Is lightning protection required by code in the United States?
In the United States, lightning protection is required by code only when an adopted code, the authority having jurisdiction (AHJ), an insurer, a contract or the owner's policy calls for it. Neither the 2024 International Building Code nor the 2026 National Electrical Code requires it on every building, and NFPA 780-2026 sets how a system is installed, not which buildings need one.
NFPA 780 is a standard, not a law. It sets how a lightning protection system must be installed once someone has decided to install one, and it binds a project only when a code, the AHJ, an insurer or a contract points to it.
The building codes work the same way. The 2024 International Building Code (IBC) regulates lightning protection systems where they are provided, and the National Electrical Code (NEC) regulates how they connect to the electrical installation. Neither one decides which buildings need a system. That decision comes from the AHJ, an insurer, a client or the owner, and it should rest on a written risk assessment.
This guide covers the United States and is written against NFPA 780-2026, the 2024 IBC and NFPA 70-2026. Outside the US, see lightning protection standards in Australia or what IEC 62305 is.
Four ways lightning protection becomes mandatory
A requirement always comes from outside NFPA 780. These are the routes it takes in practice.
A code your jurisdiction adopted
A state or local code, or a local amendment, can require protection for certain occupancies. The authority having jurisdiction (AHJ) enforces it and can apply NFPA 780-2026 to an existing building it judges too risky (Section 1.4.2).
Criteria of a federal agency
A federal owner can set its own design criteria. The Department of Defense does this in UFC 3-575-01 (31 July 2026), which requires protection for explosives facilities and critical communication facilities.
A condition of insurance cover
An insurer can make protection, or a documented assessment, a condition of a policy. NFPA 780-2026 Section L.1.1.1 recommends that insurance requirements take precedence over a risk assessment result.
A client specification or owner policy
A project specification, a lease, or a corporate engineering standard can require an NFPA 780 system. That obligation is contractual, and it binds the parties who signed up to it.
What NFPA 780 says about its own application
Chapter 1 of NFPA 780-2026 tells you what the standard covers, not which buildings must be protected. Section 1.1.1 lists what it addresses, from ordinary structures and heavy-duty stacks to special occupancies, buildings holding flammable vapors or explosives, wind turbines, solar arrays, watercraft and the circuits that feed airfield lighting. Section 1.2 states the purpose as protecting people and property from lightning. Neither clause says that any of those structures must have a system.
What Chapter 1 does do is hand real authority to the AHJ. Under Section 1.4.1, the standard does not reach buildings that existed or were approved before the edition took effect, unless it says so. Section 1.4.2 lets the AHJ apply parts of it retroactively where an existing situation carries unacceptable risk. Section 1.5.2 requires the people who install the system to be certified by the AHJ as fit to apply the standard, and explanatory note A.1.5.2 says that check could look at their installation experience and credentials. Section 1.5.3 lets the AHJ require an on-site inspection by a qualified, impartial organization, and Section 1.7 sets inspection or testing annually or at an interval the AHJ picks.
The standard also defines the AHJ broadly (Section 3.2.2): any organization, office or individual that enforces a code or approves an installation. Explanatory note A.3.2.2 widens the picture: a building official, fire marshal or electrical inspector, an insurer's inspection department, the owner or the owner's agent, or a commanding officer on a government installation. Explanatory note A.3.2.1 adds that NFPA itself approves, inspects and certifies nothing. For a tour of the rest of the standard, see NFPA 780 explained chapter by chapter.
Why the Annex L risk assessment is guidance, not a rule
Annex L of NFPA 780-2026 opens with a statement that it is not part of the standard's requirements and is included for information only. That status matters. An NFPA 780 system installed without an Annex L assessment is not out of compliance with the standard, and an assessment that says protection is optional does not, by itself, release anyone from a requirement.
