Environment, Health & Safety (EHS) Across Build & Operate

Every preceding chapter in Part 6 designed a hazard into the building. Chapter 6.2 screened an assumed 3,000–3,300 lb wet-rack range on the slab; Chapter 6.5 put lithium BESS in rooms with their own detection, cooling, and deflagration venting; Chapter 6.7 set the rigging paths those racks travel; Chapter 6.8 wrapped acoustic enclosures around gensets running on stored fuel. This is where those hazards stop being lines on a drawing and become things that can kill or maim a human being — and where the discipline shifts from engineering a margin to operating a program. An arc-flash study is a deliverable; an arc-flash program is a labeled equipment register, an energized-work permit system, a PPE-to-incident-energy mapping, and a re-study trigger that fires every time someone changes a breaker setting. The first protects you on the day it is signed. Only the second protects the worker who opens a switchgear door three years later.

The reason EHS earns a full chapter in 2026 — rather than a paragraph in a code-compliance appendix — is that the AI build changed the hazard profile faster than the safety programs around it adapted. The move to 800 VDC distribution (Chapter 4.7) adds lethal contact-voltage shock to a DC-bus hazard that already demanded tool control and arc protection at 48 V. The move to direct-to-chip liquid (Chapter 5.4) puts pressurized glycol and dielectric fluids inside the same enclosure as energized electronics. The move to on-site gas generation (Chapter 4.8/4.9) drops a small power plant — with its own combustible-gas and process-safety regime — onto a data-center campus whose EHS staff were trained for IT, not for turbines. And the move to concurrently maintainable facilities, with the maintained equipment de-energized (Chapter 12.1) means the workforce now maintains an operating building under planned isolation and controlled work conditions; energized work remains an engineered exception under the applicable electrical-safety program. Each of those is a goodput or density decision elsewhere in this guide; each lands here as a named, managed hazard.

The most common and most dangerous EHS failure in a data center is treating the arc-flash study as a one-and-done engineering artifact. The study computes, at every piece of equipment, the incident energy (in cal/cm²) a worker would absorb in an arcing fault, the resulting arc-flash boundary (the distance at which incident energy falls to 1.2 cal/cm² — the onset of a second-degree burn), and the arc-rated PPE required inside it. That study is valid only for the protective-device settings, fault currents, and one-line topology that existed the day it was run. The instant someone re-coordinates a relay, swaps a transformer, adds a UPS module, or energizes a new feeder, the incident energy at downstream gear can move — and the label on the door, the PPE in the cabinet, and the worker's mental model are now wrong. NFPA 70E (2024), 130.5(G), requires accuracy review within five years and an update for system changes that can affect the analysis; the program turns that requirement into a trigger wired to your management-of-change process, so no power-chain modification closes out until the arc-flash impact is re-evaluated. The current edition is 70E-2027 (issued 2026-04-16, effective 2026-05-06), and its most operationally consequential change is new 130.2(A)(2): when an Energized Electrical Work Permit is required and the task uses shock or arc-flash PPE, at least one additional emergency-response-trained person must be present, stationed outside the greater of the limited-approach or arc-flash boundary — a staffing line-item for every live-adjacent fit-out and IST task, and a staffing gap at that boundary is a stop-work condition. The edition the employer’s electrical-safety program adopts is the operative one. The 2027 edition also adds dedicated DC-hazard coverage (new Article 310), though it is still not an 800 VDC design standard.

The 2026 wrinkle is that AC arc-flash intuition does not transfer to the 800 VDC world the dense racks are driving toward. A DC arc has no current zero-crossing — in a 60 Hz AC system the current passes through zero 120 times a second, which helps a breaker extinguish the arc; a DC arc can persist while its source and gap sustain it; rated protective interruption must clear the fault. That makes DC arcs harder to clear and DC arc-flash energies harder to bound with the AC-derived IEEE 1584 model that most studies still lean on. The shock side is starker still, but it runs opposite the arc/thermal side at 48 V. Under US 29 CFR 1910.333(a)(1), the below-50-V-to-ground de-energization exception also requires no increased electrical-burn or arc-explosion exposure. Use the selected rack’s actual voltage; NVIDIA’s cited DGX GB power shelves are nominally 50–51 VDC. Either way a conductive dropped tool across the NVL72's paired busbars meets a stiff parallel supply: the bars feed roughly 2,800 A of aggregate load, while the bolted-fault current is far higher (Chapter 7.13). Arc exposure is quantified from available fault current, clearing time, working distance, and task; PPE follows the study. At 800 VDC, Ohm's-law screening at an illustrative 1,000 Ω body resistance gives about 800 mA; actual current and injury depend on contact impedance, path and duration, while the absence of a current zero-crossing makes the DC arc harder to clear. The voltage step that Chapter 4.7 justified on efficiency grounds therefore adds a lethal shock regime; it does not create the need for arc discipline, because the 48 V bus already had it.

