Governing the Unmeasured Load: Hyperscale Data Centres, Systemic Risk and the Assessment–Management Gap in EU Law

Abstract European Union law regulates hyperscale data centres through four distinct risk frameworks: energy efficiency, electricity market design, critical-infrastructure resilience and artificial-intelligence safety. None was designed for very large, rapidly fluctuating, geographically concentrated electrical loads. This article argues that the resulting regime is not incoherent, but arrested at the assessment stage of the risk-regulation cycle. The Union has created mechanisms for collecting information about data centres while withholding Union-level instruments capable of converting that knowledge into risk management. The Commission’s first assessment under Article 12 of the recast Energy Efficiency Directive, published in July 2025, illustrates this gap: it captured some 770 reporting facilities, by the Commission’s own estimate only about one third of those obliged to report. Subsequent developments – the final ENTSO-E report on the Iberian blackout of April 2025, the Commission’s June 2026 Cloud and AI Development Act proposal, and Ireland’s December 2025 connection decision – show the consequences. Member States and regulators are improvising uncoordinated management tools across the Union. Drawing on the engineering and energy-systems literature as well as on legal scholarship, the article characterises the hazard posed by hyperscale artificial-intelligence loads and proposes three reforms: load-class categorisation in connection codes; a graduated linkage between industrial-policy benefits and rated energy and grid performance; and cost-causation discipline in network tariffs. It concludes by examining the precautionary principle where uncertainty concerns infrastructure behaviour under stress rather than technological harmfulness.