At a recent Lehigh Valley Chamber of Commerce event, I talked with a mix of people I don’t usually see in one room: sales leaders from major corporate banks, several MSPs, and people from waste management. Different markets, same three worries.

Is AI a bubble, and what happens to us if it pops?

What is all of this doing to the environment, and to my electric bill?

How do I lock this down when I don’t have a security department?

That mix is what made it interesting. The bankers hear these questions from the mid-sized companies they work with. The MSPs are the ones those companies call when they want AI “locked down.” And waste management is about as operations heavy as a business gets, with routes, trucks, and dispatch, and very little patience for hype.

What all of them were missing was a straight answer that fits a company of 50 to 500 people, not a Fortune 100 with a dedicated AI governance team.

I wrote a short post recently on the first question. This article goes further and takes on all three, plus the one nobody says out loud: how do I keep up with any of this while running my business?

Worry 1: Is AI a bubble?

My short answer: expect a shakeout, not a collapse. And the businesses that will feel it least are the ones that never bet the farm on a single vendor.

China shows what a bust looks like. In late October, Reuters reported that China’s STAR50 index of AI and chip stocks fell about 40% in four months, erasing roughly $480 billion in value. The warning signs were visible earlier. China declared AI a national priority, and local governments raced to hit targets. Hundreds of data centers went up in remote areas with cheap power, built to train models because that is what the plan rewarded.

Then demand shifted toward running models for real users, and location suddenly mattered. Training can happen anywhere. Serving users means every request makes a round trip, and those remote sites were too far from the tech hubs where fast responses count, and too far from the skilled staff needed to run them. Efficient models like DeepSeek needed far less hardware on top of that, and much of the capacity sat idle. China built to a mandate. Supply answered to policy, not customers.

The US is building to a forecast. After third quarter earnings, Amazon, Alphabet, Meta, Microsoft, and SpaceX are on pace to spend $803 billion to $828 billion on capex this year, mostly on AI infrastructure, and every one of them says 2027 will be higher. For context, the four largest spent about $410 billion in 2025. Most of this is funded from cash flow, and shareholders expect a return. If customers don’t show up, the spending stops. That is a real check that China’s buildout never had.

But our demand signal isn’t clean. Some AI “demand” is circular: chipmakers and cloud providers invest in AI companies that spend the money right back on their chips and cloud. More of the buildout is now financed with debt secured by hardware that loses value in a few years. The Federal Reserve’s May 2026 Financial Stability Report listed AI among the risks market contacts raised most often, citing valuations and debt-funded capex. Even the builders are hedging. OpenAI’s new community commitments include financial guarantees so local customers are protected if a campus is “delayed, reduced, or canceled.” That is the China lesson written into a corporate policy.

Today’s prices aren’t a true read either. Much of AI is priced like a loss leader. The Wall Street Journal reported that OpenAI ran a negative 122% adjusted operating margin in the first quarter of 2026. Flat monthly subscriptions often cost less than heavy users actually consume. Investors are paying for market share, the way they once paid for cheap Uber rides. Expect the cost of each task to keep falling as the technology improves, but expect today’s generous flat-rate deals to tighten, especially for heavy agentic use.

The wildcard is Meta, and it looks a lot like Android. Meta just launched Muse Wonder while giving away open-weight models, and Chinese labs keep shipping strong open models too. Meta doesn’t need to make money on models. It makes money on ads, and giving models away protects that business. That puts a price floor near zero under everyone else, which grows real demand but squeezes every company that does need to charge for AI.

The Android comparison cuts both ways. Google kept the base of Android open while the pieces that mattered became proprietary over time. Meta keeps its best models in house and controls the roadmap for the open ones. For a mid-sized firm, an open-weight model is a real option: you can run it on your own hardware, keep sensitive data inside your walls, and it never expires. But you are trading a vendor contract for a dependency on Meta’s roadmap.

So where does that leave a mid-sized company? The cash-funded giants will be fine. The pain lands on leveraged builders and on AI vendors whose pricing gets squeezed. Think 2001 telecom: equity wiped out, infrastructure repriced, and the fiber eventually used.

Your exposure is not the stock market. It is the smaller AI vendor you signed a three-year contract with.

Worry 2: What is this doing to the environment?

The environmental cost of AI is real, but it is also more nuanced than the headlines. Some of the biggest problems are already being solved by good engineering. Others are not.

