Safeguard
Industry Analysis•

How an AI lab picks a data centre site: a step by step walk through

A step by step look at how an AI lab narrows a site, from workload and megawatts to grid, permits, law and chips, with sourced real examples.

Safeguard Security Team
15 min read

An AI lab picks a site by passing gates in order: what the workload needs, how many megawatts and by when, which places can supply and connect that power in time, whether the law allows the build and the chips, and whether a builder can deliver. A place that fails an early gate is dropped.

This is an explainer built from public documents, not an account of any company's internal process, which none of them publish. The nine steps are a reading aid, not a published method. The numbers and examples attached to them are labelled by source and date.

Key numbers at a glance

  • Federal permitting threshold, US: a data centre project is one needing more than 100 megawatts (MW) of new load; qualifying projects include those with at least 500 million dollars of committed capital. Executive Order 14318, 23 July 2025.
  • US data centre electricity use: 58 terawatt hours (TWh) in 2014 and 176 TWh in 2023, about 4.4 percent of US electricity; estimated 325 to 580 TWh, or 6.7 to 12 percent, by 2028. US Department of Energy summary of a Lawrence Berkeley National Laboratory report, 20 December 2024.
  • US power plant interconnection queues: about 1,312 GW of generation and 749 GW of storage waiting at the end of 2025; median wait from request to operation over 5 years for projects built in 2025 in regions with data. Lawrence Berkeley National Laboratory, Queued Up 2026 edition, May 2026.
  • PJM summer peak forecast: 222,106 MW in 2036, up 65,733 MW over ten years, growing 3.6 percent a year on average. PJM, posted 14 January 2026.
  • Anthropic US build-out: Texas and New York sites, custom built, partner Fluidstack, about 800 permanent and 2,400 construction jobs, online through 2026. Anthropic announcement.
  • Anthropic April 2026 statement: the vast majority of new TPU capacity (expected from 2027) will be sited in the United States. Anthropic, 6 April 2026.
  • Ireland: data centres used 22 percent of metered electricity in 2024. Central Statistics Office, Ireland.
  • US industrial electricity price, July 2026: 9.77 cents per kilowatt hour average; Texas 7.07, Ohio 10.95. EIA preliminary data.
  • UAE: BIS announced on 10 July 2026 that the UAE Government and certain companies are approved to receive advanced computing items license-free; the Federal Register rule is dated 14 July 2026.
  • Stargate UAE: a 1 GW cluster inside a 5 GW UAE and US AI campus in Abu Dhabi; first 200 MW phase expected in 2026, the only phase with a stated timeline. G42 spokesperson via Gulf News, 16 October 2025.
  • Stargate UAE first phase timing: "third quarter of next year", with more than 5,000 people on site. Mubadala chief executive Khaldoon Al Mubarak, reported by The National, 5 December 2025.
  • EU AI gigafactories planned: up to seven sites of more than 100,000 advanced processors each. European Commission, as of 19 October 2026.

Step 1: define the job

Everything starts with what the machines will do. Two broad workloads behave differently.

  • Training builds or improves a model. It runs for weeks on tightly connected chips and can be far from users. Power and space matter most.
  • Inference answers customer requests. It needs to be reliable and reasonably close to users, and it is often split across several sites.

That split is general engineering, not a claim from one source. It drives the rest. A training campus can go where power is plentiful, even a remote area. An inference site is chosen with customers, network links and data rules in mind.

Anthropic's own wording shows how labs connect demand to capacity. Announcing its US investment, the company cited rising demand for Claude from business customers (over 300,000 at the time), research needs and cost effectiveness as reasons for the build.

Step 2: turn it into megawatts and a date

Labs think in power, not floor area. A megawatt (MW) is a million watts of continuous draw, and a gigawatt (GW) is a thousand megawatts. Sizing the first phase and the full build, and the dates each must be ready, produces the question that matters: where can this much power be delivered by then?

The US order on permitting shows the scale it treats as large: more than 100 MW of new load. The PJM forecast shows what a grid operator is planning for: summer peak up 65,733 MW over ten years across its region. Put another way, the new data centre load is a meaningful part of what whole regions are planning to add.

