Where your AI runs is now a business decision, not just your provider’s

What happened

The backlash against new data centers was building long before the election. Bloomberg, citing the research group Data Center Watch, reported in September that local opposition blocked or delayed $68 billion of US data center projects in the second quarter of 2026, and that 30 state legislatures have adopted rules on where data centers can go and how much power and water they use. Sightline Climate estimated in February that 30% to 50% of large data centers due online in 2026 would be late, mainly because of grid connections, equipment shortages and local opposition.

The midterms turned that into policy. Texas, which accounts for about a quarter of planned US capacity, elected a governor who wants to suspend new data center permits until protections on electricity bills, water and tax incentives are in place, according to MarketScreener. Goldman Sachs estimates that states likely to tighten rules account for about 45% of planned US capacity. Meta’s president said building in the US “is going to be harder,” and that hyperscalers are weighing building outside the country.

Timing matters here. SemiAnalysis estimates that about three quarters of the capacity expected in 2027 is already under construction. Most of what is modeled for 2028 hasn’t started, so the uncertainty lands in 2028 and 2029.

My view

For most firms, the data center has been someone else’s problem. You choose a model and a cloud region, and the provider worries about the building. That arrangement still holds for next year. It is less safe as a planning assumption beyond that.

Capacity becomes regional and uneven

When new capacity is slower in some regions, it won’t be scarce everywhere at once. It will be uneven. Some regions and some model sizes will have room; others will have waiting lists, higher prices or rationed throughput. A firm whose critical AI workloads all sit in one region, on one provider, with no fallback, is carrying a concentration risk it may not have written down.

Moving offshore is a compliance question

If providers respond by building abroad, the cost might fall, but the data question changes. For a bank, insurer or health company, where a model runs decides which laws apply to the prompts and documents sent to it, which regulators can ask about it and which contracts must cover it. Many firms have data residency rules for storage. Fewer have applied them to inference: where the model reads the data, not just where the data rests. The same goes for the logs and traces an AI system keeps, which often contain the most sensitive content in the whole flow.

Resilience planning hasn’t caught up

Most firms test what happens if a data center or a cloud region fails. Fewer have tested what happens if their AI provider can’t serve them at the volume they need for a week, raises prices sharply or moves a model to another country. For an internal assistant, that is an inconvenience. For an AI step inside claims, payments or customer service, it is an outage, and the business needs to know what happens to the work in the meantime.

Smaller and private options get more attractive

The constraint favors efficiency. Smaller models that do a specific task well, running on capacity a firm already has or on private infrastructure, become more attractive when large-scale capacity is uncertain. That isn’t a reason to abandon frontier models. It is a reason to route each task to the smallest system that does it well, and to keep the option to run some work closer to home. Where sensitive data has to be processed on someone else’s hardware, confidential computing and attestation let a firm verify what is running before it sends the data.

Why it matters

For the industry. Next year’s capacity is mostly built. The decisions that matter are about 2028 and beyond, and they are being made now in contracts and architecture. Firms that treat compute location and continuity as part of their AI plan will have options when capacity tightens. Firms that don’t will find out what their provider decided when the invoice or the outage arrives.

How it connects to our work. Confidential Computing for AI explains attestation-gated key release, so data reaches a workload in another facility only after it proves what it is, and what that does and doesn’t protect. Patterns and Product Fit maps each approved path, including where inference and logs live, to the controls it has to keep. Four steps for the next planning cycle:

• Map where inference happens. For each production AI system, record the provider, region and where prompts, outputs and logs are processed and stored.
• Extend residency rules to inference. Apply your data location rules to where a model reads data, not only where data is stored.
• Test a capacity shock. Rehearse a week of reduced throughput or a region move for your most important AI workflow, and agree the manual fallback.
• Write location into contracts. Require notice before a provider moves your workloads to another region or country, and the right to say no.

Sources

• Local opposition blocked $68 billion worth of data center projects in the second quarter of 2026, Tom’s Hardware, 21 September 2026, reporting Bloomberg and Data Center Watch
• Up to half of the world’s data centers may be delayed this year, Latitude Media, 24 February 2026, reporting Sightline Climate
• Data centers after the midterms: is the AI trade really at risk?, MarketScreener, 6 November 2026, citing Goldman Sachs and SemiAnalysis estimates
• Tech stocks are suffering their biggest selloff since Covid, Fortune, 5 November 2026
• Analysis: Trump’s midterm drubbing demonstrates the power of data centre opponents, Reuters (republished by TimesLIVE), 4 November 2026

Data centersAI infrastructureData residencyResilience

Linked sources are the record. Check them for the full reporting.