Written by: Jakub Pietroszek, Partnership Manager, Digital Colliers
Swiss Re projects global data-centre insurance premiums will hit $20-30 billion a year by 2030. About 40% of US data-centre capacity sits in tornado-prone areas. That is the headline. Here is the problem: if you are underwriting debt against these facilities, you are probably looking at site risk, power risk, and counterparty risk as three separate exercises. They are not. And the gap between those three views is where defaults happen.
Why this is landing now
The data-centre build-out is real. Hyperscalers and enterprise buyers are signing capacity at record pace. Banks are financing construction and leasebacks at scale. But the underwriting model most shops use still treats these as straightforward infrastructure plays. You assess the site, you confirm the power permit, you check the borrower's balance sheet. Three boxes, three separate teams, three weeks of turnaround.
The insurance market is telling you something. Premiums are climbing because physical risk is climbing. A tornado does not care if your net lease has 15 years left. The EPA rule change on power plant permitting is adding 9-18 months to timelines in practice. And the borrower's AI capex plan matters more than their debt service coverage ratio, because if their AI bet does not pay off, they do not need the racks.
The three datasets banks rarely hold together
Site-hazard data is usually a consultant report. You get a PDF with flood zones and seismic scores. Power-permit status lives in another silo, often tracked manually by the infrastructure team. Counterparty AI exposure is the one most credit committees ignore entirely. If the anchor tenant is a hyperscaler, you assume they know what they are doing. If the borrower is a regional operator, you look at their last three years of EBITDA and call it a day.
But those three things interact. A site in a tornado corridor is not a problem if the power permit clears fast and the tenant is locked in. A power permit delay is manageable if the site is low-risk and the borrower has balance sheet depth. A shaky AI business case is survivable if the physical and regulatory risk is minimal. But when you get two or three of those variables going wrong at once, the loan blows up.
Why the counterparty piece is the catch
Most data centres going up right now are being built for AI workloads. Training runs, inference at scale, the whole stack. The borrower's pitch is that demand is infinite. The tenant says they need 50 megawatts today and 200 in two years. The credit committee sees signed LOIs and says yes.
Here is what the credit committee does not see. More than 80% of AI projects fail, roughly twice the failure rate of conventional IT projects. 88% of AI proofs-of-concept never reach production. 42% of companies abandoned most of their AI initiatives in 2025, up from 17% the year before. If your anchor tenant is betting their next five years of capex on AI workloads that have an 80% chance of not shipping, your collateral is a very expensive empty building in a place where tornados happen.
The pattern I keep seeing: banks treat the tenant's AI spend as a given, not a risk factor. If the borrower shows a contract, the loan gets written. No one is asking what happens if the tenant cuts AI capex by 60% in year two. No one is stress-testing the default scenario where the racks sit dark because the workload never materialized.
What a single credit view actually looks like
You need one dataset that shows site risk, permit status, and tenant AI exposure on the same page. Not three separate reports that land in different inboxes. The credit officer needs to see: this site has moderate tornado risk, the power permit is four months behind schedule, and the anchor tenant has 70% of their capex committed to AI initiatives with a historical production rate under 15%.
Most banks do not have that view today. The data exists, but it lives in three places. Site risk is in the consultant's model. Permit status is in an email thread. AI exposure is nowhere, because no one thought to ask.
The shops that are building this view are starting with the permit data. EPA timelines are public record. Site hazard is harder but still mappable. AI exposure is the tricky one, because it requires reading the tenant's public filings and actually modeling what happens if their AI bets do not land.
What happens if you do not build this
Loans are getting written today that will default in 18 to 24 months. By the time the insurance bill doubles or the power permit stalls or the tenant backs out of half their capacity, the facility is already funded. The credit committee approved it six months ago based on three separate risk assessments that never talked to each other.
The winning operators are not waiting. They are building the joined view now, before the first wave of defaults lands. If you are underwriting data-centre debt and you cannot see all three risk factors in one place, you are writing blind. The market will tell you that soon enough.