Data center construction starts in the United States hit $81.5 billion in the first six months of 2026. That is more than all of 2025 and roughly three times what was built in 2024. The average project now runs close to 700,000 square feet, and the map has shifted: Illinois, Indiana, and Michigan each passed $10 billion in starts this year, and the pipeline is moving toward the Midwest because that is where the power and the water are. I have sat in county board meetings in Iowa where the only agenda item was a data center ordinance. This is not a coastal story anymore. It is a story about your county, your grid, your contractors, and your labor pool.
What almost nobody is talking about is that a data center is one of the most hazard-dense buildings a mid-size community will ever host, and the EHS function that is supposed to manage it mostly does not exist yet. The hyperscalers have programs. The general contractors have programs. The 40 subcontractors on site, the regional electrical firm that just tripled its headcount, the fuel supplier, the battery integrator, the county emergency planner, and the manufacturer down the road whose skilled trades are getting hired away do not. That gap is where people get hurt, and it is where the liability lands.
What is actually inside the box
Strip the marketing off a data center and you have an industrial facility with four overlapping hazard classes that rarely share one roof anywhere else.
Energized electrical work at scale. A single hyperscale campus can draw hundreds of megawatts. Medium-voltage switchgear, transformers, busway, UPS systems, and thousands of feet of feeder run through the building, and the commissioning schedule means much of it is energized while construction is still happening around it. Arc flash is the defining hazard of this building type. NFPA 70E is not a suggestion here; it is the operating system. Every contractor touching the electrical infrastructure needs an arc flash study that matches the current configuration, not the one from the design set, and a qualified-person program that means something.
Stored energy that burns. Modern facilities pair the UPS with lithium-ion battery energy storage, sometimes at the megawatt-hour scale. Thermal runaway in a lithium battery room is a different kind of fire: it produces its own oxidizer, it releases hydrogen fluoride and other toxic gases, and it does not respond to the suppression systems most fire brigades train on. NFPA 855 governs installation, but the operational side, meaning inspection, state-of-charge management, off-gas detection, and emergency response coordination with a rural volunteer fire department, is where the plan usually stops.
Combustion and air permits. Backup generation means diesel: dozens of gensets, each with its own fuel storage, each an emissions source. A campus with 100 megawatts of backup diesel is a major source under the Clean Air Act by any reasonable reading, which means Title V or synthetic minor permitting, testing obligations, run-hour tracking, and an SPCC plan for the fuel. I have watched sites treat the generators as “the electrical contractor’s problem” until the state air agency showed up.
Refrigerants, water, and chemistry. Cooling is the other half of the power budget. Chillers carry refrigerant inventories that can trigger EPA Section 608 and, at scale, process safety questions. Evaporative cooling means water treatment chemistry, meaning HazCom, meaning Tier II reporting to the local emergency planning committee that may never have received one from a facility this size. Ammonia and CO2 systems are showing up as alternatives, and each brings its own rulebook.
Any one of these would justify a dedicated safety professional at a manufacturing plant. A data center has all four, in one building, on a compressed schedule, with a contractor population that turns over weekly.
The build phase is where the exposure peaks
Operationally, a finished data center is a fairly quiet place. Low headcount, controlled access, mostly monitoring. The danger is concentrated in the 18 to 30 months of construction and commissioning, and it is driven by three things.
The first is density. A large campus can have 2,000 to 5,000 workers on site at peak, from dozens of employers, working around the clock. Fall protection, ladders, scaffolding, and eye protection are OSHA’s most-cited construction standards every year for a reason, and this is construction at a pace and scale most regional subcontractors have never seen. The multi-employer worksite doctrine means the general contractor and the owner carry exposure for what those subcontractors do, which is why the hyperscalers write contractor prequalification requirements that are more demanding than anything most Midwest trades have had to meet.
The second is sequencing. Energization happens in phases while construction continues. The moment the first switchgear goes live, the site stops being a construction project and becomes a construction project inside an energized industrial facility. Lockout/tagout, which was OSHA’s fourth most-cited standard in fiscal 2025 with over 2,100 violations, becomes the daily discipline. So does the coordination between the commissioning agents, the electrical contractor, and everyone else who now needs to know which rooms are live.
The third is the labor market. These projects pay well and hire fast. The experienced electricians, pipefitters, and equipment operators come from somewhere, and in a rural county that somewhere is the existing manufacturing base. The plants that lose those people backfill with less-experienced workers, and their injury rates move. I have seen it on the OSHA logs of manufacturers 30 miles from a major project. The data center’s safety problem does not stay inside the fence.
Why the current model leaves a gap
The owners and the tier-one general contractors generally have strong programs. The gap is everywhere else, and it is structural.