The scale. A Department of Energy report by Lawrence Berkeley National Laboratory found that data centers used 4.4% of US electricity in 2023, and could use 6.7% to 12% by 2028. Water use rose from about 5.6 billion gallons in 2014 to about 17 billion gallons in 2023, and the largest operators alone could use 16 to 33 billion gallons by 2028.

The local picture. Data centers have replaced warehouses as the biggest developer of industrial space in Lehigh and Northampton counties. Proposals include a 5.1 million square foot campus across from Parkland High School and a 2.6 million square foot complex at Air Products’ former Upper Macungie headquarters. The Lehigh Valley Planning Commission has said a single hyperscale site can use as much energy as half a million homes, and more than a dozen municipalities are writing data center rules.

The bill. Wholesale power costs in PJM, the grid that serves Pennsylvania and New Jersey, rose 50.3% in the first half of 2026. The independent market monitor found that projected data center demand alone added $11.11 per megawatt-hour, and recommended that data centers bring their own new generation rather than pass the cost to everyone else. If your facilities budget jumped this year, this is a big part of why.

Per task, AI is getting far more efficient. Google reported that a median Gemini text prompt uses about 0.24 watt-hours, roughly nine seconds of TV, and that energy per prompt fell 33 times in a single year. The problem is aggregate scale and where the buildings land, not the email your team drafted this morning.

Engineering firms are already solving the water problem. The best-designed sites don’t drink from the local reservoir. They cool with treated wastewater that would otherwise be discharged, or with closed systems that barely use water at all.

Google, Douglas County, Georgia. Since 2008, Google has diverted about 30% of the county’s treated wastewater through a treatment plant it financed, used it in the cooling towers, then treated what didn’t evaporate on site before returning it to the Chattahoochee River “clean, clear and safe.”

Black & Veatch, Washington State. A 1.4 million gallon per day reuse plant turns a city’s wastewater effluent into cooling water for more than 60 MW of data centers, with the goal of eliminating the discharge to local waterways. It went from design to start-up in 14 months.

CDM Smith, North America. A 2 million gallon per day reclaimed water system using ultrafiltration and reverse osmosis moved a data center campus off groundwater entirely.

Amazon Web Services. AWS uses recycled wastewater for cooling at 20 data centers, including 16 in Virginia.

Microsoft’s closed-loop design. New Microsoft sites cool at the chip in a sealed loop that is filled once during construction, avoiding more than 33 million gallons of water per data center per year. Pilots come online in 2027. The tradeoff is that low-water cooling generally uses more electricity, so water savings come partly at the expense of power.

This is a solved engineering problem, not a hope. The question for Lehigh Valley municipalities writing data center ordinances is whether they require it.

Carbon is the harder problem, and Pennsylvania is at the center of the answer. Microsoft’s emissions rose about 25% in a single year, which it attributed primarily to its data center buildout. But much of the new demand in our region is being met with nuclear power, not coal.

Limerick, Montgomery County. A 20-year Google power deal is helping fund a 348 megawatt upgrade at the Limerick nuclear plant, about 15% more output from existing reactors. Constellation is investing at least $4.3 billion across six sites, which it says it can do because of Google’s commitment. Upgrades run from 2028 to 2032, and the state building trades estimate at least 2,500 local construction jobs.

Salem, South Jersey. The same deal adds 97 megawatts at the Salem Generating Station.

Three Mile Island. Unit 1 is being restarted as the Crane Clean Energy Center under a 20-year deal with Microsoft, possibly as early as 2027.

Susquehanna, Salem Township. Talen’s nuclear plant has a 1,920 megawatt supply agreement with Amazon through 2042.

Data centers aren’t static, and that cuts both ways. A data center is not a warehouse that gets built once and left alone. The hardware inside runs on a refresh cycle of a few years, and every refresh brings more efficient chips, new cooling, and often more power per rack, not less. That constant churn is real, ongoing work: electricians, cooling and HVAC technicians, network and facilities staff, and the local contractors and suppliers behind them. Locally, TierPoint’s 100 megawatt expansion of its Tek Park data center in Upper Macungie is expected to add up to 100 jobs. For the engineering, construction, and building services firms I work with, that upgrade cycle is a steady source of work, not a one-time project.

