Which law applies to your AI infrastructure?
On the financing behind AI infrastructure, and what it means for a European business.
Last checked: 4 September 2026
The mechanism
Data centres were for years a dull property category. Today they are one of the largest destinations for private capital in the world. The model behind them is notable, and it is rarely explained.
The builder is usually not the user. Private equity funds develop the sites; the large cloud providers lease them. That distinction is what makes the financing possible. Before the first foundations are laid, binding lease agreements are signed with parties of exceptional creditworthiness. Those contracts then serve as security for the project financing. It is not the data centre that carries the credit, but the tenant.
Scarcity has also shifted. The limiting factor for a new data centre is not land or capital, but a connection to the electricity grid. Whoever holds an allocation owns something that cannot quickly be replicated. Land with allocated grid capacity has as a result become an asset class in its own right.
What it rests on
This model rests on one assumption: that demand for AI services will ultimately justify the rents being fixed today. We do not settle that question here. What is established is that the model works for as long as the lease agreements are honoured, and that a European business has no visibility over the considerations underlying them.
The amounts are considerable. According to Dell'Oro Group, the four largest US cloud providers entered 2026 with a combined investment budget of almost 600 billion dollars, and the research firm projects global investment in data centres at 1.7 trillion dollars by 2030. A later estimate revised that expectation to above 3 trillion dollars, close to a doubling against the January 2026 forecast.
How large this market is precisely depends heavily on what is counted. For 2024, estimates circulate ranging from approximately 101 billion dollars to 416 billion dollars, depending on whether only hyperscale facilities are counted, or network infrastructure and equipment as well. Anyone reading a figure about this sector would do well to ask for the definition alongside it.
There are two readings of those same figures, and it is fairer to set out both.
The sceptical reading points out that the investment runs ahead of demonstrable returns. Dell'Oro notes that investment in data centres outside the hyperscalers is in fact being held back by tariffs, monetary policy and uncertainty over the return on AI. Hardware moreover ages quickly, while development costs are written off over far longer periods.
The other reading is equally defensible: the large providers finance this from their own cash flows rather than from debt, and they are playing for long-term market share. Dell'Oro cites precisely that as the reason they continue to invest despite the increased criticism of returns. Anyone arguing that this is a bubble has to explain why parties with this cash surplus would be mistaken.
The Belgian market
The debate on data sovereignty in Belgium often turns on whether data leaves the country. The structure of the market makes clear why that is the wrong question.
There is considerable capacity within the country. Market surveys count approximately 36 data centres in Belgium, operated by some sixteen parties, with the heaviest concentration around Brussels. The largest facility is Google's data centre in Saint-Ghislain, with a capacity of approximately 45 megawatts. Research firms name as the principal investors in the Belgian market, among others, AtlasEdge, Digital Realty, Datacenter United, Etix Everywhere, Google, LCL and Microsoft, with EdgeConneX and KevlinX as more recent entrants. On those same estimates, the Belgian market is growing at approximately 7.7 per cent a year.
Those operators do not fall under the same legal order. Google, Microsoft, Digital Realty and EdgeConneX are US companies or US-listed. Other parties on that list are European or Belgian. The buildings all stand on Belgian territory.
That is where the distinction sits that is rarely made explicit in contracts and tenders: the location of a data centre and jurisdiction over the operator are two different things.
The US CLOUD Act of 2018 requires providers subject to US jurisdiction to produce data in their possession or under their control, regardless of where that data is physically held. Whether a European subsidiary changes that is legally contested. Some authors argue that a subsidiary held by a US parent remains subject to that jurisdiction; the providers themselves maintain the opposite with their sovereign cloud offerings. That debate is not settled, and we do not settle it here.
There is moreover more than one route to the same outcome. In May 2026, Microsoft and other technology companies are reported to have passed the names of staff of the Dutch competition authority and data protection authority to a committee of the US House of Representatives. The basis was not a CLOUD Act request but a congressional subpoena, an instrument by which Congress can compel companies to hand over internal material.
Alongside jurisdiction there is dependency. Pricing and availability of AI capacity follow from the investment decisions of a limited number of parties. If the model described in part 1 comes under pressure, the first visible consequence is not insolvency but a revision of rates and terms.
Four questions about your own environment
This article does not give advice. It sets out the questions that we find organisations are rarely able to answer.
- Which of your AI applications process corporate data on infrastructure subject to non-European jurisdiction? Not where the data centre stands, but which law the provider is subject to.
- Who is contractually your provider, and who is the ultimate parent company? With procured software, that chain is often two or three layers deep.
- What happens to your process if the cost of that service changes substantially within eighteen months, or if the terms are amended unilaterally?
- Which of those applications process personal data, trade secrets or data under sector-specific supervision, for which you carry an accountability obligation of your own?
Anyone who cannot answer these four questions today does not have a risk. They have a blind spot.