Occupational risk assessment in data centers: regulatory issues and responsibilities

Introduction

The rapid expansion of the digital economy has propelled data centers to the heart of critical national infrastructure. These facilities, which host and process massive volumes of data, present technical specificities and occupational hazards that necessitate a particularly rigorous risk assessment approach. According to Interop's survey, 52 of the top % managers working in data centers were aware of at least one accident involving human error, and 14 reported four or more accidents, revealing the scale of the safety challenges in this sector.

Faced with constantly evolving regulations and the emergence of new technologies, business leaders, human resources managers, and prevention officers must master the specificities of risk assessment in these complex technical environments. This article examines the regulatory framework, specific risks, applicable classifications, and legal responsibilities inherent in data center operations.

I. Regulatory and normative framework for data centers

1.1. General obligations under the Labour Code

Article L. 4121-1 of the French Labour Code imposes a general obligation of safety on the employer: «"The employer takes the necessary measures to ensure the safety and protect the physical and mental health of workers."» This obligation is specifically addressed in the context of data centers through several provisions:

• Risk assessment Article R. 4121-1 mandates the transcription of risk assessment results into a single document, a particularly critical requirement in data centers given the diversity and complexity of the risks present.
• Training and information Article L. 4141-1 requires employers to organize appropriate practical training in security matters, including the specific risks associated with the technical environments of data centers.
• Personal protective equipment Article R. 4321-1 et seq. governs the provision of PPE adapted to the electrical, chemical and physical risks present in these installations.

1.2. Specifics of the Building and Housing Code

The French Building and Housing Code (CCH) applies differently depending on whether the data center is built specifically for this purpose or integrated into an existing building:

• Specific constructions Article R. 111-2 of the French Construction and Housing Code (CCH) mandates compliance with fire safety regulations, which are particularly critical in data centers due to significant heat loads and specialized fire suppression systems.
• Integration into existing buildings Articles R. 143-2 et seq. govern changes in use, often necessary when installing a data center in a building not originally designed for that purpose.
• Accessibility and evacuation The provisions relating to accessibility (articles R. 111-19 et seq.) must be adapted to the specific security constraints of data centers

1.3. EN 50600 standard and technical reference documents

The EN 50600 standard is a European standard for data centers that uses a holistic approach to provide comprehensive specifications for the planning, construction, and operation of data centers. It defines four main parts:

• EN 50600-1 General concepts and requirements for data centers
• EN 50600-2 Building infrastructure (mechanical and electrical)
• EN 50600-3 Planning and installation of telecommunications infrastructure
• EN 50600-4 Environmental monitoring and infrastructure control

This standard is aligned with the obligations of the Labour Code by specifying the technical requirements necessary to comply with the employer's general safety obligation.

II. Classification of data centers and differentiated obligations

2.1. Classification by size and regulatory impact

Regulatory requirements vary depending on the size and capacity of the facilities:

• Micro data centers (< 40 kW) Generally not subject to ICPE regulations, these installations fall solely under the general provisions of the French Labor Code. The assessment must cover specific electrical, thermal, and fire risks.
• Enterprise data centers (40 kW – 1 MW) These installations may be subject to the ICPE declaration regime under section 2910 (combustion) if their thermal power exceeds 2 MW
• Hyperscale data centers (> 1 MW) Depending on the size and nature of the installed equipment, it is important to verify whether this new installation falls under the category of classified installations (ICPE). These installations are generally subject to ICPE authorization and may fall under the Seveso III Directive.

2.2. ICPE regulations and risk assessment

• Section 2910 (Combustion) Declaration of 2 to 20 MW thermal / Authorization beyond 20 MW thermal
• Section 1432 (Accumulators) Declaration required for quantities from 50 kg to 250 tonnes / Authorization required for quantities exceeding 250 tonnes

The ICPE regime requires specific hazard studies and internal operating plans (POI) integrated into the overall assessment of occupational risks.

2.3. Seveso III Directive and hazardous substances

Data centers may be affected by this directive if they exceed regulatory thresholds for:

• Lead-acid batteries Lower threshold 250 tonnes, upper threshold 2,500 tonnes
• Extinguishing gas (FM-200, Novec 1230): Classification according to stored quantities
• Diesel fuel for generators : Threshold according to section P2 (flammable liquids)

The application imposes enhanced obligations in the prevention of major accidents and the assessment of environmental risks.