At every voltage class the thing that protects the worker is not the PPE in the cabinet but the program control that keeps the study, the labels, and the human's training synchronized with the as-built power chain. Workers can mistake a nominal 48 V bus for low total risk even though conductive tools can bridge its high-current conductors. Keep tool control and study-selected arc-rated PPE in the task plan; carry the low-risk habit to 800 V and the error also includes electrocution. → the voltage architecture itself is set in Chapter 4.7; the resilience model that requires isolating the maintained component while the other paths keep carrying load is Chapter 12.1.

Lockout/tagout is the bedrock control for working on equipment that could energize or move unexpectedly: isolate the energy source, lock it in the safe state, tag it, and verify zero-energy before a hand goes near it. In a conventional plant you can often de-energize a whole system to work on it. In a concurrently-maintainable AI data center you normally isolate the maintained equipment while another path serves IT — the Tier III/IV site-infrastructure premise is that required capacity components and distribution paths can be removed for planned maintenance while the IT load keeps running (Chapter 12.1). That is a feature for uptime and a trap for LOTO, because the worker is now isolating one leg of a system whose other legs are deliberately, continuously live. The boundaries that LOTO must draw — back-feed from a parallel UPS or genset, stored energy in capacitor banks and DC buses, the closed-transition path that could re-energize an 'isolated' bus during an automatic transfer — are exactly the boundaries that concurrent maintainability is engineered to keep hot.

The program consequence is that generic LOTO procedures are not safe here; the facility needs equipment-specific energy-control procedures for every maintainable boundary, written against the actual one-line and the actual transfer logic, naming every isolation point and every stored-energy source. The split is organizational: individual LOTO (each worker applies their own lock) is unambiguous but does not scale to multi-trade work on a large lineup; group LOTO (a lockbox holds the isolation, each worker adds a personal lock to the box) scales but introduces a single authorized-person accountability that, done loosely, becomes the failure mode in the incident report. And because the IT load cannot drop, the highest-consequence question — who owns the permit, and who has the authority to refuse the work when isolating a component would violate concurrent maintainability — has to be answered in writing before the first live job, not negotiated on the floor at 2 a.m.

Trace every way the task can acquire energy. The motor’s main feed reaches the drive; the DC link can remain charged after that feed opens; the separate control supply reaches the terminal enclosure; and the water branch can retain pressure or drain under gravity after its valves close. The listed drive disconnect interrupts only one of those paths. Reject the task boundary and keep pump removal on HOLD, even if the BMS says “off” and the IT load is running normally.

The electrical qualified person and mechanical authorized person revise one coordinated isolation: identify and control both electrical supplies, follow the drive’s discharge procedure, verify absence of hazardous voltage at the work boundary with suitable test equipment, and prove the tester by the applicable procedure. Isolate, depressurize and drain the water branch, prevent reaccumulation, secure moving parts, and apply the personal/group-lock arrangement to every exposed worker. Only then can the accountable work controller release the removal. Operations accepts the temporary loss of redundancy; it cannot trade that risk for an unverified energy state.

Flip case: the work becomes eligible when every source reaching the task is identified, controlled and verified; discovery of even one omitted source reverses release. A 24 V control supply can initiate motion or bridge a hazardous boundary, so its label does not settle the task. OSHA 1910.333(b)(2)(ii)–(iv) supplies the electrical de-energization and verification basis; the mechanical energy-control program follows 1910.147(d)(5)–(6) and (f)(3) where applicable. This chapter owns work authorization; Chapter 5.13 defines the hydraulic boundary and Chapter 14.12 carries the maintenance/retest handoff.

The mechanical hazards of the build and operate phases are ordinary, which is exactly why they kill people: the program fails through familiarity, not novelty. Falls remain the single leading cause of death in construction: of 1,034 construction fatalities in 2024, 389 were fatal falls, slips, and trips; fall-protection enforcement is another reason to retain the controls under schedule pressure. A data-center build is a fall-rich environment — open structural steel, elevated pipe racks for the facility water loop, rooftop heat-rejection plant, mezzanines for electrical gear — and the controls (guardrails, personal fall-arrest, controlled-access zones, a competent-person inspection regime) are well understood and routinely skipped under schedule pressure. The EHS program's job is not to invent new controls; it is to make the known controls non-negotiable on a critical-path schedule that is screaming for speed-to-power.

Confined spaces proliferate in the AI build in ways the IT-trained operator may not anticipate: large CDU and tank interiors, the inside of thermal-storage and chilled-water reservoirs, deep electrical vaults and cable trenches, and the let-down/scrubbing vessels on a gas-conditioning skid (Chapter 4.9). Each space must be evaluated against the jurisdiction's confined-space definition and hazards; only a space meeting the applicable criteria is permit-required. Where entry is permit-required, controls include atmospheric testing as applicable, an attendant and a site-specific rescue plan. The statistic that should anchor the program: a large share of confined-space deaths are would-be rescuers who entered an untested space to save a downed coworker. The rescue plan is the deliverable that prevents one fatality from becoming two or three. Heavy rigging closes the set — multi-tonne transformers, chillers, prefab power/cooling modules (Chapter 6.4), and the guide-assumed 3,000–3,300 lb wet-rack screening range carried into Chapter 6.7 — where the controls are engineered lift plans, certified rigging gear, exclusion zones under suspended loads, and qualified signal/rigger roles. The rigging path defined for civil reasons in Chapter 6.7 is, on this ledger, a struck-by and crush-hazard corridor that the EHS plan has to own.

