Constructing data centres: legal considerations in a rapidly scaling UK market (part 3 - testing & commissioning, security and sustainability)

Building on Part 1 and Part 2 of this series, we now turn to the final set of themes shaping legal and commercial risk, and which most frequently drive delay, cost escalation and dispute risk, in UK data centre construction: testing and commissioning; security requirements and sustainability. These stages determine whether a facility is truly “mission‑ready”, and they frequently give rise to the most contentious completion and handover issues. As with earlier blogs, our focus is not on replicating engineering guidance, but on highlighting the contractual implications developers, funders and occupiers should account for when delivering these highly specialised facilities.

Testing & Commissioning: The Critical Path and a Major Source of Disputes

Testing and commissioning is one of the most risk‑sensitive stages of a data centre project. A facility may be physically constructed, but without successful integrated systems testing and reliability demonstration, it cannot enter service. Data centre commissioning typically involves several stages: component verification, system testing, Integrated Systems Testing, and Reliability Demonstration Testing (or soak testing). Each step has specific preconditions and interdependencies, and in practice delays or defects at one stage can quickly cascade across the programme. From a contractual perspective, these stages are also critical in determining:

when Practical Completion can be certified;
when delay damages cease; and
when performance security or retention may be released.

From a legal perspective, contracts should incorporate a detailed commissioning plan as a contract document, rather than an aspirational appendix. This plan should set out clear and objectively measurable:

sequencing;
acceptance criteria;
dependencies;
required OEM attendance
and resourcing responsibilities.

In practice, disputes frequently arise where:

acceptance criteria are not objectively measurable;
responsibility for failure during integrated systems testing is unclear (particularly where multiple suppliers are involved); or
retesting procedures and associated time and cost consequences are not expressly addressed.

Performance guarantees also require careful drafting. Penalties or delay damages tied to commissioning outcomes must be aligned with realistic technical thresholds and supported by clear retesting procedures. In EPC style arrangements, where the contractor bears single-point responsibility, these provisions are often among the most heavily negotiated particularly where performance outcomes depend on third‑party equipment or specialist suppliers.

Security: Physical, Operational and Cyber Considerations

Security requirements in data centre projects extend beyond simple access control. Hyperscalers and financial services clients routinely impose stringent vetting, confidentiality and operational protocols, all of which must be translated into construction-phase obligations. Physical security may require pre‑approval of subcontractors, controlled access zones, and strict site-log management. These restrictions can affect productivity and therefore need to be accounted for in programme estimates and priced risk. As a matter of good contractual practice, these requirements should be clearly identified as Employer’s Requirements (or equivalent), rather than being introduced as operational constraints following contract award. Contract documents should also be clear as to these requirements and main contractors need to ensure that these are properly “flowed down” into sub-contracts.

Cyber risk is also an emerging issue. As more building systems integrate with client networks, particularly Building Management Systems monitoring, remote‑start systems and metering, the construction phase introduces a temporary but heightened exposure. Contracts should expressly require:

secure configuration of systems;
restrictions on external connectivity;
protocols for handling digital commissioning tools; and
immediate incident‑reporting mechanisms.

Confidentiality undertakings also increase in complexity. Restrictions on site photography, data capture, and disclosure of system specifications must be flowed down the supply chain to avoid inadvertent breaches.

Sustainability: From Aspirational Targets to Contractual Requirements

Sustainability considerations are rapidly moving from marketing narratives into binding contractual obligations. Developers and funders are increasingly requiring evidence of carbon reduction across both embodied and operational carbon profiles. At the design stage, this may include obligations to assess and report on embodied carbon, specify low-carbon materials, or justify departures from pre‑agreed environmental baselines. On the operational side, clients may require contractual commitments to efficiency metrics such as Power Usage Effectiveness, Water Usage Effectiveness or energy‑recovery measures.

Aligning these requirements with long-term liability is essential. A key risk area is the distinction between:

deliverables within the contractor’s control (e.g. materials selection, reporting obligations, metering capability); and
operational performance metrics (e.g. PUE), which depend on client use, load and operational management

Contractors will typically resist performance obligations tied to operational parameters outside their control, particularly where future load profiles are uncertain. A balanced contractual approach distinguishes between construction-stage deliverables (such as reporting, metering capability, and materials compliance) and operational performance indicators that depend on client use. Sustainability obligations also increasingly interact with procurement strategies. Framework agreements for multi-site rollouts may include continuous improvement targets, standardised reporting formats, or mandatory supplier‑engagement requirements to demonstrate year-on‑year carbon intensity reduction.

A further complexity is the absence of any universally accepted definition of a “green” data centre. Whilst the term is increasingly used in procurement and planning contexts, the underlying criteria are not always clearly defined, creating a risk of inconsistency and, in some cases, allegations of ‘greenwashing’. In Edinburgh following the refusal of planning permission for a data centre this has led to a call in March 2026 for a moratorium on new data centres until a clear national definition of “green data centre” is provided. From a contractual perspective, this underlines the importance of clearly defined and measurable sustainability obligations. Without agreed parameters, whether in terms of embodied carbon targets, efficiency metrics or certification standards, there is a risk that aspirational language creates ambiguity rather than enforceable obligations.

Conclusion

As the sector continues to scale, the contracts underpinning these projects must evolve to reflect both the complexity of the assets and the expectations of hyperscale and enterprise occupiers. In particular, careful drafting is required to:

align commissioning regimes with completion and payment mechanisms;
allocate security and cyber risk appropriately across the supply chain; and
ensure sustainability obligations are clearly defined, measurable and aligned with risk allocation.

This concludes our three‑part series on construction considerations in the UK data centre market. If you would like to discuss any of the issues raised, or how we can support your project, please contact Kirsteen Milne.