Responsible AI's Missing Layer
Responsible AI frameworks govern the model — its outputs, its behaviors, the harms it produces when it runs. That scope stops at the server. Every model runs on land that gets rezoned, water drawn from shared reservoirs, and power grids stretched thin.
The case
Northern Virginia holds 13% of global data-center capacity. The Digital Gateway project proposed a 2,100-acre, 37-data-center campus in Prince William County, approved after a 27-hour hearing in December 2023. Two courts later voided that approval, but not for any reason a responsible AI framework would catch: the county failed to meet a public notice requirement under Virginia Code. A newspaper-advertising technicality stopped the project. No ethics framework did.
Two dilemmas the framework can't see
The first is procedural: residents received legally deficient notice while a board chair holding stock in the developer's parent company and a supervisor who'd contracted to sell his own land into the project both had a hand in the vote. The second is distributive: water drawn from a regional drinking supply and a tax subsidy costing Virginia $750 million a year concentrate benefits in a handful of localities — Loudoun County residents gained roughly $1,506 each — while the cost, about $87 a head, falls on all 8.6 million Virginians. NIST's AI Risk Management Framework asks developers to complete a risk register for the model. It asks nothing about where the server farm goes.
A developer can be fully compliant on paper and still miss both problems.Governance regulates what AI does, not what running AI requires.
Three fixes
The paper proposes extending risk frameworks to cover infrastructure siting with binding, not voluntary, standards; mandating water and energy disclosure at the point of application instead of after facilities are already built; and replacing public comment — which well-resourced developers can simply outlast — with binding community review modeled on NEPA's environmental impact process.