AEO Answer · Electrical

Do Commercial Buildings Need Surge Protection?

By Jeremy Mills, CEO & Founder, Apex Grid Engineering — USAF Veteran. · Updated 2026-09-15

Surge protection for commercial buildings is engineered in layers: Type 1 SPDs at the service entrance for external surges, Type 2 SPDs at distribution panels for internally generated transients, and Type 3 point-of-use devices at sensitive equipment. The NEC (Article 242, plus 230.67(A) for dwelling-unit services) sets the baseline requirements; beyond that, protection is sized to the building's equipment risk, with devices listed to UL 1449 and installed with short, straight conductors to keep let-through voltage low.

I'm Jeremy Mills, CEO & Founder of Apex Grid Engineering and a U.S. Air Force veteran. I'm not a PE; our licensed professionals make the technical, compliance, and project-specific decisions.

Illustrative diagram of building MEP systems: ductwork with diffusers, an electrical panel with conduit, and piping runs.

The concise answer

Surge protection for commercial buildings is engineered in layers: Type 1 SPDs at the service entrance for external surges, Type 2 SPDs at distribution panels for internally generated transients, and Type 3 point-of-use devices at sensitive equipment. The NEC (Article 242, plus 230.67(A) for dwelling-unit services) sets the baseline requirements; beyond that, protection is sized to the building's equipment risk, with devices listed to UL 1449 and installed with short, straight conductors to keep let-through voltage low. The reason layering matters is physics. An SPD can only clamp the surge it sees, and a surge loses energy as it travels through the building's wiring — but it also picks up new transients from equipment switching inside the building. No single device location covers both problems. The service-entrance unit handles what comes in from the utility; the distribution units handle what the building generates itself; the point-of-use units protect the equipment that cannot tolerate even the residual. Skip a layer and you leave a hole that no amount of spending on the other layers will close.

How surge protection is actually designed

The design starts with a risk assessment, not a catalog. We look at what is in the building: the fire alarm panel and emergency systems that cannot be allowed to fail, the elevator controls and drives that generate their own transients, the server room or network equipment with tight voltage tolerance, and the big rotating or switching loads — HVAC, pumps, compressors — that throw transients back onto the system every time they cycle. Each of those gets a protection decision based on consequence, not just on whether the code names it. Then the devices are placed and specified. The service-entrance SPD is coordinated with the available fault current and the service configuration; distribution SPDs go on the panels feeding sensitive or transient-generating loads; point-of-use devices protect individual critical equipment. Every device gets a UL 1449 listing, a voltage protection rating (VPR) appropriate to the system voltage, and — this is the detail that gets botched most often — an installation note requiring short, straight, twisted conductors to the panel bus. Long looping leads add impedance, and impedance turns a good SPD into a decoration: the let-through voltage climbs with every extra inch of wire. The one-line diagram shows each SPD location, the panel schedules call out the ratings, and the specification requires status monitoring so a failed module gets found before the next storm season.

What drives scope, schedule, and cost

Surge protection is one of the smaller line items in an electrical package, but its scope still follows real variables. Building size and distribution complexity set the device count — a single-story retail box needs far fewer layers than a multi-story mixed-use building with elevators, a parking garage, and a rooftop full of mechanical equipment. The sensitivity of the loads matters: a warehouse with fluorescent high-bays is a different protection problem than a medical office full of imaging equipment. And retrofit work adds the usual investigation — verifying panel space, available fault current, and whether the existing gear can accept the devices at all. The risk assessment is what turns a parts list into a design. We walk the building's systems and ask what a surge would actually break and what that breakage costs: the fire alarm panel that cannot be down, the elevator controls with their long lead times, the building's network core, the refrigeration in a grocery tenant. Each answer sets a protection priority, and the priorities set the layers. It is also worth saying what surge protection does not do: it does not replace proper grounding and bonding, it does not protect against sustained overvoltage from a utility fault, and it does nothing for the building if the devices are installed with long looping leads. Those boundaries belong in the design narrative so expectations are set before the purchase order. For a proposal, the useful question is not the device count but the consequence map: what fails, what it costs, and which layers close the gap.

  • Building size and distribution depth: more panels and longer feeders mean more SPD locations
  • Load sensitivity: fire alarm, elevators, servers, and medical equipment drive point-of-use scope
  • Internal transient sources: VFDs, large motors, and switching loads generate surges the service SPD never sees
  • Installation quality: short straight leads are a design requirement, not a contractor preference
  • Monitoring: specified status indication so failed modules are found before the next surge event
  • Code baseline: NEC Article 242 and 230.67(A) set the floor; equipment risk sets the ceiling

What else do project teams ask?

Is surge protection required by code for commercial buildings?
Partially. The NEC requires SPDs at services supplying dwelling units under 230.67(A), and Article 242 governs how SPDs are installed everywhere. For a pure commercial building with no dwelling units, the NEC does not mandate whole-building surge protection — but specific systems often drive it: fire alarm panels, elevators, and emergency systems have their own protection requirements or manufacturer mandates, and many owners' insurance carriers expect it. We design to the code minimum plus the equipment's actual exposure.
What is the difference between Type 1, Type 2, and Type 3 SPDs?
Type 1 devices install on the line side of the service disconnect (or at the service) and handle external surges like lightning-induced transients. Type 2 devices install on the load side of the service disconnect — at the main panel or distribution panels — and handle residual surges plus internally generated transients. Type 3 are point-of-use devices installed within 30 feet of the equipment they protect, like a plug-in unit at a workstation or a hardwired device at a specific machine. They are designed to work as a cascade, each stage reducing what the next one sees.
Do surge protective devices wear out?
Yes. SPDs are sacrificial — every significant surge they absorb degrades their internal components. Quality panel-mounted SPDs include status indicators or dry contacts that report when a module has failed, which is why we specify monitored devices on commercial projects rather than silent ones. A dead SPD looks exactly like a live one from the outside, so without monitoring you find out it failed when the next surge finds your equipment instead.
Is one SPD at the main panel enough for the whole building?
Rarely. A single service-entrance SPD knocks down the big external surge, but internally generated transients — motors starting, drives switching, large loads cycling — originate downstream of it and are never touched. Sensitive equipment at the far end of long feeders also sees a higher let-through voltage because of the impedance between the SPD and the load. The engineered answer is layered: service entrance, distribution panels, and point-of-use, each sized and located for what it is protecting.

Ready to discuss your engineering scope?

Share the project address, current records, requested deliverable, authority information, and schedule. Apex Grid confirms professional responsibility, availability, and scope before work begins.

Request a Project Review

Get a quote on your project

Reviewed and sealed by licensed PEs. “Solid engineering and clear communication from start to finish.” — Jason Mitchell, Principal Architect

Tell us what you need and where the project is — quotes back within 12–24 hours on qualifying scopes.