Summary

  • Singapore’s framework uses different triggers for different risks: 3 MW of critical IT load for data-centre sustainability, 10 MW for major facility resilience, and a separate three-year revenue test for major IaaS and PaaS.
  • The key implementation question is whether energy, resilience and reporting duties follow the asset or service the operator controls, while preserving a view of the system-wide impact.

A data centre can pass one threshold without passing another. Singapore’s Digital Infrastructure Act 2026 gives that distinction legal form: a 3 MW facility can enter the licensing framework for sustainability before it reaches the 10 MW threshold for major data-centre resilience obligations. A cloud provider can also fall into the major-service regime through revenue from Singapore users, even though its trigger is not a facility’s power rating.

Three triggers, three objects

The 3 MW test is about the facility. Operators at or above that critical IT load must obtain a data-centre licence and meet sustainability requirements, beginning with facility-level energy efficiency and power usage effectiveness (PUE). CIL is designed electrical capacity for IT and network equipment, not the electricity a site consumes at a particular moment.

At 10 MW, a data-centre facility service can qualify as a major foundational digital infrastructure service. The measure is still CIL, but the regulatory concern changes: disruption could affect many businesses and organisations. The regime covers qualifying colocation services and cloud data centres that serve other parties. Cloud IaaS and PaaS use a third test: average annual revenue of at least S$100 million from users in Singapore over the previous three years. SaaS is excluded from that defined cloud category.

The Ministry estimates that roughly 70 data centres operate in Singapore and about two-thirds meet the 10 MW test. Those are government estimates, not a published facility-by-facility register. Their practical meaning will depend on final licensing guidance and how the Authority applies the tests to real corporate structures.

Efficiency and control are not the same thing

The consultation record shows why the two data-centre regimes need different boundaries. A colocation operator can manage the building, power distribution, cooling and physical access while its customer owns and controls servers inside. MDDI and IMDA say the resilience requirements for a facility are intended to cover the operator’s direct control, not customer equipment beyond it. The authorities also plan separate codes for cloud and colocation data centres, subject to further consultation.

Sustainability has a similar control problem. PUE can assess facility overhead relative to IT load, but it cannot by itself show how much total electricity, water or carbon the sector uses. The Minister has called PUE a starting point, not the endpoint: a site may become more efficient even while its total demand grows. The consultation response says IT-equipment efficiency will not be mandatory at the outset because operators may lack visibility over customer servers; water rules are also for later consultation.

The operating rulebook is still ahead

The Act establishes licensing, baseline duties and enforcement powers. Detailed resilience controls, incident thresholds, energy requirements and codes of practice will come later. Where cybersecurity reporting overlaps with the Cybersecurity Act, the Government says a licensee will report to IMDA, which will share relevant information with the Cyber Security Agency. The aim is a single reporting path, not a single risk regime.

The Act is expected to commence in stages on dates appointed by Gazette notification. The Government expects this process to begin in 2027; existing operators will then have six months to apply and may continue operating while a timely application is considered. That is a stated implementation plan, not a live compliance deadline.

Heng Lu’s Note 64 offers an editorial discipline here: distinguish the shared initial rule from later choices. Singapore’s follow-on codes remain statutory instruments, not voluntary Internet-system adoption. The usefulness of the framework will turn on the records behind each threshold: designed CIL, service and customer scope, actual operational control, the revenue basis for cloud services, and transition plans. If operators can reproduce those records and regulators can explain how they determine control, the two regimes can place different duties where the risks sit.

If PUE becomes a proxy for total sustainability or a nominal licence holder is treated as controlling customer-owned systems, the formal thresholds will be easier to count than to enforce fairly.

Sources