The U.S. may lack a comprehensive national regulatory framework for AI, but that isn’t keeping federal regulators from influencing the form and scale of AI infrastructure development.
According to a recent analysis from Morgan Lewis, the financing, construction and operation of AI-focused data centers are increasingly being shaped by a growing web of U.S. national security regulations that extend far beyond traditional export controls. The report argues that developers, investors and operators can no longer treat national security compliance as a specialized legal issue. Instead, it has become a core business consideration affecting everything from project financing and vendor selection to customer onboarding and long-term operational strategy.
The analysis comes as governments worldwide grapple with the strategic implications of artificial intelligence infrastructure. Data centers have emerged as critical national assets because they host advanced computing resources, train AI models and process vast amounts of sensitive information. As a result, U.S. policymakers are increasingly using investment screening, data security rules, export controls and supply chain regulations to influence how these facilities are developed and who can access them.
The report highlights the expanding role of national security review processes in data center transactions. Foreign investments in U.S. data center projects may face scrutiny from the Committee on Foreign Investment in the United States (CFIUS), particularly when facilities involve advanced computing technologies or large repositories of sensitive data. At the same time, newer outbound investment restrictions are beginning to affect investments involving semiconductors, AI and related technologies connected to overseas operations.
WHAT’S NEXT IN ANTITRUST AND TECHNOLOGY REGULATION™
Data protection concerns are also becoming a major factor in project planning. Morgan Lewis points to recently adopted Justice Department regulations designed to limit access by so-called “countries of concern” to bulk sensitive personal information and government-related data. Those rules could have implications for data center financing structures, cloud-service arrangements and vendor relationships.
Supply chain security represents another emerging area of scrutiny. The Commerce Department already possesses authority to regulate information and communications technology and services supply chains involving countries of concern. While officials previously signaled interest in data center-specific regulations, no such rules have yet been finalized. Nevertheless, the report notes that existing authorities provide regulators with substantial flexibility to intervene when supply chain risks are identified.
Export controls have become particularly significant for AI infrastructure. Since 2022, restrictions on advanced computing technologies have affected many of the core components used in sophisticated data centers, including advanced GPUs, high-performance servers, supercomputing systems and certain AI model-training technologies.
Read more: Following EU, Canada Unveils AI Sovereignty Plan
The analysis highlights a notable shift in regulatory thinking. Enforcement agencies are increasingly focusing not merely on technical specifications but on how technologies will ultimately be used. Companies must now consider broad “catch-all” restrictions tied to end users and end uses, including situations where they have “reason to know” or a “high probability” that technologies could be diverted or misused.
To meet those expectations, companies may need to conduct deeper reviews of customer relationships, financing arrangements, compute-allocation practices and other indicators that could signal diversion risks. Morgan Lewis warns that customer certifications alone may not be sufficient when surrounding circumstances raise concerns.
The report identifies several recent enforcement trends that underscore regulators’ increasingly aggressive posture. These include greater reliance on “high probability” awareness standards, heightened scrutiny of due diligence failures, expanding expectations for documentation and risk assessments, and growing financial penalties for violations.
Congress may further strengthen those tools. Pending legislation would significantly increase export-control penalties, extend the statute of limitations from five years to ten years, create a whistleblower reward program and broaden regulators’ authority over remote access to controlled technologies. The latter proposal could prove especially consequential for cloud computing, infrastructure-as-a-service and AI training environments because regulators are increasingly examining whether remote access should trigger export-control restrictions even when hardware never leaves the United States.
As geopolitical tensions and U.S.-China technology competition continue to shape policy, companies that integrate national security assessments into project planning, governance and compliance programs will be better positioned to navigate an increasingly complex regulatory landscape.