The same churn creates waste, and a resource. One study estimates generative AI servers could produce between 1.2 and 5 million metric tons of electronic waste from 2023 to 2030. But that waste is full of valuable material, and the industry is starting to treat it that way.

The first answer is reuse. The same researchers found that keeping servers in service one extra year would cut e-waste by 62%, and a secondary market for used AI chips launched this summer to give older hardware a second life. Microsoft reports that 90.9% of its servers and components were reused or recycled in 2024.

The second answer is recovery. Microsoft and Western Digital recovered about 90% of the rare earth metals from 50,000 pounds of shredded data center hard drives, along with copper, aluminum, steel, and gold, with 95% lower emissions than mining. Today, US recycling recovers less than 10% of these materials, and most rare earth production happens overseas. Recovering them here is an environmental win and a supply chain win.

For a mid-sized company, the lesson is the same at a smaller scale: when you retire servers and laptops, use a certified IT asset disposition and recycling vendor that wipes your data securely and documents where the material goes.

What’s still unsolved: air quality. In Virginia, permits show thousands of diesel backup generators attached to data centers. Virginia now requires cleaner generators for new permits and has started air monitoring in its “data center alley.” Generator standards belong in local ordinances from day one.

The industry is starting to write its own rules. In February, Anthropic committed to cover electricity price increases its data centers cause, pay for grid upgrades, use closed-loop and air cooling, and decline local tax incentives so full property tax revenue stays in the community. This week, OpenAI published a community compact: pay the full cost of power, post financial guarantees, publish water and electricity use for each site, run independent noise studies, and sign no NDAs with public officials.

These are voluntary promises, not results. But together they give local officials a ready checklist to ask of any developer. Community acceptance is now a real factor in how fast data centers get built, and the question for officials is whether to make these requirements rather than rely on promises.

So the fair question for a community is not whether data centers bring jobs and technology. They do. It is whether those jobs, the tax revenue, and the investment outweigh the load on the grid, the water, and the land, and who pays for the new power.

What a mid-sized company can actually control:

Use the smallest model that does the job. Most document, email, and summary work does not need the largest frontier model. Smaller models cost less and use less power.

Don’t pay for idle capacity. Avoid commitments that lock you into compute you won’t use. That is the China mistake at company scale.

Ask vendors where and how they host. Energy sourcing and cooling methods are fair procurement questions.

Plan for higher energy costs in your own budget, whether or not you ever use AI.

Worry 3: How do I lock this down?

You can’t ban your way to AI security. You lock it down by making the approved path better than the personal one.

Your people are already using AI, with or without you. In PagerDuty’s 2026 survey, 66% of office professionals had used AI at work despite believing it wasn’t permitted, and 88% had shared work data with a public AI tool. Verizon’s 2026 breach report, which measured network traffic rather than asking people, found that 67% of AI users reach it through personal accounts on company devices. Those surveys skew toward large companies. In a 100-person firm with no security team, I’d expect the numbers to be higher, not lower.

It costs real money. IBM found that breaches at organizations with heavy unsanctioned AI use cost about $670,000 more on average, and in 97% of those incidents the company had no AI access controls in place.

Bans make it invisible, not gone. The pattern repeats: a company blocks ChatGPT, and within weeks staff are pasting from a personal Gmail tab or a phone. Employees aren’t being reckless. They route around a tool that is slower or worse than the $20 subscription in their pocket.

Compliance plus a stretched IT team equals a ban. One of the bankers I talked with was frustrated. His IT team had banned the agentic AI tools that would have made him dramatically more efficient: tools that research, draft, and work across his systems on his behalf.

The issue wasn’t that SOC 2 forbids AI. It doesn’t. SOC 2 requires that you can show controls over access, data handling, vendor risk, and monitoring. His IT team simply didn’t have the people or the time to build and document those controls for a new class of tool, so “no” was the only answer they could defend to an auditor. I don’t blame them. Agents act, not just answer, and an agent with broad access to client data is a real risk.

But the cost of that “no” doesn’t disappear. It shows up as lost productivity for the people closest to revenue, or as work quietly moving to a personal phone, the one place the auditors can’t see. If a major bank’s IT team can’t find the capacity, a 150-person firm certainly can’t. That is the real mid-market problem: not a lack of rules, but a lack of hands to implement them.