The annex is explicit about this. Section L.1 describes the method as a tool to help the owner, safety professional or architect and engineer judge the risk, and says it does not override any rule the AHJ enforces, whether federal, state or local. Section L.1.1.1 goes further: rules from statute, regulation and insurance should win over the result of a risk assessment. Section L.1.1.2 adds that where a system is required, it should be installed to the standard. That reading of Annex L is ours. The AHJ's reading of your adopted code governs.
Section L.1.1 also names cases where protection deserves serious thought whatever the numbers show: large crowds, continuity of critical services, high flash frequency, tall isolated structures, buildings with explosive or flammable materials, and irreplaceable cultural heritage. For the method itself, read the NFPA 780 Annex L risk assessment guide.
What the IBC says about lightning protection
The 2024 International Building Code, Chapter 27 contains Section 2703, Lightning Protection Systems. Its scope clause, Section 2703.1, applies the section to systems where they are provided. It does not list buildings that must have one.
When a system is provided, the section sets three rules. Section 2703.2 requires installation to NFPA 780 or UL 96A, and bars UL 96A for buildings that produce, handle or store ammunition, explosives, flammable liquids or gases, or other explosive ingredients including dust. Section 2703.2.1 requires surge protective devices under NFPA 70 together with NFPA 780 or UL 96A. Section 2703.3 requires every lightning protection system on one building to be interconnected.
Chapter 15 ties the roof to the same rules. Section 1511.7.6 of the 2024 IBC sends rooftop components to Section 2703, with added rules for mounting on tested metal edge systems, gutters and roof coverings (1511.7.6.1 and 1511.7.6.2).
Two cautions follow. First, the section is recent: the 2021 IBC Chapter 27 has only Sections 2701 and 2702, with no lightning protection section. Second, the IBC is a model code. It has force only where a state or city adopts it, and many jurisdictions adopt an edition years later, often with amendments. The official ICC copy of the Florida Building Code, Building, eighth edition (2023), for example, is based on the 2021 IBC, and its Chapter 27 has no Section 2703. Always check which edition your jurisdiction enforces before citing a section number.
Does the NEC require lightning protection?
No. The 2026 National Electrical Code has no article that requires a lightning protection system on any building. Its scope (Section 90.2) covers electrical, signaling and communications conductors and equipment. Where a lightning protection system exists, though, the NEC controls how it meets the electrical installation, and several of those rules are mandatory.
- Section 250.106 requires the lightning protection system's ground terminals to be bonded to the building's grounding electrode system. The same rule appears in 270.106 for systems above 1000 volts ac or 1500 volts dc.
- Section 250.60 forbids using the electrodes that ground strike termination devices in place of the grounding electrodes Section 250.50 requires for wiring and equipment.
- Section 800.53 requires at least 1.8 m (6 ft) between lightning protection conductors and communications wiring on buildings, where practicable.
- Section 620.37(B) allows elevator rails to be bonded to a down conductor, but keeps the down conductor out of the hoistway and forbids using hoistway equipment as one.
Two NEC rules are often mistaken for a lightning protection mandate. Section 230.67 requires a Type 1 or Type 2 surge protective device (SPD) at services supplying dwelling units, dormitories, hotel guest rooms and similar sleeping areas. That is surge protection for the wiring, not a system of air terminals, conductors and grounding. Section 675.15 requires a grounding electrode system at the stationary point of an irrigation machine, which is again grounding rather than a strike termination system.
The many references to NFPA 780 across the NEC sit in informational notes. Section 90.5(C) states that such notes explain and point to other documents but cannot be enforced as NEC requirements.
The NEC is a model code too. Section 90.4(A) says it is written for governments to adopt and enforce, so it carries legal force only where a state or city has adopted it. The section numbers here are from the 2026 edition, so check which NEC edition your jurisdiction enforces before citing one. For how the two documents fit together on the ground, see NFPA 780 grounding and bonding and surge protection under NFPA 780.
