, the project takes on generation, dispatch and availability risk that a regulated utility used to carry, without the tariff that priced it or the operating history that made it underwritable. This shows up in three places.

Delivery. The generation is a second project on the critical path: if it is late, tenant delay penalties start to run, and if it underperforms, a regulator can cut the site’s permitted import capacity.
Operations. Running a plant brings reliability, dispatch and price exposure the operator did not previously have, and when that plant trips there may be no grid headroom to fall back on. Sustainable methods also bring enhanced physical risks - for example, battery storage, often part of the solution, adds a fire risk conventional suppression systems were not designed for.
Contract. Uptime guarantees to tenants have been tightening across the sector,and where the operator generates its own power, the plant’s performance becomes the operator’s own exposure. A failure upstream of the building becomes a contractual liability downstream of it.

None of it is easily undone: the architecture is fixed when the site is designed and permitted.

What has changed. Governments have decided that AI capacity is strategic infrastructure rather than commercial property. Public services, research and critical industries increasingly run on computing owned by foreign companies and reachable by foreign governments. AI sovereignty has become a strategic priority for many countries, shaping who may build, own, and operate the capacity behind sectors a country treats as sensitive. This impacts projects in three ways:

As gatekeeper of the market. Governments are defining which providers may sell to the public sector, grading them by where infrastructure and data sit and by who ultimately controls them. Sovereignty has become a qualification to bid, as evidenced by the European Commission’s proposed Cloud and AI Development Act.
As the authority over ownership and control. Conditions are being attached to who may own and operate a facility, where its data must sit and whose law governs. Enforced through grid access rather than through company law (Spain’s draft royal decree on data centres, fast-tracked in August 2026 and still in consultation).
As customer and financier. The state is now a counterparty on the same projects it regulates and permits. Regional governments are buying computing and funding construction directly, through national computing programmes and public investment vehicles such as the EU’s AI Factories and InvestAI, Canada’s Sovereign AI Compute Strategy, or India’s IndiaAI Mission.

What it does to the risk position. These rules land after the capital is committed, on projects designed under previous terms, with months rather than years to comply. They can change what a project is allowed to sell and who is allowed to own it, without anything changing at the asset. The state’s roles move independently of each other, so a project underwritten on the assumption of a supportive government can find itself facing a slower permitting authority or a harder gatekeeper.

What changed. National governments decide whether a project may be built; local communities increasingly decide whether it is. After sustained local opposition, the Scottish Parliament backed a pause in September 2026 on planning decisions for hyperscale data centres while national guidance is drawn up, due within twelve months. The 24 proposals affected would together draw more than Scotland’s peak demand. Seventeen of 33 permitted projects in South Korea were delayed by local opposition in 2026, and around $130bn of US investment was blocked or delayed in the first quarter of the year. The objections concern measurable local impacts such as electricity prices, water and land use, and developers can answer them with evidence and with commitments they then honour.

What it does to the risk position. Consent is three exposures under one name, and they land at different points.

Before commitment, schedule and sunk cost. Development spending, option payments and queue positions are committed against a permission that may arrive a year late or not at all, and nothing the project does accelerates it.
Once granted, long-dated obligations. Conditions on water use, efficiency, heat reuse and grid flexibility bind the asset for its operating life. A breach is an enforcement matter rather than a commercial one, and there is no counterparty to indemnify it.
After commitment, revision risk. Permission can be narrowed once capital is committed. Debt covenants tied to an operating timeline, power contracts priced against an assumed energisation date, and tenant agreements with fixed delivery obligations can all be triggered by one planning reversal.

Four of the five shifts land on the same three questions: what the contracts allocated before anyone priced the risk, what the market will take once asked, and what is left. Consent skips the first two, because there is no counterparty to allocate it to and no product built to transfer it, and goes straight to the third.

Part 2 – What it takes to keep these projects financeable and deliverable

Any exposure can be retained, pushed down the contract stack, or transferred to the insurance and capital markets. All three routes are constrained at the same time, retention by appetite and by what lenders and rating agencies tolerate. Contractual transfer by supplier leverage, insurance transfer by what is insurable. They are three views of one decision rather than three workstreams.

