Australia’s growing demand for artificial intelligence (AI) infrastructure presents opportunities for overseas investors. Developing or acquiring a data centre can, however, engage foreign investment, planning, competition and national security rules. Proposed national AI standards could introduce further requirements for large projects.
Foreign investment and competition approval
Under the Foreign Acquisitions and Takeovers Act 1975 (Cth), overseas investors may require Treasurer approval to acquire interests in Australian businesses or land, or to establish certain businesses. Requirements depend on ownership, the transaction, the target’s activities and screening thresholds.
Data centres handling government information or business-critical data for critical infrastructure operators may raise national security issues. Establishing a qualifying national security business, acquiring a direct interest in one or acquiring national security land can trigger zero-dollar notification thresholds, subject to exemptions. Foreign government investors may face additional screening.
Acquiring an existing data-centre business may also trigger mandatory ACCC notification under Part IVA of the Competition and Consumer Act 2010 (Cth).
Planning and infrastructure requirements
Development consent, building approvals and environmental assessment depend on state, territory and local laws. In New South Wales, data-centre projects are assessed under the Environmental Planning and Assessment Act 1979 (NSW) and relevant planning instruments, alongside state data-centre policy guidance. Approval under the Environment Protection and Biodiversity Conservation Act 1999 (Cth) may also be needed if a project is likely to significantly affect federally protected matters. Electricity connections, water supply and related infrastructure costs can materially affect site selection and feasibility.
National security and data protection
The Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act) may apply where a facility meets the criteria for a critical data storage or processing asset. Depending on the asset, obligations can include registration, reporting specified cyber incidents and maintaining a critical infrastructure risk management program. Not every data centre is covered.
The Privacy Act 1988 (Cth) and Australian Privacy Principles may separately apply to entities handling personal information, depending on their circumstances.
What is changing for AI data centres?
In September 2026, the Government released Getting it right: Building AI infrastructure that works for Australia, consulting on nationally consistent standards for large data centres and AI training. It builds on the March 2026 expectations for data-centre developers, which are policy expectations rather than new statutory duties, but may affect prioritisation in Commonwealth regulatory assessments. The consultation considers tiers based on ultimate electricity network connection capacity:
- Below 30 MW: possible exclusion from the standards.
- 30-100 MW: potential baseline requirements.
- Above 100 MW: potentially more extensive requirements, including possible coverage of cumulative portfolios equivalent to 150 MW.
Proposals address additional renewable electricity generation, grid impacts and costs, water efficiency, community engagement and workforce development. Separate conditions are contemplated for frontier AI training, including safety, security and Australian capabilities. These capacity tiers and requirements remain proposals, not current statutory obligations. Consultation closed on 9 October 2026; the final scope, legal form and commencement remain subject to government decisions.
What should overseas investors do next?
Investors should assess FIRB and, where relevant, ACCC notification, planning and environmental approvals, network and water infrastructure, and SOCI and privacy obligations. Project modelling should also account for potential future national standards and their effect on design, costs and timelines. Australia has no single approval pathway for AI data centres. Therefore, early legal and regulatory due diligence remains essential to managing project and transaction risk.