Governor Josh Shapiro signed Executive Order 2026-05 on 18 August 2026, applying to Pennsylvania data-centre projects with peak demand above 25 MW. It creates a two-track DEP permitting process keyed to whether a developer executes a binding Consent Order and Agreement incorporating the GRID requirements, removes AI data-centre proposals from Fast Track review, prohibits non-disclosure agreements, and makes non-compliant developers ineligible for the state sales-tax exemption on data-centre equipment. The state describes more than 100 proposals under discussion, most lacking financing, power access or signed tenants — while only five data centres currently hold the permits needed to operate, and none are running. The order reverses a voluntary certification approach announced in May.
Two numbers describe Pennsylvania's data-centre situation better than any other pair. The state says more than 100 data-centre proposals are under active discussion. Five data centres currently hold the permits they would need to operate, and none of them are running.
Governor Josh Shapiro signed Executive Order 2026-05 on 18 August 2026. It is being covered as environmental guardrails, and it does contain environmental conditions. But read the eligibility threshold, the two-track permitting structure and the ban on non-disclosure agreements together, and a different function emerges. The order is designed to make a speculative filing expensive, and to let the pipeline thin itself.
The order applies to any data-centre project with expected peak demand above 25 megawatts, for permit and authorisation applications submitted after 18 August. That threshold is worth pausing on: it is materially lower than the 50 MW trigger in PJM's pending large-load rules, which means Pennsylvania has chosen to capture a wider set of projects than the regional grid operator's own framework would.
Above that threshold, developers face two tracks at the Department of Environmental Protection, and the choice between them is theirs.
The distinction matters and has been widely flattened in coverage. This is not a rule that blocks non-compliant developers. It is a rule that lets compliant developers run permitting in parallel while everyone else runs it in series. The penalty is time, not prohibition — and on a project with financing costs accruing, time is the expensive thing.
The GRID requirements themselves cover energy affordability — including bringing generation and paying for the infrastructure needed to serve a project's own electricity demand — alongside environmental protection, workforce and economic development, transparency and community engagement conditions. The order also removes all AI data-centre proposals from the state's Fast Track permitting process, and makes non-compliant developers ineligible for Pennsylvania's existing sales-tax exemption on data-centre equipment. That last provision is the one with a directly quantifiable cost attached.
Shapiro's own characterisation of the pipeline is unusually blunt for a governor who has actively courted data-centre investment: more than 100 proposals under discussion, most of them speculative, lacking financing, power access or signed tenant agreements. He cited Archbald in Lackawanna County, where six data-centre campuses comprising 51 warehouses have been proposed.
A pipeline shaped like that creates a specific governance problem that has nothing to do with emissions. Municipalities have to evaluate proposals they cannot distinguish between. A serious project with a hyperscaler tenant and a speculative land-assembly play with a rendering and a term sheet arrive at the same planning commission looking broadly identical, and the commission has no way to tell them apart — particularly if it has signed an NDA. Local officials then negotiate infrastructure commitments, tax abatements and zoning variances against projects that may never be built, and the ones that do get built inherit terms set during a bidding war against ghosts.
A binding consent order with penalties attached does something a ban would not: it prices the filing. A developer with financing, a tenant and a real power plan can sign it, because the conditions describe what they were going to do anyway. A developer without those things is being asked to accept enforceable obligations on a project they cannot fund. Most will not sign, and the ones that do not sign land in the slower track. The pipeline sorts itself without the state having to adjudicate which proposals are real.
The most under-covered provision is the prohibition on non-disclosure agreements. Developers can no longer use NDAs to withhold basic project details from surrounding communities — including which company will occupy a facility and where its power will come from.
Secrecy is not incidental to how data-centre siting has worked; it is load-bearing. A developer negotiating with five municipalities simultaneously under NDA can tell each one it is competing against unnamed rivals with unknown offers. None of the five can verify the claim, compare terms or coordinate. That information asymmetry is worth a great deal at the bargaining table, and it is worth more than most individual emissions conditions.
Removing it does not change what a developer is allowed to build. It changes what a township knows when it decides what to charge. Of everything in EO 2026-05, this is the provision most likely to show up in the actual economics of Pennsylvania projects, and the least likely to be replicated by states competing hardest on incentives.
Environmental groups and the Pennsylvania Capital-Star's coverage have said the order falls short of what campaigners sought, and the criticism is substantive rather than reflexive. An executive order directs agencies; it does not bind the legislature, and it can be rescinded by the next governor with the same instrument that created it. The GRID requirements gain their force from consent orders signed by individual developers, which is durable for those projects but does not establish a standard that survives a change of administration.
There is also a version of this order that is simply less effective than its architecture implies. If serious developers sign the consent order and build, and speculative ones quietly disappear, the state gets a cleaner pipeline and a set of enforceable commitments. If instead developers route around the 25 MW threshold by splitting projects, or if neighbouring states advertise the absence of a GRID equivalent, Pennsylvania has exported the buildout rather than disciplined it. Neither outcome is knowable yet.
Worth noting too: the order reverses a voluntary certification approach the administration announced in May. Three months of a voluntary regime produced enough evidence to make it binding, which is itself a data point about how much of the pipeline was ever going to comply on request.
The generalisable point sits above Pennsylvania. This is a governor who has courted data-centre investment imposing a bring-your-own-generation standard on it, and doing so through executive action rather than waiting for the legislature or the grid operator. The fight over who pays for load growth — ratepayers or the loads themselves — has spent two years working through FERC dockets and PJM capacity auctions. It has now arrived on governors' desks, where it moves faster and binds less.
Pennsylvania has written the template. The interesting question over the next few months is not whether it survives a court challenge, but which states copy it, which states advertise against it, and whether the 100 proposals turn out to have been 100 projects or five.
No. It creates two permitting tracks for projects above 25 MW peak demand. Developers who execute a binding Consent Order and Agreement incorporating the GRID requirements get rolling DEP review; those who decline face a sequential process where DEP cannot begin review until local and water-related approvals are already documented. Non-compliant developers also lose eligibility for the state's sales-tax exemption on data-centre equipment. The penalty is time and cost, not prohibition.
Siting, ratepayers and permitting are where AI infrastructure gets decided. DrafterDaily reads the orders and the dockets so you do not have to.
More technology analysisCVE-2026-0768 is an unauthenticated root RCE in Langflow. It was disclosed in January, the fix has shipped through seven releases, and attackers are hitting it in September — because low-code AI middleware became critical infrastructure without acquiring a patch owner.
Opposition to data centres is not a referendum on AI. It is a cost-allocation dispute — and PJM's capacity auction is the mechanism that turned an abstract argument into a number on 67 million households' bills.
OpenAI's first published benchmarks for its custom inference chip are real, from a public benchmark, and normalised on nameplate TDP rather than measured power. OpenAI disclosed that itself, in a sentence nobody is quoting.