Germany is about to loosen the efficiency rules for the buildings that will run its AI economy, and it has already widened the cybersecurity rules for them. The two moves tell us how the country regulates digital infrastructure.
On 23 October 2026, a guest piece in netzpolitik.org reported that the coalition plans to weaken the data-centre provisions of the Energy Efficiency Act (EnEfG). It would raise the permitted power usage effectiveness (PUE) values and add exceptions to the waste-heat reuse requirements. The Bundestag is expected to pass the amendment in November. The article gives no new PUE figures, and it does not link to the draft text. Anything beyond the outline is therefore unverified.
The case for the rules being rolled back
Begin with the strongest argument for the government's side. The current law is demanding. Under § 11 EnEfG, data centres commissioned from 1 July 2026 must reach a PUE of at most 1.2. They must also reuse a share of their energy: at least 10% from July 2026, rising to 20% for facilities commissioned from July 2028. A target of 20% waste-heat reuse only works if a district-heating customer sits next to the site. In many places, no such customer exists. A rule that no operator can meet does not save energy. It moves investment to Ireland, the Nordics or the US. Germany has set out to double IT capacity from roughly two gigawatts to more than four by 2030, and netzpolitik says the AI share is to quadruple. Rules that block that build-out carry a real economic cost, and the government has a point when it asks whether every site should face the same test.
The case against a quiet retreat
The critics' argument is also strong. Netzpolitik cites an analysis by the Umweltinstitut, Fraunhofer ISI and AlgorithmWatch. It says the weakened rules would mean about 9 TWh more electricity use in 2045 and about 10 TWh less waste heat use. That analysis is not one I could check independently, and it is an advocacy-side estimate. Yet the underlying point stands. Existing facilities reach an energy reuse factor of just under 3%, according to the same article, so the baseline is poor. The government's case would be stronger if it were backed by public data on which sites cannot comply and why.
The data are thin. The first national data-centre register, published in mid-August 2026, lists 319 facilities by name and 166 anonymously. Netzpolitik puts the number of reporting-obligated facilities at about 1,000. So fewer than half have disclosed anything by name, and policy is being loosened before the evidence base exists. If regulators cannot see the sector, they cannot calibrate rules for it, whether strict or lenient.
Where NIS2 fits
The netzpolitik report does not mention NIS2 or KRITIS. The link is mine, and it is an analytical one. Germany's NIS2 implementation law entered into force on 6 December 2025. According to Reed Smith, it expands the BSI Act's scope from about 4,500 regulated organisations to roughly 29,500. Covered entities must register with the BSI, report significant incidents and document risk management. The BSI's own page states that the statutory registration deadline has already passed and tells entities that have not registered to do so at once.
Data centres sit squarely in this regime. Recital 35 of the NIS2 Directive says the directive covers providers of data centre services that are not cloud computing services. It excludes in-house corporate data centres owned and operated by the entity concerned. Whether a particular operator is "important" or "essential" depends on its size, so the two obligations overlap only partly. An operator subject to the efficiency register and to BSI oversight now answers to two regulators with two sets of data, and the register shows that neither set is complete.
What good oversight looks like
The sensible response is neither to defend every EnEfG number nor to cheer the retreat. Three principles follow.
- Keep the rules measurable. If PUE and reuse targets change, the new values should be published with the data that justify them. Weakening a standard without showing who could not meet it leaves the policy open to the charge of simply following lobbying.
- Fix the register first. A register where roughly half of the reporting-obligated sites have not disclosed by name cannot support either strict or lenient policy. Complete data is cheap and benefits everyone, operators included.
- Do not let the two regimes drift apart. Efficiency and cybersecurity rules both govern the same facilities. A single reporting channel, or at least shared identifiers, would cut compliance costs for operators and give regulators a joint picture of the sector. That is proportionate regulation: the lightest rule that achieves a defined goal.
The EFF made a related argument about AI security in September. In its submission to lawmakers, it urged that rules be grounded in documented risks and proven practice, so that they stay useful as technology changes. That advice transfers well to infrastructure policy. Rules grounded in measured outcomes can be defended when they tighten and when they loosen.
Bottom line
Germany can reasonably decide that a 1.2 PUE and a 20% reuse factor are the wrong tests for every site. It cannot reasonably decide this without data. The Bundestag has weeks to ask the ministry for the numbers behind the amendment, and it should.