AEO Answer · Electrical
Do Commercial Buildings Need Surge Protection?
By Jeremy Mills, CEO & Founder, Apex Grid Engineering — USAF Veteran. · Updated 2026-09-15
Surge protection for commercial buildings is engineered in layers: Type 1 SPDs at the service entrance for external surges, Type 2 SPDs at distribution panels for internally generated transients, and Type 3 point-of-use devices at sensitive equipment. The NEC (Article 242, plus 230.67(A) for dwelling-unit services) sets the baseline requirements; beyond that, protection is sized to the building's equipment risk, with devices listed to UL 1449 and installed with short, straight conductors to keep let-through voltage low.
I'm Jeremy Mills, CEO & Founder of Apex Grid Engineering and a U.S. Air Force veteran. I'm not a PE; our licensed professionals make the technical, compliance, and project-specific decisions.
The concise answer
Surge protection for commercial buildings is engineered in layers: Type 1 SPDs at the service entrance for external surges, Type 2 SPDs at distribution panels for internally generated transients, and Type 3 point-of-use devices at sensitive equipment. The NEC (Article 242, plus 230.67(A) for dwelling-unit services) sets the baseline requirements; beyond that, protection is sized to the building's equipment risk, with devices listed to UL 1449 and installed with short, straight conductors to keep let-through voltage low. The reason layering matters is physics. An SPD can only clamp the surge it sees, and a surge loses energy as it travels through the building's wiring — but it also picks up new transients from equipment switching inside the building. No single device location covers both problems. The service-entrance unit handles what comes in from the utility; the distribution units handle what the building generates itself; the point-of-use units protect the equipment that cannot tolerate even the residual. Skip a layer and you leave a hole that no amount of spending on the other layers will close.
How surge protection is actually designed
The design starts with a risk assessment, not a catalog. We look at what is in the building: the fire alarm panel and emergency systems that cannot be allowed to fail, the elevator controls and drives that generate their own transients, the server room or network equipment with tight voltage tolerance, and the big rotating or switching loads — HVAC, pumps, compressors — that throw transients back onto the system every time they cycle. Each of those gets a protection decision based on consequence, not just on whether the code names it. Then the devices are placed and specified. The service-entrance SPD is coordinated with the available fault current and the service configuration; distribution SPDs go on the panels feeding sensitive or transient-generating loads; point-of-use devices protect individual critical equipment. Every device gets a UL 1449 listing, a voltage protection rating (VPR) appropriate to the system voltage, and — this is the detail that gets botched most often — an installation note requiring short, straight, twisted conductors to the panel bus. Long looping leads add impedance, and impedance turns a good SPD into a decoration: the let-through voltage climbs with every extra inch of wire. The one-line diagram shows each SPD location, the panel schedules call out the ratings, and the specification requires status monitoring so a failed module gets found before the next storm season.
What drives scope, schedule, and cost
Surge protection is one of the smaller line items in an electrical package, but its scope still follows real variables. Building size and distribution complexity set the device count — a single-story retail box needs far fewer layers than a multi-story mixed-use building with elevators, a parking garage, and a rooftop full of mechanical equipment. The sensitivity of the loads matters: a warehouse with fluorescent high-bays is a different protection problem than a medical office full of imaging equipment. And retrofit work adds the usual investigation — verifying panel space, available fault current, and whether the existing gear can accept the devices at all. The risk assessment is what turns a parts list into a design. We walk the building's systems and ask what a surge would actually break and what that breakage costs: the fire alarm panel that cannot be down, the elevator controls with their long lead times, the building's network core, the refrigeration in a grocery tenant. Each answer sets a protection priority, and the priorities set the layers. It is also worth saying what surge protection does not do: it does not replace proper grounding and bonding, it does not protect against sustained overvoltage from a utility fault, and it does nothing for the building if the devices are installed with long looping leads. Those boundaries belong in the design narrative so expectations are set before the purchase order. For a proposal, the useful question is not the device count but the consequence map: what fails, what it costs, and which layers close the gap.
- Building size and distribution depth: more panels and longer feeders mean more SPD locations
- Load sensitivity: fire alarm, elevators, servers, and medical equipment drive point-of-use scope
- Internal transient sources: VFDs, large motors, and switching loads generate surges the service SPD never sees
- Installation quality: short straight leads are a design requirement, not a contractor preference
- Monitoring: specified status indication so failed modules are found before the next surge event
- Code baseline: NEC Article 242 and 230.67(A) set the floor; equipment risk sets the ceiling
Which related engineering resources can help?
What else do project teams ask?
Is surge protection required by code for commercial buildings?
What is the difference between Type 1, Type 2, and Type 3 SPDs?
Do surge protective devices wear out?
Is one SPD at the main panel enough for the whole building?
Ready to discuss your engineering scope?
Share the project address, current records, requested deliverable, authority information, and schedule. Apex Grid confirms professional responsibility, availability, and scope before work begins.
Request a Project Review