Federal Data Center Enhancement Act set to expire in September, reportedly without renewal

The Federal Data Center Enhancement Act (FDCEA), the only federal mandate setting minimum resiliency, cybersecurity, availability and sustainability standards for US government data centers, is set to sunset on September 30, 2026, and the government reportedly does not plan to seek its renewal.

The reported non-renewal matters because it would remove the lone federal standard governing how agencies build and secure data centers just as AI workloads strain federal infrastructure planning. The expiry of the law itself is documented; the intent not to renew it is not.

The FDCEA, enacted in 2023, directed the Office of Management and Budget (OMB) to set requirements for federal data centers to meet appropriate standards for cybersecurity, resiliency and availability. OMB Memorandum M-25-03 implemented those provisions, and both the act's provisions and the memo are scheduled to sunset on September 30, 2026, according to the federal CIO Council's own policy page. That page still lists the act among the council's policies, and no executive extension has been announced.

The central claim should be read with care. The report that the government intends to let the act lapse, rather than renew it, is attributed to unnamed sources and has not been confirmed by any named official, OMB or GSA statement, or Federal Register notice. The published government record confirms only the September 30 sunset of the act and the implementing memo, not a decision against renewal.

The act replaced earlier data-center oversight under the Federal Information Technology Acquisition Reform Act, whose consolidation and optimization requirements Congress did not renew. If the FDCEA lapses without a successor, agencies would set their own resiliency and security baselines, with no government-wide floor. A renewal, an extension or a replacement standard could still emerge before the September deadline.