The national trend points the same way. The Department of Energy's December 2024 summary of the Lawrence Berkeley National Laboratory report says US data centres used 58 TWh of electricity in 2014 and 176 TWh in 2023, and estimates 325 to 580 TWh by 2028. A terawatt hour is a million megawatt hours. The wide range is the point: the report gives scenarios, not a single forecast, because chip efficiency, AI adoption and build speed are all uncertain. A lab sizing a campus is one of the inputs to that range, and also one of the parties exposed to it.

Step 3: shortlist by power, not by map

A shortlist usually begins with places where power is already available or can plausibly be added. Three things get checked.

Price. The EIA table for July 2026 shows a US industrial average of 9.77 cents per kilowatt hour, from 7.07 in Texas to 10.95 in Ohio. Europe's spread is wider in Eurostat's mid-sized business band, from 0.0970 euros per kilowatt hour in Sweden to 0.2552 in Ireland. Large buyers often fix the price for years through a power purchase agreement (PPA), a long contract to buy electricity from a generator at an agreed price. Table prices are only a starting point for those talks.

Source. Some labs and buyers want electricity from specific sources, such as low carbon or round the clock supply, which narrows the list further. Contract terms are rarely published in full, so outsiders usually see only the announcement.

Headroom. Ireland shows why a place with an established cluster can be harder: data centres there used 22 percent of metered electricity in 2024, up from 5 percent in 2015. Headroom is the unglamorous gate that removes many candidate places.

Step 4: test the grid connection and the timeline

Having power in a region is not the same as being connected to it. An interconnection queue is a waiting list for connection requests, and operators now sort real requests from speculative ones. PJM says near-term forecast years need firm commitments, such as signed service obligations or construction commitments, while longer-term projects are treated as non-firm and reduced. It also says its 2026 forecast is lower in the near term through 2032 than the 2025 forecast, partly because of these adjustments.

For a lab, that means two things. First, a signed commitment to pay for connection can move a project ahead. Second, a site that looks cheap on power may still lose on time. A 12 month delay in a field where capacity is the product is costly.

The queue for new power plants shows how long the supply side can take. Lawrence Berkeley National Laboratory's Queued Up report, 2026 edition (May 2026, data to the end of 2025), counts about 8,200 projects seeking connection, with 1,312 GW of generation and about 749 GW of storage. Active queue volume fell 10 percent from a year earlier because withdrawals outpaced new requests. Natural gas in the queue rose 86 percent to 253 GW. For regions with data, the median project built in 2025 took more than five years from interconnection request to commercial operation. Of capacity that asked to connect from 2000 to 2020, only 13 percent had reached operation by the end of 2025 and 75 percent had withdrawn.

Those figures describe generators, not data centres, and they are national. They still matter to a site decision, because a campus that depends on new local generation inherits that generation's wait. That is one reason labs favour regions with spare capacity today, or plan their own on site supply.

Some governments try to shorten this step. The UK's January 2025 plan proposes AI Growth Zones with streamlined planning and quicker clean power provisioning, and names Culham as a first site, citing its grid connection.

Step 5: check permits, land and water

Permits are the step that surprises outsiders. Land use, environmental review, road and water access all need approval, and each has its own timetable. The US Executive Order 14318 aims to speed federal reviews: it tells agencies to look for categorical exclusions under the National Environmental Policy Act, uses a public permitting dashboard, sets a 180 day target for certain Army Clean Water Act permits and lists federal sites. It covers federal permits only, not state or local ones.

Water and cooling enter here, because a design that needs lots of water may meet local opposition even if the grid is ready. Two kinds of use are worth separating. Direct use is water consumed on site, mostly by evaporative cooling. Indirect use is water consumed by the power plants that supply the site. A design with closed loop liquid cooling can cut direct use but may need more electricity for chillers on hot days, so the choice trades one local resource against another. Site specific water figures are rarely published before a permit hearing, which is where they usually first appear.

Step 6: run the legal gates on data and chips

Two legal questions can end a site early.

Where will customer data be processed? Some customers need regional processing. AWS announced a European Sovereign Cloud on 15 January 2026 with a first region in Brandenburg, Germany. Microsoft described a European governance board and a completed EU Data Boundary. Our explainer, AI data residency and sovereignty, covers what such offers do and do not include.