A clause is only as good as the answer to one question: can the exposure it creates actually be borne or transferred? That makes the contract and the insurance programme a single design problem.

Risk is allocated in the contracts before anyone prices it. A construction delay clause, a power availability guarantee, a liability cap in a supply agreement. Each is negotiated early, often before financing or insurance are meaningfully engaged, and each decides who is exposed to what before anyone with a balance sheet built to absorb it has looked at the deal.

The exposures being allocated have grown, too. Over the last eighteen months liquidated damages have become larger and more frequent, while performance guarantees have extended beyond construction metrics to power availability. Energisation schedules and operational readiness, as well as property and casualty risk, have started moving off the insurance programme into indemnities.

Marsh’s The new age of contractual risk allocation in data center development makes the structural point directly: a project is a stack of overlapping contracts responding to the same event in different, uncoordinated ways. A transformer delay triggers the tenant’s remedy regardless of cause, lets the contractor claim excusable delay, and caps the supplier’s liability at the value of the equipment. Three reasonable positions that do not add up, because no single negotiation sees the whole stack. Scarcity has sharpened the situation: the supplier, the party best able to control a delay, is now also the party with the leverage to refuse liability for it.

Some exposures have no counterparty to receive them at all: no contractor indemnifies a water commitment, and no vendor absorbs an operating duty underneath a guarantee given to a tenant. So, the question worth asking is whether each exposure sits with a party that can genuinely hold it, and whether the portion that cannot be moved has been priced and funded deliberately. Contract drafting and insurance placement decide the same thing, and are still run by different people on different days.

How much insurance capacity a buildout can draw on is genuinely contested. What exposures are transferable, on what trigger, and at what limit?

Some carriers and advisers describe cover at full project value as the point where the market runs out. Marsh’s published view is that difficulty placing very large programmes is not always down to capacity: most insurers have appetite, major carriers have expanded single-risk limits substantially, and alternative capital through insurance-linked securities and private markets is now playing a meaningful role in the sector. The disagreement is mostly about the basis on which cover is bought and its associated costs, rather than solely the amount of capital available.

Capacity and limits. Some lenders require cover to the full contract value of the project. A detailed loss study sizes the programme to probable maximum loss instead and gives the project a basis for that conversation rather than buying limits someone else specified.Where large limits are genuinely needed, capacity is assembled rather than bought. Facilities offer pre-arranged capacity; structured exchanges let underwriters evaluate each risk individually; consortium arrangements, reinsurance and insurance-linked securities extend the tower beyond what the primary market will write. Marsh is innovating in this sector: Nimbus, a construction-phase facility, and Stratus, an operational property exchange offering up to US$10bn of capacity on a single placement, are structured so that underwriters assess each risk individually with built-in benefits tailored to the sector.

Triggers and scope. The events that cause the largest losses on these projects are not always the events the policies were built to pay for. Delay-in-start-up cover generally responds only to delay caused by insured physical damage, so a missed interconnection with nothing broken can fall outside the trigger. Property and business interruption cover pays loss of rent on a repair timeline, while a lease may terminate on a commercial one.During a retrofit the programme often reflects the legacy asset rather than the live one. A single event with a cyber cause and a physical effect can fall between two policies.Marsh’s own analysis names contract language that does not align with what is insurable as a recurring failure mode on these projects, and the remedy is the one from the previous section: test each promised remedy against the trigger that would have to answer it, while both are still being drafted.

The evolving toolkit. A risk can only be transferred once it can be measured and priced, and for performance, credit and obsolescence exposures there is little loss history to price against. Some instruments already exist and are underused: surety, which secures lease obligations and power purchase guarantees without tying up the collateral a letter of credit demands, and credit mitigation for power purchase agreements. Some are being built now, including cover for liquidated damages and service level obligations, historically excluded on the principle that insurers do not cover risks two parties assumed voluntarily between themselves. For some exposures the transfer question remains open at scale, obsolescence and residual value on computing hardware, and business interruption where the loss is a performance failure with nothing damaged or external to the asset. Where an indemnity trigger cannot be defined cleanly, parametric structures can pay against an observable event such as a grid outage of a stated duration, at the cost of basis risk.

