The Dutch government writes digital independence into its contracts
The Dutch government spends around €20 billion a year on purchasing. Its new procurement vision of 16 October wants that spending to make it more digitally independent and secure.
What happened
The Dutch government wants to use its purchasing of around €20 billion a year to become more digitally independent and secure. That is the message of the new vision on central government procurement that the cabinet adopted on 16 October.
The government buys from some 25,000 companies. The new vision runs for five years and covers all ministries and government agencies; Defence joins in where it can. It builds on a strategy from 2019. Through its purchasing, the government wants to support the economy and innovation, improve security and buy more efficiently with fewer rules. Security here means digital independence, ICT services that keep running and access to critical raw materials. This is needed, the cabinet writes, because the government depends on certain countries and multinationals.
In practice the cabinet wants to anchor security and digital autonomy more firmly in contracts, map risks before a contract is signed and keep tracking them throughout delivery. The government also wants to be the first customer more often for innovative companies that strengthen Dutch and European digital autonomy. State Secretary Eric van der Burg says too many rules have built up over the years for buyers and for the companies that do business with the government.
The same day saw the publication of the national security risk analysis, which researchers from RIVM, TNO, Clingendael and the Dutch intelligence services, among others, produce every four years for the NCTV, the national security coordinator. It advises reducing risky dependencies and warns that putting off such choices harms national security. Two days earlier the cabinet had upheld its ban on the takeover of Solvinity by the American company Kyndryl. Solvinity hosts DigiD, the Dutch government login, and MijnOverheid, the government’s citizen portal, among other services.
Map the risks before a contract is signed, and keep track of them throughout delivery.
From the Dutch government’s procurement vision of 16 October 2026, in short
The background
What already applies
Part of the new course has already begun. Since 1 January 2026, the Dutch government’s General Security Requirements for Government Contracts (ABRO) apply to contracts where national security is at stake, for example because a company receives sensitive information. The National Bureau for Industrial Security then looks at the organisation and its management, the reliability of staff, and physical and digital security, cloud services included. A company that does not, or no longer, meets the requirements does not get the contract, or can see it stopped.
Ministries and the police are phasing the requirements in over 2026 and 2027. The cabinet wants municipalities, provinces, water boards and energy companies to join as well.
How dependent the Netherlands is
In January the Dutch broadcaster NOS examined 16,500 domain names of government bodies, healthcare providers, schools and vital companies. Of those, 67% were linked to at least one American cloud service, and 49% to Microsoft. MP Barbara Kathmann (GroenLinks-PvdA) said the country was in a stranglehold.
In July a group of Dutch regulators, including the competition authority, the financial markets authority, the data protection authority and the central bank, wrote that digital autonomy is not about complete independence but about freedom of choice. When buying IT, they ask for open standards, systems that work together and the ability to switch. Heavy dependence on non-European providers, they say, makes switching costly and complicated.
What happened with Solvinity
Solvinity started out as a Dutch company, is now British-owned and was set to be taken over by the American company Kyndryl. It stores the data DigiD runs on, and also hosts MijnOverheid and the secure messaging system of the Ministry of Justice and Security. Experts and MPs feared that American laws could let the US government block access to DigiD or request data in secret.
On 26 May State Secretary Willemijn Aerdts banned the takeover, on the advice of the Dutch investment screening bureau. Kyndryl said it was extremely disappointed. Solvinity objected, but on 14 October the cabinet upheld the ban. The DigiD contract runs until 2028; the cabinet wants the successor to be a Dutch or at least a European company.
Our analysis
Independence starts with being able to switch
The vision sounds ambitious, but the announcement contains no hard new requirements yet. It mentions no preference for European suppliers and no requirements on switching. What is already strict is the ABRO, and that only applies to contracts that touch national security. Suppliers to the government can expect more questions first, and more rules only later. How the vision will show up in tenders remains to be seen.
The Solvinity case shows why tracking risks during delivery matters. A supplier that started out Dutch is now British-owned and could have become American in the middle of a contract. A good choice at signing does not protect you against that. The regulators point to the ability to switch: open standards and systems that work together. We would add agreements on what happens when a supplier changes owner. That also works when a European supplier is taken over.
Our expectation: these questions will filter down to municipalities, healthcare providers and suppliers’ suppliers. If you can explain where your software runs, who owns the services you build on and how you would switch, you are in a strong position, as a supplier and as a customer.
What stands out
- An owner can change mid-contract Solvinity started out Dutch, is now British-owned and nearly became American, in the middle of its DigiD contract.
- The strictest rules already apply Since January the National Bureau for Industrial Security has been vetting suppliers of sensitive government contracts, down to their cloud services.
- The vision names no European preference yet The announcement of the vision mentions no preference for European suppliers. For now the vision mostly sets a direction.
- Two thirds rely on an American cloud Of 16,500 domain names of government bodies, healthcare, schools and vital companies, 67% were linked to at least one American cloud service.
What it means for you
Do you supply the Dutch government? Then expect more questions about security, and about how dependent the government becomes on you.
- Dependence becomes a buying question The government weighs digital autonomy and security, and tracks risks throughout delivery. Make sure you can explain where your software runs and what it depends on.
- Look at your own dependencies The risk analysis advises reducing risky dependencies. Ask yourself the same question: which supplier or service could you not easily replace?
- Software you can take with you If you hold the source code, the data and the documentation, you can switch when you need to. That makes any dependence a lot smaller.
Where we come in · Development
We build software you can take with you
We build custom software and integrations that are easy to hand over, so you’re not tied to us. And if you’d rather keep AI close to home, AI on a server of your own is worth a look.
Could you take your software with you if you had to?
Tell us where your software runs now and who has access. We’ll think it through with you and always reply within one working day.
