Law, standards and responsibilities

Electrical work in a data center is governed by several layers of rules at once. Occupational health and safety law sets out who has duties and what they must achieve. Electrical codes, adopted into law by provinces, states or municipalities, set out how installations must be built and inspected. Consensus standards describe how to work safely on and near electrical equipment and how to maintain it. And each facility has its own electrical safety program, procedures, MOPs and permits, which must meet or exceed all of the above. HSE-320 Lesson 2 introduced these layers for every worker in a data center. This lesson goes into the electrical layers in more depth, for the people who must apply them.

The goal is not to make you a lawyer. It is to make sure that when you plan, approve or carry out electrical work in a critical facility, you know which requirements apply, where they come from, who is responsible for meeting them and how they fit together, so that the site's procedures rest on solid ground. Requirements change, so the lesson date-stamps the editions current as of 2026 and you should always check the version your jurisdiction and your site actually use.

Occupational health and safety law in the United States

In the United States, the Occupational Safety and Health Act of 1970 requires every employer to furnish a workplace free from recognized hazards that are causing or likely to cause death or serious physical harm (the general duty clause) and to comply with OSHA standards. In about half the states, federal OSHA enforces these rules; in the others, a state plan approved by OSHA enforces rules that must be at least as effective, and some, such as California's Cal/OSHA with its Electrical Safety Orders, are more detailed.

For general industry workplaces such as data centers, the key federal rules are in 29 CFR 1910 Subpart S, Electrical. Its design safety standards (1910.302 to 1910.308) cover installations, and its safety-related work practices (1910.331 to 1910.335) cover the people working on and near them. Section 1910.333 requires live parts to be de-energized before an employee works on or near them unless de-energizing introduces additional or increased hazards or is infeasible, and sets out lockout and tagging requirements for electrical work. Section 1910.335 covers protective equipment and alerting techniques, and 1910.137 covers electrical protective equipment such as rubber insulating gloves.

Other OSHA standards also apply. The lockout/tagout standard, 1910.147, covers servicing of machines and equipment generally; OSHA treats electrical work practices that follow 1910.333 as meeting lockout requirements for electrical hazards, but the two must be coordinated. Construction work, such as electrical installation in a new data hall, falls under 29 CFR 1926 Subpart K. Section 1910.269, which covers electric power generation, transmission and distribution, can apply to work on some on-site generation and substation installations; whether it applies to a particular campus substation or generation plant depends on the facts and should be confirmed with qualified advice. OSHA also uses a multi-employer citation policy, under which the employer that creates, exposes workers to, corrects or controls a hazard can be cited, so a facility owner can be responsible for a contractor's exposure.

The National Electrical Code and inspection

The National Electrical Code (NFPA 70) sets out how electrical installations must be designed and built. It becomes law when a state, county or city adopts it, often with local amendments, and the authority having jurisdiction enforces it through permits and inspections. As of 2026 the 2026 edition has been published, but many jurisdictions still enforce the 2023 or 2020 edition, so check what applies locally. Article 645 covers information technology equipment rooms, and Article 110.26 sets out the working space required in front of electrical equipment. Electrical work generally requires a licensed electrician or electrical contractor, with licensing set by each state or locality.

Electrical codes govern the installation, not the work practices of the people who maintain it, but the two connect in important ways. Codes require arc flash warning labels on equipment likely to be examined, adjusted, serviced or maintained while energized. They require adequate working space in front of equipment, so that workers can move away from a fault. They require energy-reducing maintenance switching or similar means for large circuit breakers in many cases, which Lesson 4 explains. And they require permits and inspections for new work in a live facility, so that every change is checked by someone independent.

NFPA 70E and related standards

NFPA 70E, Standard for Electrical Safety in the Workplace, is the national consensus standard for safe work on and near electrical equipment in the United States. It sets out requirements for an electrical safety program, training and qualification, establishing an electrically safe work condition, shock and arc flash risk assessments, approach boundaries, energized electrical work permits, PPE and the maintenance needed to keep equipment safe to operate. As of 2026 the current edition is NFPA 70E-2024, with the next edition expected in 2027. NFPA 70E is not itself an OSHA regulation, but OSHA treats it as a recognized consensus standard: it uses NFPA 70E to show that a hazard is recognized and that feasible means of abatement exist, and it has cited employers under the general duty clause and Subpart S for failing to protect workers in ways NFPA 70E describes.

Two other NFPA documents complete the picture for critical facilities. NFPA 70B, which became a full standard (Standard for Electrical Equipment Maintenance) with its 2023 edition, sets out maintenance programs, intervals and the assessment of equipment condition; before 2023 it was only a recommended practice. NFPA 70 itself, the NEC, governs installations. IEEE 1584 provides the method most arc flash studies use to calculate incident energy. Lesson 11 returns to maintenance, because poorly maintained protective devices can turn a moderate arc flash hazard into a severe one.

Who is responsible

A data center is a multi-employer workplace. On any given day, electrical work may involve the facility owner, an operator if the owner has outsourced operations, a facilities management company, several electrical contractors, UPS and switchgear manufacturers' field service engineers, commissioning agents, testing firms, colocation customers and their vendors. Each has duties, and the electrical safety standards in both countries set out specifically how host employers and contract employers must work together.

