PUBLIC LAW DIVISION
The expansion of artificial intelligence is turning data centres into strategic infrastructure, but also into major consumers of electricity, water and grid capacity. Against this backdrop, the Government has promoted a draft Royal Decree aimed at subjecting their development to stringent requirements concerning energy and environmental sustainability, resilience and digital sovereignty.
Royal Decree-Law 7/2026 empowered the Government to establish these conditions. Accordingly, the legal debate is not so much about whether the Government has regulatory powers in this area, but rather about the limits on the exercise of those powers.
One of the most significant measures is the requirement for data centres to cover a high proportion of their electricity consumption through new renewable generation, together with hourly matching mechanisms. The aim — to reduce the impact of growing electricity demand — pursues a legitimate public interest and is aligned with European decarbonisation objectives. However, Article 129 of Law 39/2015 requires regulatory restrictions to be necessary, proportionate and consistent with the principle of legal certainty.
This issue is particularly relevant to projects that are already under development or even hold grid access and connection permits. Regulatory conditions may legitimately be amended, but such changes must be weighed against the principle of legitimate expectations, particularly where operators have made significant investments in reliance on the previous regulatory framework. There is no right to regulatory rules remaining unchanged, but nor is it irrelevant when regulatory change frustrates advanced projects and financial commitments that have already been undertaken.
Another contentious issue is the introduction of substantial financial surcharges for failure to comply with certain requirements. Their justification will have to rest on objective and proportionate criteria. If such surcharges are purely compensatory in nature, they should bear a reasonable relationship to the costs that the breach causes the system; if their purpose is essentially punitive, the safeguards applicable under administrative sanctioning law will come into play.
This is compounded by the dimension of digital sovereignty, through requirements relating to the protection and location of certain data. The measure reflects a growing strategic concern in Europe, although it will have to be implemented in compliance with EU law and the principles of proportionality and the freedom to provide services. The challenge, therefore, is not to choose between data centres and sustainability. It is to strike a balance between the energy transition, system security, technological sovereignty and the freedom to conduct business.
Spain has significant advantages when it comes to attracting investment linked to artificial intelligence. Precisely for this reason, the future regulatory framework will need to combine environmental ambition with legal predictability. An excessively flexible regulatory approach could shift the costs of this new industry onto consumers as a whole, whereas an excessively rigid framework could drive investment towards other markets.
The underlying issue is straightforward, but of fundamental importance: how can data centres be regulated without turning sustainability into a barrier to innovation or legal certainty into the cost of the digital transition? Ultimately, the key legal question can be summed up as follows: how can the State require new digital infrastructure to be sustainable without disproportionately altering the rules on which investments have been built? The answer will require a careful balance between the public interest, environmental protection, the freedom to conduct business and legal certainty. That balance will determine Spain’s position in the growing European competition to attract the infrastructure underpinning artificial intelligence.