What a project keeps should be a decision, and most of what it keeps today is not.

Whatever the first two moves cannot place lands here. Consent conditions land here by construction: no counterparty, no product, and therefore retained whether or not anyone recognised it. Much of the rest is held without being measured. Redundancy reduces the likelihood of a disruption without reducing what it costs, and operators have invested heavily in resilience irrespective of the consequence they carry. As portfolios grow, uptime commitments accumulate and the total sits above anything a site-by-site view shows.

Three moves follow. Quantify what is retained, at a stated confidence level and against a stated scenario: the same loss study that sizes the programme sizes the retention, and an exposure nobody has sized is not a decision. Structure what you keep, reserve against it, size the balance sheet behind it, use a captive where the scale justifies one, and name who owns the decision to hold it rather than leaving it with whoever was in the room when the contract was signed. Design the exposure down at source: the siting and resilience decisions that help win consent also reduce insurable and retained exposure, which is why early integrated siting and design assessment supports the future availability and affordability of insurance.

None of this is absolute. The five shifts compound and recombine after financial close, and a retention correctly sized at signing can be materially mispriced eighteen months later if nobody is asked to revisit it. The sector is also moving at such a pace that the five shifts can, and will, change posing new risks, and opportunities, that need to be quantified.

The five shifts do not create five separate problems. Each one lands in the same place a commitment the project has made, an exposure it has taken on, and a question about who actually holds it.

Those commitments are made early. When a lease is signed, a site is chosen, an energy architecture is fixed, a financing structure is agreed, and by the time anyone prices the risk, most of the allocation has happened. Risk transfer is therefore a capital-allocation decision, and it is taken early. It also cuts across functions: each of these shifts is owned by a different team on its own clock, so the position across all five rarely belongs to anyone.

That timing decides which options are still open. Early on, all three routes are open: put each exposure in the contract with a party that can hold it, transfer it to a market that will take more than most projects ask of it provided the risk can be evaluated, or size and fund what is left on purpose. Later, the contracts are already signed, what the market will take is limited by what those contracts agreed, and the remainder is whatever nobody else took.

The projects that get built, financed and let on the best terms are the ones whose sponsors can say, exposure by exposure, who holds it.

Report

Building and financing digital infrastructure

Five changes over the past year have altered what a digital infrastructure project commits to, and what risks it is exposed to:

Who buys the capacity?

Who funds it?

How it gets its power?

What governments require of it?

What communities ask of it in return?

Part 1: Five shifts transforming digital infrastructure risk

Part 2 – What it takes to keep these projects financeable and deliverable

Our people

Damien Renaudeau

Serena France-Hayhurst

Kate Fairhead

Jason Payne

Related insights

Contract Risk Management 2026

Risk in Context Podcast: Leveraging site selection as a strategic data centre success driver

Middle East conflict: How geopolitical risk is reshaping data centre resilience and investment

Emerging Technologies & Risk Management in Data Centres

Building and financing digital infrastructure

Five changes over the past year have altered what a digital infrastructure project commits to, and what risks it is exposed to:

Who buys the capacity?

Who funds it?

How it gets its power?

What governments require of it?

What communities ask of it in return?

Part 1: Five shifts transforming digital infrastructure risk

1. Demand: new, young companies have their own requirements

2. Financing: private capital is growing in importance

3. Power: the project is becoming an energy business

4. The state: governments are increasingly interventionist

5. Consent: communities decide whether the project proceeds

Part 2 – What it takes to keep these projects financeable and deliverable

Structure it

Transfer it

Retain it

Risk transfer is a capital-allocation decision

Our people

Damien Renaudeau

Serena France-Hayhurst

Kate Fairhead

Jason Payne

Related insights

Contract Risk Management 2026

Risk in Context Podcast: Leveraging site selection as a strategic data centre success driver

Middle East conflict: How geopolitical risk is reshaping data centre resilience and investment

Emerging Technologies & Risk Management in Data Centres