Singapore Is Licensing the Reliability and Resource Use of Digital Infrastructure

Two risks, two licensing regimes

Singapore has introduced a Digital Infrastructure Bill that puts the physical and operational foundations of its digital economy inside a statutory licensing system. The Bill creates one regime for the security and resilience of major data centers and cloud service providers, and another for the environmental sustainability of data-center operations.

The split is important. A data center can fail as infrastructure because its systems, cooling, power or continuity arrangements break down. It can also impose growing pressure on electricity, water and land even while operating reliably. Combining those questions in one broad obligation could obscure both. Singapore instead sets different coverage thresholds and duties for systemic disruption and resource performance.

Under the resilience regime, major co-location and cloud data centers with at least 10 megawatts of critical IT load would require a license. Large infrastructure- and platform-as-a-service providers would also be covered when their average annual Singapore revenue reaches S$100 million over the preceding three years. Licensees would need risk-management measures, continuity and recovery plans, and incident reporting.

The sustainability regime reaches further. Data centers with at least 3 megawatts of critical IT load would be licensed and initially required to meet facility-level energy-efficiency standards, including power-usage-effectiveness requirements. The framework can later extend to IT-equipment and water efficiency after consultation.

Compute capacity becomes a governed bargain

The most consequential part of the Bill may be its treatment of new capacity awards. Singapore has more than 1.6 gigawatts of data-center capacity, but it is also a city-state where land, power and water are tightly constrained. The government has used competitive allocation exercises to decide which proposed facilities receive room to grow. The Bill would allow strategic, economic and green-energy commitments made in those exercises to become license conditions.

That changes a promise into an enforceable obligation. If an operator secured scarce capacity by offering energy improvements, investment or broader economic value, the commitment would no longer sit only in an application file. It could become part of the permission to operate.

This is a different regulatory logic from treating data centers as ordinary commercial buildings or cloud services as purely contractual products. Digital infrastructure depends on public systems and scarce resources, while failures can disrupt banking, payments, government services and commerce. Singapore is making that dependence explicit.

Reliability extends beyond cybersecurity

The Bill complements rather than replaces the Cybersecurity Act. That boundary recognizes that infrastructure disruption is not always a cyber event. Power surges, cooling failures, fires, technical misconfiguration and weak recovery arrangements can interrupt services just as effectively as an attack.

Singapore has direct experience of those failure modes. Incidents in 2023 and 2024 disrupted cloud, banking, payment and digital-platform services. One cooling-system failure contributed to millions of failed payment and access attempts. The proposed regime therefore focuses on operational resilience as a wider discipline: identifying dependencies, preparing continuity arrangements, recovering services and reporting specified disruptions.

For cloud providers, this raises a practical question about shared responsibility. Operators control the underlying platform, but customers design applications and recovery arrangements on top of it. Licensing can establish a baseline for providers, yet it cannot guarantee that every dependent service has been architected for failure. The regime will work best if reporting and guidance help customers understand which risks remain theirs.

Efficiency requirements must become measurable

The sustainability license begins with facility energy performance. That is a sensible starting point because power usage effectiveness is established and measurable. It is not, however, a complete measure of productive or sustainable compute. A facility can improve overhead efficiency while total electricity use continues to rise. Efficient cooling does not reveal how intensively servers are used, what workloads they support or whether water pressure has shifted elsewhere.

The Bill leaves room for requirements covering IT equipment and water. The next design challenge is to add those measures without creating a reporting system that rewards easy ratios rather than real resource performance. Rules will also need to distinguish between existing facilities and new capacity, recognize credible standards without outsourcing regulatory judgment, and give operators enough transition time to make capital changes safely.

The consultation response indicates that government intends to streamline licensing and reporting, recognize relevant certifications and align requirements with the Cybersecurity Act. Those details will determine whether the system becomes a clear operating baseline or a stack of overlapping compliance exercises.

A statute for an infrastructure economy

Singapore’s approach is notable because it joins reliability, sustainability and investment discipline without pretending they are the same problem. Major failures receive a systemic-risk threshold. Environmental performance applies across a broader part of the data-center estate. Capacity commitments can be enforced where public scarcity made the award valuable.

The Bill is not yet evidence that outages will decline or resource use will be contained. It has passed First Reading and awaits further parliamentary consideration, while many technical requirements will sit in later implementation. The evidence to watch is therefore specific: final thresholds, transition periods, incident-reporting rules, water and IT-efficiency measures, and the license conditions attached to newly awarded capacity.

Singapore is defining digital infrastructure as something the economy depends on and the state must actively govern. Its quality will turn on whether the licenses remain precise enough to change operations while adaptable enough to keep pace with the systems they regulate.