When a federal owner sets the rule: UFC 3-575-01
Federal owners can write their own criteria, and the clearest published example is the Department of Defense. UFC 3-575-01, Lightning and Static Electricity Protection Systems sets the policy for defense facilities. The current edition, dated 31 July 2026, is published as digital criteria on the Whole Building Design Guide. The 2012 edition and its Change 1 are now archived, so check which one a contract names before you rely on a paragraph number.
Paragraph 3-1.1 of the 2026 edition requires a lightning protection system on any facility that holds explosives and on critical communication facilities. For ordinary structures and facilities it calls for the simplified risk assessment of NFPA 780 Annex L, and it points to L.1.1 for cases that deserve protection whatever the result. Paragraph 3-1.2 requires the finished system to be certified as meeting NFPA 780 by a commercial third-party inspector whose only business is lightning protection, and who neither designed nor installed it. Paragraph 3-1.4 adds rules for ammunition and explosives facilities.
The UFC lists NFPA 780 among its key standards (paragraph 1-2) without naming an edition, so confirm with the contracting office which edition the project uses. The UFC applies to Department of Defense work, and WBDG points to UFC 1-200-01 for which projects it covers. Other agencies set their own criteria.
Who can require lightning protection, and what each one requires
The first four rows are the four routes above, and only they can compel a system. The rest govern how a system is built.
| Source | What it requires | Where to check |
|---|---|---|
| 1. Adopted code and the AHJ | Whatever the adopted code or local amendment requires. The AHJ can also apply NFPA 780 to an existing building, require third-party certification and set inspection intervals | Your jurisdiction's adopted codes; NFPA 780-2026 Sections 1.4.2, 1.5.3, 1.7 |
| 2. Federal owner (Department of Defense) | Protection for explosives and critical communication facilities; Annex L simplified assessment for ordinary structures; third-party certification | UFC 3-575-01 (31 July 2026) paragraphs 3-1.1, 3-1.2 |
| 3. Insurer | Whatever the policy states, such as a system, a certified installation or a documented assessment | The policy wording; NFPA 780-2026 L.1.1.1 on precedence |
| 4. Client or owner | Whatever the specification, lease or corporate engineering standard states | The contract or the owner's standard |
| 2024 International Building Code | No building list. Where a system is provided: NFPA 780 or UL 96A, SPDs, interconnection | IBC 2024 Sections 2703.1 to 2703.3, 1511.7.6 |
| NFPA 70 (NEC), 2026 | No system required. Bonding, electrode use and separation where a system exists; SPDs at dwelling-type services | Sections 250.106, 250.60, 800.53, 230.67 |
| NFPA 780-2026 body chapters | How to install, once the standard applies | Section 1.1.1 (scope) |
| NFPA 780-2026 Annex L | Nothing on its own. Informative guidance on whether protection is warranted | Annex L heading, L.1, L.1.1.1 |
Local amendments can add requirements that no model code carries. The only reliable way to know is to ask the building department or fire marshal which codes, editions and amendments they enforce, and to get the answer in writing.
Insurance, specifications and owner policies
Private obligations are often stricter than public ones. An insurer can require a lightning protection system, a certified installation or a documented assessment as a condition of cover for a particular property. A client's specification can name NFPA 780 as the design basis, and a corporate engineering standard can apply it to every site a company owns.
None of these are codes, so none appear in a code search. They live in policy wording, tender documents and internal standards. NFPA 780-2026 Section L.1.1.1 is the useful anchor here: the annex recommends that an insurance or regulatory requirement should take precedence over what a risk assessment concludes. If the policy says protect, an Annex L result of optional does not change that, because the policy is the binding document and the annex is guidance.
How an Annex L assessment shows protection is or is not needed
Where nothing compels protection, someone still has to decide, and the decision should be written down. Annex L of NFPA 780-2026 is the documented method the standard offers. Its quick screen (Section L.5.2.1) compares the expected yearly strikes to the structure, N_D, with a tolerable frequency, N_C. When N_D does not exceed N_C, a system can be optional. When N_D is higher, a system is recommended.