Why it feels harder for mid-sized companies: you have the same data obligations as an enterprise (client contracts, CUI, HIPAA, PCI) but no CISO, no data loss prevention team, and an IT person or MSP already at capacity. The answer is not an enterprise governance program. It is a short list done well.

Pick an approved tool and pay for the business tier. Business and enterprise plans typically keep your data out of model training and give you admin controls and single sign-on. A free personal account gives you none of that.

Write a one-page policy. Three data tiers are enough: public (anything goes), internal (approved tool only), and restricted (client confidential, regulated, or personal data stays out unless a specific approved workflow covers it).

Audit what’s connected. Note-takers, browser extensions, and “Sign in with Google” apps quietly get access to calendars, mailboxes, and files. Review those permissions in Microsoft 365 or Google Workspace every quarter.

Train on real work, not slides. Show people how to use the approved tool on their actual tasks. Adoption is the control.

Put AI into vendor reviews. Ask every software vendor what AI features they’ve added, where your data goes, and whether you can turn it off.

Staying current without making it a second job

Running a business is a full-time job. Keeping up with AI can feel like another one. The answer is not reading more AI news. It is a light routine tied to your own business.

Follow your workflows, not the headlines. Most AI news won’t affect you. Pick two or three processes that eat time, like proposals, reporting, or scheduling, and ask once a quarter whether AI does them better yet.

Use it yourself, 30 minutes a week. Hands-on time with your approved tool teaches more than any article, and it makes you far better at telling hype from substance.

Name an internal AI champion. It doesn’t have to be IT. Pick the curious person who is already experimenting, give them about 10% of their time, and have them report back monthly on what worked, what didn’t, and what it cost.

Add 15 minutes to a meeting you already hold. Once a quarter, put AI on the leadership agenda: what’s in use, what it costs, any new risks, and one pilot to try next. No new committee.

Learn from peers. Chamber events and industry groups are where you hear what is actually working at companies your size. That is exactly where the conversations behind this article happened.

Borrow expertise for the big decisions. For a platform choice, a governance setup, or a compliance question, bring in an outside advisor instead of becoming the expert yourself.

One answer to all of it: stay flexible

The same decisions protect you from a market shakeout, keep your costs and footprint sensible, and make AI easier to govern. Here is what I’m telling mid-market clients.

Avoid long, rigid lock-in with a single AI vendor. Prefer annual or monthly terms. If a vendor gets acquired, raises prices, or folds, you want to be able to walk.

Design so you can swap models without rebuilding workflows. Keep your prompts, documents, and business rules in systems you own, and treat the model as a replaceable part.

Keep an open-weight option in your back pocket. It is your fallback if a vendor changes terms, and your private path for data that should never leave your walls.

Don’t build a business case on today’s subsidized prices. The cost of each task will keep falling, but generous flat-rate deals won’t last forever. Budget on metered rates and keep the ability to switch.

Right-size the model to the task. Smaller models are cheaper, faster, and lighter on the grid.

Govern before you scale. One approved tool, one page of policy, and a quarterly review of what’s connected will do more than any ban.

None of this requires predicting whether the bubble pops. It works either way.

The number to watch

Watch whether real customer revenue, not vendor-funded spending, keeps pace with the buildout. China never had to pass that test. The US is taking it now.

In the meantime, the businesses that come out ahead will be the ones that used AI deliberately, paid for what they needed, and kept the keys to their own data.

Start the conversation

If you were at the Chamber event and we talked, I’d like to hear how your company is handling any of these. And if you weren’t, which one keeps you up at night?

I work as a fractional CIO with engineering, construction, building services, and operations heavy firms across Eastern Pennsylvania and New Jersey, and I’m vendor neutral: I don’t resell AI tools or take referral fees, so the advice is about what fits your business.

SilvaTechSolutions.com

Or reach me directly at 484-580-9523.

Sources

The bubble

The environment

Locking it down

Deel Works: Shadow AI is the new shadow IT (PagerDuty, Verizon, IBM data)

Jeremy T. Silva is the owner of Silva Tech Solutions LLC and works as a fractional CIO with engineering, construction, building services, and operations heavy firms across Eastern Pennsylvania and New Jersey. He has twenty five years of enterprise IT leadership experience, including director level roles at AdaptHealth and Encore Global.

SilvaTechSolutions.com | 484-580-9523

AI After the Hype: What Mid-Market Leaders Should Actually Do