These developments follow the House’s 417-3 passage of the Ratepayer Protection Act in September and a range of state actions, including announcements in Texas of audits on data centers and Attorney General investigations, New York’s moratorium on state environmental permits for large data centers, New Jersey’s announced fine against a data center for alleged air pollution violations, and changes to data center tax incentives in several states. For companies that operate, develop, or finance data centers, more immediate considerations may arise less from new federal law than from congressional oversight, state enforcement, and the related disclosure, contracting, and reputational questions.

Background

In July, we wrote about Senator Mark Warner’s proposal addressing AI infrastructure, competition and safety, the workforce, and national security. For more on proposed legislation in the current Congress, please see S. 5061 (AI Development Regulation), S. 5054 (Data Center Disclosure Requirements), H.R. 9925 (AI Governance), and H.R. 9340 (Ratepayer Protection).

On October 7, 2026, Senator Maria Cantwell (D-Wash.), Ranking Member of the Senate Commerce Committee, released a frontier AI governance framework calling for NIST-developed safety standards and independent audits of covered models before release, potentially previewing upcoming priorities in the next Congress. Even so, the most active scrutiny has moved to other venues.

Congressional Oversight: The Warren-Van Hollen-Blumenthal Report (Oct. 9, 2026)

Congressional interest in AI and data centers has drawn members of both parties, as the House vote on the Ratepayer Protection Act suggests, and oversight may continue after the midterm elections. The latest Senate report offers a useful window into the themes investigators are examining.

On October 9, 2026, Senators Elizabeth Warren, Chris Van Hollen, and Richard Blumenthal released a report titled “Power and Profits: How the AI Data Center Boom Costs Households and Communities“ (“report”). The report’s principal assertions are that:

• data center companies are not paying their “fair share” of grid costs and resist “but-for” cost allocation, shifting costs to residential ratepayers;
• routine use of nondisclosure agreements (NDAs) with utilities, landowners, and public officials limits community scrutiny; and
• companies aggressively pursue sales tax exemptions and other incentives, with little evidence that promised jobs materialize.

In an accompanying press release, the senators stated that their “investigation finds the data center industry is bulldozing local communities and using their economic resources to play states and local communities against one another, creating a race to the bottom in which state and local policymakers feel they have no choice but to accede to the data centers’ demands — and leaving ordinary citizens stuck with the bills.”

Congressional reports of this kind can inform subsequent document requests, hearings, and legislative proposals, and they often shape public discussion of an industry in the meantime.

Company Sponsored Bills

Congress is not the only group focused on passing AI legislation. Companies have also drafted bills and circulated them around the hill. One major AI company has drafted a bill that would allow the government to block the release of a model if it posed a foreseeable and imminent risk of over $1 billion in damages or killing/seriously injuring more than 50 people. The risk must also stem from the creation or release of a biological weapon, a cyberattack, or the model evading its controls. Evaluators from the Commerce Department would be tasked with such oversight. The bill would also preempt state law on the disclosure of risk and reporting of critical incidents. Safety frameworks and transparency reports are also part of the proposed bill. Another major AI company has endorsed the Web of Biological Data Act, the AI-Ready Bio-Data Standards Act, the Scale Biology Act, and a key provision of the FRONTIER act focused on model safety assessment.

Spotlight on NDAs and Transparency

The report places particular emphasis on the use of NDAs, which it characterizes as limiting transparency. The report views these agreements as a means of keeping planned data center projects hidden from local communities and competitors. Some industry participants have cited confidentiality, speed, and efficiency as reasons for using NDAs, while others have publicly announced changes to their NDA practices with local governments and other public agencies.

These confidentiality arrangements may carry transactional and reputational risk. According to the report, the Michigan Attorney General is challenging two heavily redacted NDAs between a data center developer and a utility. As this example illustrates, confidentiality provisions can draw public criticism as well as legislative and attorney general scrutiny.

