The acquirer who controls the grid controls the era.
NextEra Energy announced a $67-118B all-stock acquisition of Dominion Energy on Monday May 18 2026 · creating the world's largest regulated electric utility · 110 GW generation · 10M customers across FL/VA/NC/SC · 130+ GW large-load pipeline. But the deal logic isn't utility consolidation. It's AI-power-bottleneck capture. Here's the operator-honest read for compliance buyers · 5 cluster gaps where existing SOC 2 / HIPAA / FedRAMP frameworks fall short · and what a custom-backup-build layer adds.
"NextEra isn't buying Dominion Energy. It's buying Data Center Alley. Northern Virginia hosts the densest concentration of data centers on the planet. Every major hyperscaler — Amazon, Google, Microsoft, Meta — operates critical AI infrastructure inside Dominion's service territory. The acquirer who locks up generation and transmission capacity in the right geography doesn't just own a utility. They own the energy supply chain underneath the AI era."
— Raj Brar · Founder, Argus AI Labs · LinkedIn 2026-05-18
— PJ Zonis · SideGuy founder · Encinitas · 858-461-8054
What's actually being acquired
The numbers compliance buyers should care about — utility consolidation is the surface narrative · AI-power-bottleneck capture is the actual story.
All-stock · NextEra shareholders ~75% of combined entity · largest utility transaction in history
Combined renewable + nuclear fleet · NextEra adding 15 GW this decade · world's largest regulated electric utility
Across FL · VA · NC · SC · multi-jurisdiction data-sovereignty footprint · 130+ GW large-load pipeline
Data center electricity demand projected this decade · driven by AI infrastructure buildout
Where existing frameworks fall short
SOC 2 Type II · ISO 27001 · FedRAMP · HIPAA · PCI-DSS — all great frameworks. None of them were written with utility-consolidation-of-AI-data-center-power in mind. Five cluster gaps every compliance buyer should map BEFORE the next audit cycle.
Utility-supply-chain risk in your SOC 2 vendor inventory
Auditors increasingly ask for vendor risk assessments that go BEYOND the cloud provider. When AWS · Azure · GCP all run inside the same utility service territory · and that utility just got consolidated · your vendor concentration risk just changed. Most SOC 2 vendor inventories don't list the underlying energy supply.
- Gap: auditor asks "what's your concentration risk if Dominion territory has a sustained outage" — generic Vanta evidence is silent
- SideGuy add: custom vendor-risk narrative · energy-supply mapping · multi-region failover documentation
- Typical longtail queries:
soc2 utility vendor risk·data center power concentration audit·ai infrastructure vendor risk 2026
Resilience controls need new evidence trails for AI workloads
AI data centers require continuous · uninterruptible power at a scale the existing grid was never designed to deliver. SOC 2 Availability + ISO 27001 A.17 (business continuity) increasingly demand evidence that your AI workload resilience accounts for the underlying generation/transmission constraints — not just your DR plan.
- Gap: auditor wants "how does your AI workload survive a 6-hour transmission interruption" — templated DR evidence doesn't address it
- SideGuy add: bespoke continuous-power evidence narrative · multi-region AI workload failover documentation · grid-dependency mapping
- Typical longtail queries:
soc2 availability ai workload·iso 27001 business continuity data center·ai resilience power outage evidence
AI workloads crossing FL / VA / NC / SC service areas
When data and AI workloads cross multiple state lines under one utility provider · data sovereignty + state-level regulatory frameworks (Virginia's CDPA · Florida's FIPA · NC SB 70 · SC Insurance Data Security Act) all touch the same compliance program. Existing frameworks don't auto-map this.
- Gap: enterprise customer asks "where does our PHI sit when AI inference runs across your region" — generic answer doesn't cut it
- SideGuy add: state-by-state regulatory mapping · AI inference geography documentation · jurisdictional handoff narratives
- Typical longtail queries:
ai data sovereignty multi state·vcdpa ai inference compliance·cross state ai workload compliance
Your cloud provider's energy supply chain audit
Enterprise procurement increasingly demands fourth-party risk visibility — not just your vendors but your vendors' vendors. When AWS · Google · Microsoft · Meta all depend on the same utility provider · your cloud provider's energy supply chain becomes part of YOUR audit scope.
- Gap: security questionnaire asks "fourth-party energy provider concentration" · your cloud provider's SOC 2 doesn't pass it through
- SideGuy add: fourth-party energy supply chain mapping · hyperscaler-region-utility correlation document · custom procurement answers
- Typical longtail queries:
fourth party vendor risk cloud·aws azure gcp utility dependency·hyperscaler energy supply chain audit
Federal AI workload compliance in a consolidated grid era
FedRAMP authorization assumes geographic redundancy and clear vendor boundaries. When AI workloads run on hyperscalers · in Dominion territory · under newly-consolidated utility ownership · the FedRAMP boundary analysis needs to expand. Specifically for agencies adopting AI for citizen-facing services.
- Gap: FedRAMP 3PAO asks "how does the consolidated utility affect your authorization boundary" — most current packages don't address it
- SideGuy add: custom FedRAMP boundary documentation · AI workload power-supply analysis · multi-region authorization mapping
- Typical longtail queries:
fedramp ai workload boundary·fedramp utility consolidation·federal ai compliance 2026
Three live surfaces · pick your entry
No funnel · no gatekeeper · no discovery call. Pick whichever surface matches how you want to evaluate.
GSC-Linked Homepage
SideGuy substrate · 6,144 matrix pages · 200K-page operator site · live GSC signal · operator-honest performance data.
Open homepage →NCSD Compliance Hub
8 NCSD city compliance pages · 5+ vendor matcher quizzes · SOC 2 + HIPAA substrate · operator-honest scoring on Vanta · Drata · Sprinto · Scytale · Thoropass.
Open compliance hub →Katie · SEO Service Hub
$250 Operator Audit start · $2K 10-day onboarding · $500/mo optional ongoing · operator-owned Python toolchain · zero retainer.
Open Katie →The energy era is here. Audit your AI-infra compliance now.
$250 deposit · 3-5 day operator-honest audit of where YOUR compliance program is exposed to AI-infra consolidation risk · credited toward $2K onboarding if you continue · no retainer · no Calendly · no email gate. Payment link arrives within 30 minutes · audit work begins on receipt.
The AI-Infra-Compliance lane builds out from here
This page is the operator-honest ANCHOR. Five deep-dive child pages building out across the next 7-30 days · each maps to one of the 5 gap clusters above · longtail capture + buyer-stage SEO depth. Subscribe to the substrate compound by bookmarking this anchor — child pages link back here when they ship.
Deep-dive on vendor-risk frameworks that need utility-supply-chain mapping post-consolidation.
Resilience controls evidence trail for AI workloads dependent on uninterruptible grid capacity.
Cross-jurisdictional AI inference compliance · VCDPA · FIPA · NC SB 70 · SC IDSA mapped.
Beyond-the-cloud-provider vendor risk · AWS/Azure/GCP utility dependency mapping.
Federal AI compliance · authorization boundary in consolidated-grid era · 3PAO-ready evidence.
Want first access when each child page ships? Text PJ · 858-461-8054 · or bookmark this URL · the substrate compounds inbound.