AI data centers: design flexible demand

On November 2, 2026, one calendar day before this publication in America/Lima, OpenAI announced Grid Protectors, a program for future compute campuses to reduce electricity use when the grid is under strain. The Effingham County pilot builds on an approved Georgia Power contract: the project includes 3,200 MW of new demand and up to 1,000 MW of flexible response. The useful decision for a CTO is not to assume that every AI workload can be switched off. It is to turn each service, training run, and batch job into an operational class with reducible power, required notice, tolerable duration, persisted state, and a recovery objective. Those classes must then appear in the electricity contract, scheduler, and product SLOs. Without that chain, a commercial flexibility promise can shift risk to users, models, data, or the grid itself.

The announcement describes a national ambition and an initial case, not proof that every campus can deliver the same flexibility. OpenAI says arrangements will vary by location and that additional commitments will be published later. It also states that flexibility does not replace new generation or transmission. That boundary matters: reducing demand during a peak may avoid some marginal capacity, but it does not create energy, solve an interconnection by itself, or eliminate the fixed cost of lines, substations, and backup. Acceptance criteria must separate contracted capacity, actually available curtailment, and observed performance during an event.

A demand-response event begins outside the cluster: the utility or grid operator requests a reduction with a target, start time, and duration. The campus translates that request into a power budget, and the control plane decides which workloads to pause, shift, throttle, or temporarily support with storage. The correct order cannot be inferred from GPU utilization. It must come from a policy that protects critical inference, communications, storage, and security functions; uses checkpointing for training; drains batch jobs; and limits new admissions before terminating processes with unpersisted state.

A battery can smooth ramps or bridge a transition, but it must not be counted twice as both continuity energy and grid-committed capacity. Local generation may also supply power when permits, fuel, emissions, synchronization, and safety allow; the announcement presents it only as a site-dependent option. The technical contract needs an explicit hierarchy: reduce deferrable work first, use storage within its reserve second, and retain enough margin for recovery and contingencies. The product must know its degraded mode before the first real event.

Consider a hypothetical campus running interactive inference, overnight fine-tuning, and batch generation. The utility issues an instruction to reduce 30 MW for 90 minutes with fifteen minutes of notice. The policy engine freezes new batch admissions, requests checkpoints from eligible training runs, and lowers concurrency limits on non-critical endpoints. The battery covers the ramp while jobs confirm durable state. Priority endpoints retain capacity and publish a more conservative latency budget. If checkpoints do not finish in time, that block does not count as available curtailment and another preapproved class takes its place.

The hard part comes at the end. Restarting everything at once creates a second peak, pressures storage and networking, rebuilds caches, and may increase errors just as the event ends. A recovery controller releases capacity in stages based on temperature, power, queue depth, and service health. Batch backlog is rate-limited so it does not displace inference. The incident closes only after electricity metering reconciles the requested reduction, the runtime confirms which jobs changed state, and product SLOs return to their normal band. This example is not a benchmark and does not describe OpenAI's campus; it illustrates the state machine a serious commitment requires.

First, classify workloads by impact and dependency, not by owning team. Second, prove that state survives: checkpointing, idempotency, retries, and consistency must be tested with real interruptions. Third, measure power at the contractual boundary and connect it to scheduler decisions through a shared event ID. Fourth, test both the downward ramp and recovery ramp; either can disturb the grid and the service. Fifth, verify degraded mode with synthetic users and separate SLOs. Sixth, reconcile costs, promised capacity, delivered reduction, and exceptions in a receipt that engineering, finance, and operations can review.

Every gate needs a rejection condition. An inventory item without an owner does not enter the flexible pool. A training run without tested checkpointing is treated as firm. A battery without reliable state of charge does not back the commitment. A utility signal without authentication, expiration, and replay protection cannot govern the cluster. A curtailment that meets its MW target but breaks a critical SLO is a joint failure, not an energy success. An event without reconciled metering remains unproven. These rules prevent a dashboard from advertising theoretical flexibility while real operations depend on manual intervention or untested assumptions.

Run monthly simulations and less frequent integrated exercises with the utility. At level one, a signed instruction traverses the control plane without changing power and produces an auditable plan. At level two, synthetic workloads curtail and recover with real metering. At level three, an agreed window activates the full system under supervision. Compare notice time, available MW, ramp rate, sustained duration, lost work, product latency, errors, and recovery time. Preserve weather and operational baselines: two events at different outdoor temperatures do not demonstrate the same cooling performance.

Electrical telemetry has limits as well. The U.S. Department of Energy explains that synchronized AI loads can produce oscillations across multiple frequencies: PMUs are useful at lower frequencies, while point-on-wave measurements capture fast dynamics at the cost of far more data. Not every team needs to deploy both systems, but the design must agree with the utility on which resolution detects the promised ramp and which signal reveals unsafe behavior. Sampling consumption every five minutes may be adequate for billing while still hiding a problematic transient lasting seconds.

Flexibility can fail because risks are correlated. A heat wave raises grid demand and also increases campus cooling consumption, reducing available MW at exactly the wrong time. A model update may make a previously deferrable backlog urgent. A security incident may block automation or require evidence preservation. A battery may be reserved for continuity, degraded, or temperature-limited. Offered capacity must therefore be calculated from joint scenarios and margins, not from the best day of the quarter. The contract also needs rules for partial delivery, justified unavailability, and safety priorities.

A projection must not be turned into realized savings either. Georgia Power projects future customer benefits from its portfolio of large loads and expected growth; that does not yet demonstrate savings for a household or isolate one project's contribution. FERC, meanwhile, has ongoing proceedings covering transparency, cost recovery, and services for flexible loads. A founder buying capacity should review who pays for interconnection, upgrades, firm energy, penalties, and stranded assets if the project is delayed or downsized. The technical architecture and financial agreement are two views of the same risk.

If your roadmap requires dedicated infrastructure, ask for the workload matrix, curtailment mechanism, storage reserve, staged recovery, metering, and cost allocation before signing for flexible MW. If you operate in public cloud, apply the same reasoning to capacity commitments, regions, and queues: identify which work moves, how long it takes, and what evidence confirms it returned healthy. The scale changes; the need for a contract between energy, runtime, and product does not.

Grid Protectors exposes a boundary the industry often hides behind GPU counts: AI compute is also a physical load with local effects, control timing, and financial obligations. The opportunity is not to call an occasional pause sustainable. It is to design flexibility that can be promised, executed, measured, and recovered without sacrificing critical service. If you need to turn a capacity strategy into architecture, automation, and acceptance gates, Wasyra's custom agents and AI development service can help define that operating contract.