Spotlight on Ratepayer Concerns

Ratepayer protection is another pillar of the report’s concerns. One data center bill that has gained traction is the bipartisan Ratepayer Protection Act (H.R. 9340), which passed the House 417-3 on September 16, 2026, and would direct state utility regulators to consider standards requiring data centers with peak demand of 100 megawatts or more to pay the full incremental cost of serving their load. In the Senate, an effort to pass the bill by unanimous consent was blocked on September 17, a subsequent effort to advance it fell short of the 60 votes needed, and the motion to proceed was withdrawn on September 30. Even so, the House margin suggests that ratepayer cost allocation may be an area of emerging consensus. States, including Alabama, Tennessee, South Dakota, Nebraska, and Florida, have also passed ratepayer protection bills. The federal and state bills all have different thresholds, regulatory mechanisms, and cost recovery standards, but they generally reflect a growing bipartisan concern for energy costs.

State Activity: Attorney General Enforcement and Beyond

While federal legislation advances slowly, state attorneys general are increasingly active on AI and data center issues, both individually and jointly, including through letters to AI companies on AI chatbot quality control and safety, which were signed by 44 attorneys general in August 2025 and by 42 attorneys general in December 2025. As our July alert anticipated, states continue to “differ in how strictly they enforce.”

Texas has been active in data center regulation and enforcement. This August that Governor Greg Abbott directed the Texas Commission on Environmental Quality to pause permits for new data centers pending a state audit by the Electric Reliability Council of Texas (ERCOT) and the Texas Water Development Board (TWDB) of more than 400 data centers, Attorney General Ken Paxton opened two investigations: one investigation into data center developments that did not respond to the TWDB’s water use survey and a second investigation into a proposed AI data center in Taylor on land conveyed for future use as public parkland. New Jersey has also used enforcement to target data centers. In September 2026, the New Jersey Department of Environmental Protection fined one data center $1.07 million for violations of the New Jersey Air Pollution Control Act for installing and operating 62 large natural-gas power generators without the requisite DEP permits.

Other states have acted through executive orders, legislation, and tax policy. According to the report, as of April 2026, 28 of the 38 states that offered some form of tax exemption to the data center industry have introduced legislation to roll back some or all of the incentives to data center industry. New York imposed a statewide one-year pause on state environmental permit applications for data centers of 50 megawatts or more. Maryland Governor Wes Moore signed an executive order creating a task force to review large projects and barring state agencies from entering into new NDAs with data center developers. In September 2026, California Governor Gavin Newsom also signed seven data center bills addressing topics including energy and water transparency, land use, and ratepayer protection. On tax incentives, Ohio Governor Mike DeWine paused consideration of new data center exemption requests. Illinois similarly paused processing agreements for the Data Center Investment Program. Arizona’s recently approved budget imposes a three-year moratorium on data center incentives, and North Carolina repealed its sales and use tax exemption for electricity used in data centers. New Jersey Governor Mikie Sherrill also signed a new bill aimed at increasing transparency of energy and water use of data centers by requiring semiannual reports to the New Jersey Board of Public Utilities.

Key Considerations

In light of these developments, operators, developers, utilities, and their financing parties may wish to consider (1) preparing for evolving water and energy disclosure expectations, including state audits like the Texas TWDB survey; (2) reviewing NDA and confidentiality practices with utilities, landowners, and public bodies in light of continued oversight and, in some states, restrictions on agency NDAs; (3) maintaining documentation that supports community-benefit representations, including job creation commitments made in connection with tax incentives; (4) assessing how large-load tariffs and cost-allocation provisions in utility agreements may be viewed by regulators and the public; and (5) having a plan in place for responding to congressional letters, attorney general inquiries, and civil investigative demands, including document preservation and consistent communications.

Looking Ahead

While most of the federal bills discussed above appear unlikely to be enacted in the remaining time this Congress, the issues they raise are likely to carry into 2027. Collectively, these bills, frameworks, and reports reflect the potential for increasing scrutiny about data centers’ effects on local water usage, energy prices, and the environment, as well as the degree of community engagement and transparency surrounding current and planned projects.

We will continue to monitor congressional oversight and activity by state attorneys general in this space.