The host employer, the organization that controls the facility, must tell contractors about the known hazards of the site and the equipment, including arc flash study results and labels, the site's electrical safety program and any unusual conditions such as equipment in poor condition or recent changes. It must also report back to the contractor any violations of its electrical safety rules that it observes. The contract employer must make sure its workers are trained and qualified, follow the host's requirements as well as its own, and tell the host about any unique hazards its work creates and any problems it finds. Both must agree in writing how the work will be coordinated, including who controls lockout, who issues permits and how emergencies will be handled.

In practice, data centers manage this through a combination of contractor prequalification, site orientation, the MOP and permit process and a clear rule that only the site's authorized persons may operate switching devices that affect the critical load, even when a contractor is qualified to do so on other sites. HSE-320 Lesson 10 covers contractor management generally; here the key points are electrical.

• The arc flash study and labels belong to the facility owner. Contractors must be given current results and told when equipment has changed.
• Switching that affects redundancy or the critical load is controlled by the operator, through switching orders that are part of the MOP.
• Lockout of the isolation points is coordinated, often through a group lockout with the operator's lock and every worker's personal lock on a lockbox, as HSE-210 Lesson 8 describes.
• Energized work permits are approved by people with authority under the host's program, not by the contractor alone.
• Colocation customers who bring their own technicians into the white space are usually restricted to plugging and unplugging their own equipment and must never open panels or busway.

Building the program on the requirements

A data center's electrical safety program brings all of these layers together in a single set of documents that workers actually use. Both CSA Z462 and NFPA 70E require an electrical safety program, and HSE-224 Lesson 2 describes its elements: a policy, risk assessment procedures, training and qualification, job planning and briefings, procedures for establishing an electrically safe work condition, energized work authorization, PPE, maintenance and auditing. In a critical facility the program also needs elements that ordinary workplaces may not:

• Integration with change management, so that every MOP that touches electrical equipment includes the electrical safety steps described in this course.
• Switching authority, defining who may operate which devices and how switching orders are written, checked and executed (Lesson 8).
• A process for reviewing and challenging requests for energized work, with management approval at a level that can resist operational pressure (Lesson 9).
• Arc flash study management, so that labels are updated whenever the system changes and reviewed at least every five years.
• Coordination rules for contractors, manufacturers and customers.
• Emergency response arrangements suited to electrical rooms, battery rooms and data halls (Lesson 12).

The code sample below shows a simple way to keep the requirements map at a multi-site company organized: a lookup table that returns the primary rules for a site based on its jurisdiction and whether it is federally regulated. Real compliance registers are larger and are reviewed by legal and safety specialists, but the principle is the same.

# Illustrative requirements lookup for a multi-site operator (as of 2026).
CANADA_COMMON = ["CEC Part I (C22.1:24, as adopted)", "CSA Z462:24", "CSA Z463:24", "CSA Z460"]
US_COMMON = ["NEC (edition adopted locally)", "NFPA 70E-2024", "NFPA 70B-2023"]

provincial = {"BC": "OHS Regulation Part 19", "AB": "OHS Code Part 17",
              "ON": "Reg. 851 / Reg. 213/91 electrical sections"}
state_plans = {"CA": "Cal/OSHA Electrical Safety Orders", "VA": "Virginia state plan",
               "TX": None}  # None: federal OSHA enforces

def rules(country, region, federal=False):
    if country == "CA":
        law = "Canada Labour Code Part II, COHSR Part VIII" if federal else provincial[region]
        return [law] + CANADA_COMMON
    plan = state_plans.get(region)
    law = "29 CFR 1910 Subpart S" + (f" + {plan}" if plan else " (federal OSHA)")
    return [law] + US_COMMON

for site in [("CA", "ON", False), ("CA", "ON", True), ("US", "TX", False), ("US", "CA", False)]:
    print(site[0], site[1], "federal" if site[2] else "", "->")
    for r in rules(*site):
        print("    ", r)

CA ON  ->
     Reg. 851 / Reg. 213/91 electrical sections
     CEC Part I (C22.1:24, as adopted)
     CSA Z462:24
     CSA Z463:24
     CSA Z460
CA ON federal ->
     Canada Labor Code Part II, COHSR Part VIII
     CEC Part I (C22.1:24, as adopted)
     CSA Z462:24
     CSA Z463:24
     CSA Z460
US TX  ->
     29 CFR 1910 Subpart S (federal OSHA)
     NEC (edition adopted locally)
     NFPA 70E-2024
     NFPA 70B-2023
US CA  ->
     29 CFR 1910 Subpart S + Cal/OSHA Electrical Safety Orders
     NEC (edition adopted locally)
     NFPA 70E-2024
     NFPA 70B-2023

Note that two sites in the same province can follow different OHS law, and that the standards layer is common to all sites in a country. Most multi-site operators write one corporate electrical safety program based on CSA Z462 or NFPA 70E and add site-specific appendices for local law and codes.

When the standards change

CSA Z462 and NFPA 70E are revised on a three-year cycle, and electrical codes on a similar cycle. Each new edition brings changes, sometimes significant ones, such as new requirements for risk assessment, updated tables or new language on topics like batteries and DC systems. A data center's program should name the edition it follows, assign someone to review each new edition and update procedures and training within a reasonable time. Training must be refreshed when the program changes, not only at the regular interval.

Changes in the facility matter just as much. Replacing a transformer, changing a relay setting, adding a generator or connecting a new hall can change fault currents and clearing times across the system, and with them the incident energy at equipment that was not touched. The arc flash study must be updated when such changes occur, and labels replaced, before anyone relies on them. Lesson 4 explains how to manage this.