Can the chips go there? The US Bureau of Industry and Security (BIS) licenses advanced chips by destination and by buyer. On 31 May 2026 it confirmed that a licence is required for such items going to entities headquartered in, or with an ultimate parent headquartered in, Country Group D:5 or Macau, wherever they are located. On 10 July 2026 it announced favourable treatment for the UAE. See AI chip export controls explained. A country with excellent power and a hard licensing path is a poor choice for a lab that needs the newest chips on a fixed schedule.

Step 7: pick who builds and operates

Labs rarely build alone. Anthropic named Fluidstack as its partner for the Texas and New York sites and said it chose the firm for its agility and ability to provide "rapid delivery of gigawatts of power." Others lease from cloud providers or from operators with existing sites. Choosing the builder is part of choosing the site, because the builder's track record on power and permits decides how fast the capacity arrives.

Step 8: add network, talent and trust

Fibre, subsea cables, and nearby engineers affect operating cost and reliability. Trust enters through the government relationship and through public attitudes. Anthropic's 14 October 2026 Singapore announcement is a reminder that an office, a government agreement and a data centre are three different decisions: it described an office and a memorandum of understanding with the Ministry of Digital Development and Information, and did not mention a data centre.

Step 9: stage the commitment

Few projects go from idea to full build in a single step. Letters of intent, option agreements and phased contracts let a lab stay flexible. The general lesson is to separate announcements from commitments: look for signed contracts, secured power and permits, and for which phase each date applies to.

A real case: how Stargate UAE was staged

Stargate UAE shows several of these steps in public. Gulf News reported on 16 October 2025 that the project is a 1 GW AI cluster inside a larger 5 GW UAE and US AI campus in Abu Dhabi. It is being developed by Khazna Data Centers, a G42 company, with OpenAI, Oracle, Nvidia, Cisco and SoftBank as partners, and it was announced in May 2025. A G42 spokesperson said work was progressing on the first 200 MW, expected to be completed by 2026, and that the rest of the cluster and the wider campus did not yet have confirmed completion timelines.

Map that onto the steps. Step 2 is visible in the phasing: 200 MW first, inside 1 GW, inside 5 GW, with only the first slice dated. Step 6 is visible in the chip question. The National reported on 5 December 2025 that Mubadala chief executive Khaldoon Al Mubarak described the first phase as due in the third quarter of 2026 and tied the UAE's chip numbers to a US export authorisation, which he said would take the country from "a couple of thousand" chips to up to 35,000. The 10 July 2026 BIS announcement on the UAE, covered in Step 6, came later. Step 7 is visible in the builder: Gulf News reported that Khazna is using a design to build approach to speed the first phase.

What the public record does not show is equally useful. Neither report describes the power source or supply contract, and no completion date has been published for anything beyond the first 200 MW. Whether that phase opened on schedule should be checked against a current company statement.

For the money side, see Anthropic's compute commitments and OpenAI's commitments. The overview of factors is in why labs pick one country over another.

What is firm and what is uncertain

Firm: the executive order text, the PJM forecast text, the Department of Energy summary, the Berkeley Lab queue data, the Irish statistics, the company statements from Anthropic, AWS and Microsoft, and the BIS documents.

Uncertain: the nine step order is a reading aid, not a published method. Stargate UAE timing comes from press reports of company and investor statements made in late 2025, and the first phase's status should be confirmed against a current statement. Queue times are national medians for power plants, not data centres. No lab publishes its internal site scoring, water use per site or tax terms, so none are given here. Price tables change monthly.

What to watch next

  • Whether the first 200 MW of Stargate UAE is confirmed as operating, and when later phases get dates.
  • The next Queued Up edition, and whether wait times keep rising.
  • Which AI Growth Zones and EU gigafactory sites are named.
  • New BIS rules or country reclassifications.
  • Whether more grid operators adopt firm commitment tests.

If your team wants to see what software and AI components your own systems depend on, Safeguard offers SBOM and dependency scanning, with a free scan at https://gold.safeguard.sh/scan.

Quick check

What is the first thing a lab decides when choosing a site?

What the machines will do, training or inference, and how many megawatts are needed by what date. Everything else is checked against that.

Why can a cheap power price still lose a site?

Because connection time, permits, chip licences and the builder's record can cost more than the price difference saves. Time to capacity often matters most.

Does an announced site mean a data centre is being built?

Not always. Letters of intent and offices are early steps. Look for signed contracts, secured power and permits before treating it as firm.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.