Regional subcontractors are being handed prequalification packets from ISN, Avetta, or the owner’s own system that ask for written programs they do not have, training records they cannot produce, and an EMR and TRIR that will be judged against a national bar. A 60-person electrical firm that has never needed a formal arc flash program now needs one to get on the bid list. Most of them are trying to build it in a weekend, with a template, because the project starts Monday.
County and municipal agencies are being asked to permit and plan for facilities that do not fit their experience. The LEPC that has been handling a grain elevator and a propane distributor now has a Tier II filing for a multi-megawatt-hour lithium battery installation, and the fire chief has 14 volunteers.
The manufacturers nearby, whose EHS function was already thin, are now competing for the same trades and the same safety talent. The market for a competent safety professional in a county with a data center project under way is not the market it was two years ago.
And the owners, for all their sophistication, are managing dozens of sites through a handful of corporate EHS people and a matrix of contractor requirements. They need the local ecosystem to be competent. They cannot make it competent themselves.
What senior EHS judgment looks like on a data center project
This is a building type that rewards the person who has run electrical safety, process safety, environmental permitting, and contractor management at the same time, usually in a Fortune-scale industrial setting. That is a specific skill set, and there are not many of those people. There are certainly not enough to put one at every subcontractor and every county office in the Midwest.
The work itself is not mysterious. For a subcontractor entering this market, it means a real arc flash and electrical safety program tied to NFPA 70E, a lockout/tagout procedure that survives a multi-employer energized environment, a fall protection plan that reflects the actual work, a training matrix that produces records on demand, and a prequalification score that clears the bar before the bid, not after. For an owner or GC, it means a site-level EHS structure that treats the trades as partners to be raised rather than risks to be excluded, an emergency response plan that has actually been walked with the local fire department, and environmental compliance that was designed in rather than discovered at the air permit hearing. For a community, it means someone who can read a Tier II submission and a battery hazard mitigation analysis and tell the county what they actually mean.
None of that requires a full-time hire at a 60-person contractor. It requires a senior person who can build the system, review it, sign it, and hand the daily execution to people who can run it. That is the model I built FractionalEHS around, and data centers are the clearest case for it I have seen. The hazard density demands senior judgment. The economics of a regional contractor cannot carry a senior salary. The timeline does not allow for a 90-day search. The middle is where the fractional model lives.
What to do before the project reaches your county
If you are a regional contractor, get your prequalification house in order now, before the packet arrives. Pull your OSHA 300 logs for three years, know your EMR and TRIR, and be honest about which written programs you actually have versus which ones are a title on a binder. The gap between your current state and a hyperscaler’s contractor requirements is measurable, and it can be closed in 90 days if you start before the bid.
If you are a manufacturer within commuting distance of a project, plan for turnover. Your experienced operators and maintenance techs are going to get offers. Your training system, your supervisor competency, and your incident investigation process need to be strong enough to absorb a wave of new people without your injury rate moving. Look at your log now, because it is your baseline.
If you are an owner, a developer, or a lender, treat the local EHS ecosystem as a project risk on the same tier as power delivery and water rights. A community that cannot staff, inspect, or respond to your facility is a schedule risk and a liability risk, and it shows up on the cost side eventually. Investing in the competence of your local trades is cheaper than the alternative.
If you are a county, ask for the hazard analysis and the emergency plan in a form your own responders can use, and get someone in the room who can tell you whether the answers are real.
The build-out is not slowing down. Every one of those 116 projects that broke ground this year will spend the next two years as the most hazard-dense workplace in its county. The question is whether the safety infrastructure around it grows at the same rate as the building. Right now, in most places, it is not.
Key takeaways
- A data center is four industrial hazard classes in one building — energized electrical work at megawatt scale, lithium battery storage, diesel combustion and air permits, and cooling chemistry — on a schedule that keeps them all active at once.
- Exposure peaks during construction and commissioning, when thousands of workers from dozens of employers work around progressively energized infrastructure, and lockout/tagout becomes the daily discipline.
- The gap is in the ecosystem, not the owner — regional subcontractors, county responders, and nearby manufacturers absorb the risk without the programs, the people, or the budget to manage it.
- Senior judgment, not headcount, closes the gap — build the arc flash, LOTO, prequalification, and environmental systems once with someone who has run them at scale, then hand daily execution to people who can run it.
- Start before the packet arrives — your OSHA logs, EMR, and written programs are your baseline, and 90 days is enough to close the distance if you begin before the bid.
Related reading: OSHA and EPA After November: Enforcement Is Cyclical. Your Exposure Isn’t. · Risk Assessment Is an Art Disguised as a Spreadsheet