III. Risks specific to data centers

3.1. Electrical hazards: specific characteristics and prevention

• Data center facilities include high voltage (HV) and very high voltage (VHV) equipment, requiring specific electrical qualifications (H1, H2, HC)
• The requirement to maintain electrical continuity limits the possibilities for lockout/tagout, imposing procedures for working on or near live equipment.
• The presence of multiple power sources (grid, inverters, generators) complicates lockout/tagout procedures and increases the risk of error.
• Large storage capacities (several MWh) present risks of explosion, fire, and gas release.

3.2. Fire risks: technical specifications

• The density of electronic equipment generates significant heat loads, accelerating the spread of fire.
• Extinguishing gases (Argonite, FM-200, Novec 1230) present a risk of asphyxiation and require specific evacuation procedures.
• The obligation to maintain critical services limits the firefighters' ability to intervene, requiring adapted intervention protocols.
• The high density of wiring facilitates the spread of fire and toxic fumes.

3.3. Chemical risks: batteries and refrigerants

• Lead-acid batteries contain concentrated sulfuric acid, posing risks of chemical burns and splashes.
• Overcharging or malfunctioning batteries can generate hydrogen releases (risk of explosion) and hydrogen sulfide (toxicity).
• Cooling systems use refrigerants (R134a, R410A, NH₃) that present risks of toxicity and asphyxiation.
• The solvents and degreasers used for equipment maintenance present specific chemical risks

3.4. Ergonomic and organizational risks

• The installation and maintenance of servers (up to 40 kg per unit) exposes workers to musculoskeletal disorders.
• Movement in narrow service aisles and work in subfloors present risks of falls and entrapment.
• Temperature variations between hot and cold zones (differences of 15-20°C) expose individuals to the risk of thermal shock.
• The noise level of ventilation systems (often > 85 dB(A)) necessitates hearing protection and limits communication

IV. Emerging risks related to new technologies

4.1. Liquid cooling and associated risks

The move towards higher power densities leads to the development of liquid cooling:

• Risk of leakage Liquid cooling systems in contact with electrical equipment present risks of electrocution and short circuits.
• Pressure and temperature Total immersion systems require special dielectric fluids, which present new chemical risks.
• Complex maintenance Interventions on these systems require multiple skills (electricity, plumbing, chemistry) and specific protective equipment.

4.2. Embedded Artificial Intelligence and Physical Cybersecurity

Integrating AI systems into data center management generates new risks:

• False positives/negatives Automated systems can generate false alarms or mask genuine dangers, disrupting emergency procedures.
• Physical cybersecurity Cyberattacks can compromise physical security systems (access control, fire suppression, ventilation)
• Predictive maintenance Reliance on predictive maintenance algorithms can lead to underestimating certain risks not detected by sensors

4.3. Large-scale energy storage

The development of high-capacity Li-ion battery storage introduces new risks:

• Thermal runaway Li-ion batteries can experience thermal runaway (thermal runawaydifficult to control and generates toxic gases
• Specific suppression systems These risks require adapted extinguishing systems (water with additives, aerosols) that differ from traditional systems.
• Recycling and end of life The management of waste from used Li-ion batteries presents specific environmental and safety risks.

V. Psychosocial risks specific to data centers

5.1. Work environment constraints

The constant noise from cooling systems (fans, refrigeration units) generates auditory fatigue and limits social interactions.

• Constant artificial lighting disrupts circadian rhythms
• Enclosed spaces without openings to the outside
• Constant air conditioning causing respiratory problems

5.2. Work organization and time constraints

• Permanent on-call duties imposed by the need for 24/7, 365-day/year continuity
• Time pressure during emergency interventions
• Working alone generates social isolation
• High responsibility affecting mental health

5.3. Training and technological development

• Rapid obsolescence of skills requiring intensive training
• Versatility required (electricity, IT, air conditioning)
• Obligation to maintain permanent certifications

VI. Maintenance and intervention by external companies

6.1. Prevention plan: specific obligations

Article R. 4512-6 of the French Labor Code requires preventive measures to be taken before any external intervention. The analysis must cover:

• Increased electrical risks
• Potential service interruptions
• Chemical incompatibilities

Coordination measures include lockout/tagout procedures and evacuation protocols.

6.2. Electrical authorizations and specialized training

• Required qualifications: B1V, B2V, CACES (height rating) depending on voltage present (LV or HV)
• Additional training: emergency procedures, fire suppression systems, batteries, confined spaces

6.3. Confined spaces and working at height

• Confined spaces identified : subfloors, battery rooms, technical ducts
• Mandatory measures External monitoring, breathing apparatus, rescue procedures
• Working at height : MEWPs (platforms) for working at height in server aisles

VII. Legal liability and case law

7.1. Criminal liability in case of accident

The criminal liability of a manager can be incurred under several legal classifications:

• Homicide or unintentional injury In the event of a fatal accident or an accident resulting from a failure to assess risks
• Deliberate endangerment Failure to assess the specific risks of data centers can constitute an immediate risk of death.
• Failure to comply with safety obligations Violations of the provisions of the Labor Code constitute offenses.

