(Re)insuring data centres; an evolving challenge

The galloping demand for Generative AI, as well as the constantly increasing internet use in almost all facets of our daily lives, is accelerating growth in the number and size of data centers around the world. 

While the concept of data centers housing computer systems and related infrastructure dates back to the 1940s, they look very different today. These days they’re often vast facilities in which space is leased to numerous, multinational tenants all of which need uninterrupted power for the servers on which their business operations rely. 

Data centers require large amounts of energy to run and, like other buildings, are exposed to severe weather events and other property and casualty risks, with business interruption a critical threat. There is potential accumulation risk caused by numerous tenants operating in the same data center, and with their insurance lead by a relatively small handful of carriers. 

(Re)insurers must be mindful of the risk engineering that goes into the construction and operation of data centers, as well as seeking clarity on what is included in the reinsurance treaties they write.

Vast scale, huge energy demand
Although there is no set definition, a ‘hyperscale’ data center typically covers an area of about 10,000 square feet and contains at least 500 servers. The very largest are equivalent in size to about 13 football pitches. And the world’s biggest data center currently is a colossal 10.7 million square feet.

This enormous size, coupled with the fact that data centers need to be operational 24-hours a day, seven days a week, require an uninterruptable power source and need sophisticated heating, ventilation and cooling systems to reduce overheating, fire risk and humidity, which means they consume vast quantities of energy. 

It is estimated that the approximately 11,000 data centers currently operational around the world use about 1.5% of the planet’s electricity supply. And that will only increase as more data centers are built. According to the Electric Power Research Institute, in the United States alone, data centers could account for as much as 9.1% of the country’s power generation by 2030. Research by Goldman Sachs, meanwhile, suggests that global power demand from data centers will increase by 50% by 2027, from 2023 levels, and by as much as 165% by the end of this decade. 

Data centers also need large volumes of water to operate. Both this and the energy consumption required to run data centers – whether that be from renewable sources or otherwise – can place pressure on local communities’ power supplies and cause tension and risk. Often, the development of newer energy sources, like small nuclear modular reactors, is lagging the growth in construction of data centers, meaning alternative energy sources are not yet readily available.

The very largest data centers are equivalent in size to about 13 football pitches. And the world’s biggest data center currently is a colossal 10.7 million square feet.

Evolving risks
Like many large buildings or plants, data centers are often located in areas that could be vulnerable to severe weather and natural catastrophe events. Tornadoes, severe connectives storms, wildfire and hail, among other natural phenomena, all could cause significant damage to these multimillion-dollar exposures.

It is vital in the design and construction phase that risk engineering experts are involved to ensure that buildings are sufficiently elevated to reduce flood risk, for example, or that there is sufficient separation between parts of the building so that at-risk infrastructure and equipment are not concentrated in one area. And this risk engineering and risk management mindset is crucial during the operational phase of data centers, too.

Data centers house servers for organisations for which time-sensitivity and providing uninterrupted service is critical; any unexpected downtime is a crucial business interruption risk. This is one of the most significant drivers of insured values and something which insurers and their reinsurance partners must be mindful of as they work with clients to provide coverage.

Meeting the reinsurance challenge
These are not new risks in themselves. But the sheer scale of this next generation of data centers, and their immense demand for energy among other things, makes them almost a unique risk. Cedent insurers and their reinsurer partners need, therefore, to work to understand these risks and ensure that a strong risk management culture is in place at the primary level – and throughout the lifecycle of the data center. 

As with many evolving, large-scale risks, there are a small number of well-capitalized and sophisticated lead insurance markets – and these carriers are working closely with their clients to understand the risks and ensure robust risk engineering and management is an integral part of each phase of a data center’s design, construction and operation. 

For reinsurers, concentration risk is a challenge. The potential exposures are significant, with coverage likely led by a small number of cedants. And while it is more possible to have visibility of which insurers are leading which lines during the construction phase, once data centers are operational – and housing the servers of myriad clients from around the globe – it becomes more challenging to know exactly which risks are in which treaties as risks are shared and layered.

Reinsurers, therefore, want to work with those cedants that have best-in-class risk engineering capabilities. They may also wish to change some of the treaty language or add to it – for example, to cap the insured values of data centers included to a certain amount. It might also be more manageable to provide coverage for data center-related risks on a ‘special acceptance’ basis, whereby risks that differ from those covered by the main policies in a treaty can be included.

More regular reporting on risks to data centers for which reinsurance coverage is written on a bordereau basis will also likely be necessary as the next generation of data centers comes into operation.

As more massive data centers are built around the world, it will remain vital to have confidence that significant risk engineering has gone into both the construction and operational phase and that risks are well understood and managed at the primary client level. This will mean a continuing dialogue with cedant clients and broker partners as the market seeks to gain greater insights into how data center risk might evolve over time and how it can help to manage and mitigate it.