Germany is running two regimes for the same buildings, and they point in opposite directions. Under NIS2, data-centre operators sit inside a registry the Federal Office for Information Security (BSI) is actively building. Under the Energy Efficiency Act (EnEfG), the government wants to relax what those same operators must deliver on power and heat. The two regimes are not formally linked. Read together, they show what a proportionate rule looks like and what a weakened one risks.
What the government is actually changing
According to trade-press coverage of the cabinet's 24 June 2026 draft, the required power usage effectiveness (PUE) for existing data centres would rise from 1.5 to 1.6 from mid-2027, and from 1.3 to 1.4 from 2030. New builds keep a PUE target of 1.2, but the time allowed to reach it stretches from two to four years, measured as an annual average. The draft also moves the 100 percent renewable-electricity duty from 2027 to 2030. It replaces the general waste-heat duty with a cost-benefit analysis without binding implementation, and lifts the scope threshold from 300 kW connected load to 500 kW installed IT capacity (cloudmagazin). I could not confirm from the sources I reached the reported renaming of the section from 'climate-neutral' to 'energy-efficient' data centres, so I do not rely on it here.
The same coverage says the amendment is partly meant to end an EU infringement procedure over Germany's late transposition of the Energy Efficiency Directive. It also ties the relaxation to the government's AI-location policy and its March 2026 data-centre strategy.
In a guest commentary on netzpolitik.org, Leonard Burtscher of the Umweltinstitut München argues the government is yielding to Big Tech. He cites the strategy's goal of lifting IT capacity from about two gigawatts to more than four by 2030, and a Borderstep study projecting data-centre demand of about 80 terawatt-hours by 2045 (netzpolitik.org). This is advocacy by an environmental group, not newsroom reporting, and it should be read that way. I have not read the bill text itself.
The strongest case for the critics
The critics' case is serious. Efficiency rules matter most when demand is exploding, because every watt that is wasted must be generated and delivered by a grid that is already congested. Waste heat is a local public good that disappears once a facility is built without a way to export it. If the cost-benefit analysis has no binding follow-through, operators have little reason to pay for heat connections that their neighbours would use. The commentary also notes that the lobbying group LobbyControl has documented overlaps between the draft and Big Tech position papers. That is a legitimate process concern, whatever one thinks of the policy.
Where the retreat is reasonable
PUE is a blunt instrument, and a tighter number is not automatically a better outcome. It says nothing about whether the electricity is clean or whether the compute is useful. A threshold that fits a new hyperscale campus in a cool climate can be disproportionate for a retrofitted urban facility. Moving existing sites from 1.5 to 1.6 is not abandonment. It is a recalibration for older buildings, while new builds keep the 1.2 target. Raising the scope threshold to 500 kW of installed IT power also spares small operators a reporting burden that yields little data.
Germany has a real competitiveness problem. Data-centre capacity is something companies can place in Nordic or Irish markets if the compliance cost and uncertainty are too high. A pro-innovation approach accepts that some flexibility on timing is a fair price for keeping capacity and AI workloads in Germany. Proportionality is not the same as looseness.
What NIS2 shows about the right way to regulate
The contrast with cybersecurity is instructive. The NIS-2 implementation law entered into force on 6 December 2025, and the BSI expected about 29,500 entities to fall under its supervision, up from about 4,500 previously regulated organisations (BSI press release). As of 30 September 2026, BSI figures show 20,373 registrations, including 2,674 in the digital-infrastructure sector, plus 3,070 reports received through the portal (BSI, NIS-2 in Zahlen). The page does not break out data-centre providers separately, so the 2,674 figure covers the whole sector, not only data centres.
These are the features that make the regime work. It sets obligations by risk and size, it builds a registry before it enforces, and it publishes the numbers. That matters here because Germany also maintains a data-centre register for efficiency reporting. Burtscher's commentary reports that the register had named only 319 obligated sites by mid-August 2026, with 166 more anonymous, against his estimate of about 1,000 sites that should be reporting. A regime that cannot see its regulated population cannot enforce any limit, strict or lax.
A proportionate path
The policy question is not whether a PUE of 1.5 or 1.6 is correct. It is whether Germany will measure, publish and enforce whatever number it picks. Three changes would make the relaxation defensible:
- Keep the waste-heat duty binding where a heat network is within reach, and drop it where none is. A blanket cost-benefit test with no follow-through is the weakest option.
- Publish site-level efficiency and energy data on the same cadence the BSI uses for NIS2 registrations, so that the 2030 deadlines are checkable.
- Tie the extended renewable-power deadline to interim milestones, so that the move from 2027 to 2030 is not an open-ended deferral.
A government that wants more AI capacity needs public trust in its infrastructure, on security and on energy. The NIS2 rollout shows Berlin can build a risk-based, transparent regime. The EnEfG amendment will be judged on whether it applies the same discipline or just loosens the numbers. Parliament is expected to take up the bill this autumn, which leaves time to add enforcement before the relaxation takes effect.