7.2. Employer's inexcusable fault

Gross negligence refers to a failure to meet the obligation of achieving a specific result in terms of safety. In data centers, it can be invoked in the following situations:

• Failure to assess electrical risks and redundant systems
• Insufficient training on the specifics of data centers
• Poor maintenance of critical equipment

7.3. Recent Case Law Developments

Case law confirms that awareness of the danger is sufficient to establish gross negligence. Impacts for data centers:

• Technical complexity is not an excuse
• The training requirement is strengthened
• Subcontracting does not exempt the employer.

VIII. Practical recommendations for risk assessment

8.1. Specific evaluation methodology

Area-based approach:

• IT production areas
• Technical areas (power supply, cooling)
• Storage areas (batteries, fuels)
• Reception and administrative areas

Workstation analysis:

• Maintenance Technician
• Supervisory Operator
• Security guard
• Administrative staff

Taking into account degraded situations:

• Emergency power supply interventions
• Evacuation in case of activation of fire suppression systems
• Emergency lighting work

8.2. Monitoring tools and indicators

Specific safety indicators:

• Electrical accident frequency rate
• Number of emergency interventions
• Average duration of exposure to noise
• Number of false fire alarms

Authorization traceability: Electrical authorization tracking system, CACES certifications and training with renewal alerts.

Periodic audit:

• Compliance with EN 50600 standards
• Effectiveness of emergency procedures
• Alignment of training programs with technological developments

8.3. Action plan and continuous improvement

Prioritizing actions: Criticality matrices adapted to data centers considering probability × severity × impact on service continuity.

Technology watch on :

• Evolution of cooling and storage technologies
• New sector-specific security standards
• Lessons learned from accidents

Continuing education:

• Initial enhanced training
• Periodic recycling
• Regular evacuation drills

IX. Prospects for regulatory developments

9.1. Impact of the European directive on energy efficiency

The European directive 2018/2002 on energy efficiency impacts data centers through the obligation to recover waste heat, generating new risks:

• Heat recovery systems Installation of hot water circuits presenting risks of leakage and scalding
• Cogeneration : Development of combined heat and power (CHP) systems presenting specific industrial risks
• Thermal storage : Use of phase-change materials presenting new chemical risks

9.2. Evolution of the EN 50600 standard

Energy and environmental sustainability are central elements of the EN 50600 standard. Current revisions incorporate:

• Sustainability criteria : Consideration of the equipment life cycle in risk assessment
• Climate resilience : Adaptation to extreme weather events (heat waves, floods)
• Physical cybersecurity : Integration of cyberattack risks on physical infrastructures

9.3. REACH Regulations and Chemical Substances

The evolution of REACH regulations impacts data centers through:

• Restrictions on refrigerants : Shift towards natural fluids (CO₂, NH₃) presenting new risks
• Batteries without heavy metals : Development of new storage technologies with new risk profiles
• Insulation materials Restrictions on certain insulating materials used in electrical equipment

Conclusion

Risk assessment in data centers presents a major challenge for employers given the multiplicity and specificity of risks present in these complex technical environments. The convergence between the general obligations of the Labor Code, the specific requirements of the Building and Housing Code, and technical standards such as EN 50600 necessitates a rigorous and tailored methodological approach.

The constant technological evolution of the sector, the emergence of new risks related to liquid cooling and energy storage technologies, as well as the strengthening of case law regarding employer liability, make it essential for managers and their prevention teams to have a perfect grasp of these issues.

Beyond simple regulatory compliance, effective risk assessment in data centers helps protect people, contributes to service continuity and can provide a competitive advantage in a sector where reliability and security are key criteria for customers.

Faced with the increasing complexity of these installations and the considerable economic and legal stakes, support from experts specializing in industrial security and data centers, as well as the implementation of a continuous improvement approach based on sectoral feedback, appear as essential investments for any operator concerned with controlling these emerging risks.

The ongoing digital revolution is only amplifying these challenges, making a proactive and anticipatory approach to occupational risk prevention in these critical infrastructures of the digital economy more necessary than ever.

At MD Conseil Formation, our senior consultant trainers offer several consulting, support and training services for your staff to help you better manage the many risks of your data centers.