Liquid cooling did not just change the thermal design — it introduced a chemical-handling program where air-cooled halls had none. The coolant chemistry you select in Chapter 5.4–5.5 carries its EHS envelope with it, and that envelope — exposure controls, spill response, disposal, and regulatory liability — is a consequence of the cooling fork, not a separable add-on. Three families dominate, and they sit at very different points on the hazard map.

Propylene-glycol/water (PG25 and relatives) is the workhorse single-phase direct-to-chip coolant. Its acute toxicity is low (propylene glycol is far less toxic than ethylene glycol, which is why the industry standardized on it), so the dominant hazards are physical: it is conductive enough that a leak onto energized 800 VDC electronics is a fault and shock risk, it is slip and slick on the floor, and at scale a spill is an environmental-reporting event and a disposal stream. Single-phase dielectric fluids (synthetic or hydrocarbon) trade the conductivity problem away — an uncontaminated fluid’s specified dielectric performance can reduce leakage-current risk, but moisture, particles and hot surfaces must remain inside its qualification envelope — but reintroduce flammability/combustibility classification, vapor and dermal-exposure considerations, and a heavier disposal burden. Two-phase fluorinated fluids (the PFAS family) were, until recently, the high-performance immersion answer — and they are this section's cautionary tale.

Whatever the chemistry, the operate-phase program is the same skeleton: a maintained SDS library and chemical inventory; exposure controls and PPE matched to the fluid; secondary containment and spill kits staged at the loops; a spill-response procedure matched to the adopted NFPA 75 edition and the selected liquid-cooled equipment — including the de-energization sequence for a conductive-coolant leak onto live gear; and a disposal/recycling stream with the manifesting and reporting the local regime demands. You are choosing this program when you choose the coolant — so price the spill, exposure, and end-of-life liability into the cooling fork rather than discovering it on the floor.

When a campus owns its substation and HV yard (Chapter 4.3), it inherits a hazard class most data-center EHS staff have never managed: medium- and high-voltage work, utility-grade clearances, induced-voltage and step-and-touch-potential risk across the ground grid, and switching operations where a wrong move flashes over at energies no PPE survives. The installation's actual function sets the OSHA scope: work performed as electric-power generation, transmission, or distribution falls under 29 CFR 1910.269; customer premises-wiring work falls under Subpart S. The control here is not better PPE — it is the qualified-worker program: a documented, demonstrated competency for each person allowed inside the HV boundary, refreshed on a cadence, with demonstrated competence in remote racking and switching. Use a written switching order and remote operation where practicable to establish isolation before maintenance, keeping workers outside the assessed arc-flash boundary.

The workforce question is make-vs-buy. In-house HV qualification gives operational control and faster response but demands a sustained training, tooling, and competency-audit program that is hard to keep current at a single site. Contracting the utility or an HV specialist for substation work outsources the competency but introduces interface and response-time risk, and it relocates the question of where the qualified-worker boundary sits — which is the same line as the ownership boundary negotiated in Chapter 4.3. Get that line wrong and you have either workers operating beyond their qualification or a campus that cannot perform routine switching without waiting on a third party. The EHS program and the 4.3 ownership model have to draw the same boundary, or the gap between them becomes the incident. → the substation ownership and NERC-compliance framing is Chapter 4.3.

The behind-the-meter generation strategies of Chapter 3.5 and the fuel-supply engineering of Chapter 4.9 drop a process-industry hazard onto the campus: combustible gas, pressurized vessels, fuel storage, and rotating prime movers. OSHA Process Safety Management applicability depends on a covered process, listed-chemical or flammable-material threshold, connected/co-located process scope and any applicable exemptions under 29 CFR 1910.119; inventory alone does not settle it. It is a regime that data-center operators rarely arrive prepared for. PSM is not a checklist; it is process-hazard analyses (HAZOP/LOPA), mechanical-integrity programs, management-of-change discipline, operating procedures, contractor-safety management, pre-startup safety reviews, and incident investigation — the full apparatus of running a small process plant.

The decision is binary and early: determine PSM applicability before first fuel through a documented covered-process, threshold, connectivity and exemption analysis, and if you are in, stand up the program ahead of commissioning rather than discovering the obligation during an inspection or — worse — an incident. Even below the PSM threshold, on-site gas brings combustible-gas detection, relief and venting, hot-work permitting, and the process-safety interlocks of Chapter 4.9 into the EHS program. This is the cleanest example in the chapter of a goodput/availability decision made elsewhere (firming the power with on-site generation) cascading into an EHS obligation that has to be owned here. → the energy-supply strategy is Chapter 3.5; the gas-process and fuel engineering is Chapter 4.9; commissioning the generation and microgrid controls is Chapter 13.4.

Release work from the verified isolation and the crew’s demonstrated qualifications, with operations owning any loss of redundancy. If either is missing, delay the task; the price of a longer maintenance window is smaller than asking a worker to discover an omitted energy source by contact.