AI news ·
National security regulations shape United States artificial intelligence infrastructure development
Regulators use national security tools to control AI data centers without a federal AI law. Pending bills could extend export penalties to a 10-year limit.
Federal regulators are using national security tools to influence the financing, construction and operation of AI data centers, even without a single federal AI law on the books. A new analysis from law firm Morgan Lewis, released in June 2026, warns that developers, investors and operators can no longer treat national security compliance as a niche legal concern - it now affects project financing, vendor selection, customer onboarding and long-term strategy.
The push comes as governments view data centers as critical national assets because they train AI models and process large volumes of sensitive information. U.S. policymakers are turning to investment screening, data security rules, export controls and supply chain regulations to shape who builds these facilities and who gets access.
Investment screening expands beyond traditional export controls
Foreign investments in U.S. data center projects may face review by the Committee on Foreign Investment in the United States (CFIUS), especially when advanced computing or sensitive data is involved. At the same time, newer outbound investment restrictions are starting to affect deals tied to semiconductors, AI and related technologies with overseas links. The report notes that these reviews have become a routine factor in transaction planning.
Data protection rules affect financing and cloud services
Recently adopted Justice Department regulations limit access by "countries of concern" to bulk sensitive personal data and government-related information. Those rules can ripple into data center financing structures, cloud-service agreements and vendor relationships. Companies must now map data flows early in project design to avoid compliance surprises.
Supply chain and export controls tighten
The Commerce Department already has authority to regulate information and communications technology supply chains connected to countries of concern. While data center-specific regulations have not been finalized, existing powers give regulators flexibility to intervene when supply chain risks appear. Export controls on advanced computing components - GPUs, high-performance servers, supercomputing systems and certain AI model-training technologies - have been in place since 2022 and directly affect data center hardware procurement.
Regulators are also shifting focus from technical specs to how technologies will be used. Companies must consider "catch-all" restrictions tied to end users and end uses, including situations where they have "reason to know" or a "high probability" that equipment could be diverted or misused. That means deeper reviews of customer relationships, financing arrangements and compute-allocation practices. Morgan Lewis cautions that customer certifications alone may fall short when other circumstances raise red flags.
Enforcement trends raise stakes for companies
Enforcement agencies are relying more on "high probability" awareness standards, scrutinizing due diligence failures and requiring stronger documentation and risk assessments. Financial penalties for violations are growing. Pending legislation in Congress could further increase export-control penalties, extend the statute of limitations from five years to ten years, create a whistleblower reward program and broaden regulators' authority over remote access to controlled technologies. The remote-access proposal could have major consequences for cloud computing, infrastructure-as-a-service and AI training environments, because regulators are examining whether remote access triggers export-control restrictions even when hardware stays inside the United States.
Why this matters for IT and development
For technical teams, these rules change how data centers are designed and operated. Procurement of GPUs and high-performance servers now requires export-control classifications and end-use checks. Cloud and infrastructure-as-a-service platforms may need to implement access controls that prevent remote use by restricted parties, even for domestic hardware. IT leaders who integrate national security assessments into architecture decisions, vendor contracts and compliance workflows will avoid delays and penalties as enforcement intensifies.