Two clauses stop the screen from being the last word. Section L.5.3.1 lists critical facilities, including emergency operations centers, fire and police stations, hospitals, schools, government buildings, energy and telecommunications facilities, and transport hubs. Section L.5.3.2 says these should either be protected or carried through the detailed assessment of Section L.6, which computes R1 to R4 separately. The tolerable values for those risks may be set by the owner or the AHJ, with Table L.6.2 supplying defaults (Section L.6.2).
One body clause gives a risk assessment formal weight. Section 8.1.1 exempts some structures housing explosives from Chapter 8, including those where a risk assessment justifies leaving them out, and A.8.1 describes when an AHJ might omit protection, with Annex L named as the guide. For how Lumex runs both levels, see NFPA 780-2026 risk assessment in Lumex.
Common mistakes about code-required lightning protection
These are the misreadings that lead to an unprotected building nobody meant to leave exposed, or a system nobody needed.
Reading 2703 as a mandate
Section 2703 of the 2024 IBC applies where a system is provided. It regulates the system, not the decision to install one.
Treating a service SPD as protection
The SPD that NEC Section 230.67 requires at a dwelling service limits surges. It does nothing for a direct strike to the roof.
Using optional as a release
An Annex L result of optional does not release you from a code, insurer or contract. The annex itself, in Section L.1.1.1, recommends that those take precedence.
Citing the wrong code edition
A section in the 2024 IBC may not exist in the edition your jurisdiction enforces. The 2021 IBC has no Section 2703.
Skipping the screen on critical facilities
Hospitals, schools and fire stations should be protected or carried through the detailed assessment (L.5.3.2), not settled on the screen alone.
Deciding without a record
A verbal no from the AHJ disappears when staff change. Get the decision in writing and file it with the risk assessment behind it.
Once a system is installed to NFPA 780-2026, keep it inspected: Section 1.7 sets an annual cycle unless the AHJ picks another. The NFPA 780 inspection checklist covers what gets checked.
A defensible record for the protect or do not protect decision
Lumex runs the NFPA 780-2026 Annex L risk assessment: the quick screen and, where it matters, the detailed assessment of R1 to R4, each against its own tolerable value. Voltrace, the engine behind it, shows the working behind every figure with the clause it came from, and the result becomes a signed-off report you can hand to the AHJ, an insurer or a client.
Lumex does not tell you which codes your jurisdiction has adopted, and it does not design the protection system or certify a structure. It gives you the documented risk decision those parties ask for, with a review-due date and a reminder so the assessment does not go stale. Start with the quick screen for your building in Lumex's NFPA 780 risk assessment. NFPA 780 itself must be bought from NFPA for design and certification work; Lumex is independent of NFPA.
Related reading: which lightning standard applies to your project, what NFPA 780-2026 covers, the Annex L method section by section, what changed in NFPA 780-2026, protection for flammable liquid tanks and explosives and NFPA 780 compared with IEC 62305.
Questions answered
Is NFPA 780 mandatory?
Is lightning protection required by code?
Does the NEC require lightning protection?
Who decides whether a building needs lightning protection?
Does insurance require lightning protection?
Is the NFPA 780 Annex L risk assessment mandatory?
Does an existing building have to be upgraded to NFPA 780-2026?
Lumex computes the method of the standard you choose, IEC 62305-2:2024, AS 1768:2021 or NFPA 780-2026, and shows the working. It does not certify a structure. You may not issue or submit a Lumex output until a competent person, qualified where the structure is located, has reviewed the inputs and the result and signed it.
NFPA 780-2026 Annex L gives default tolerable values of 1E-5 per year for loss of life or injury and 1E-3 for loss of service and of historical significance, and the owner or the authority having jurisdiction may set others. Every NFPA 780 assessment in Lumex states the values that applied.
Get started today