American acquisition of DigiD approved
The Authority for Consumers and Markets (ACM) approved last week the proposed acquisition of Solvinity by the American tech group Kyndryl, as the regulator found that there are no immediate competition issues arising from the transaction. This seems to mark an important step towards finalizing the deal. Solvinity provides hosting and cloud infrastructure for DigiD, the central digital login system of the Dutch government used by millions of citizens each month.
ACM spokespersons emphasize that their assessment is purely focused on competition, and not on national security or digital autonomy. According to the independent regulator, there will still be sufficient alternatives for public consumers of IT services after the acquisition. This does not directly mean that the acquisition of DigiD will go ahead, as the approval is shared with the Investment Assessment Bureau (BTI), which is investigating whether the acquisition could pose risks to national security and the continuity of critical systems.
Experts point out that the management of DigiD by an American firm could mean that Dutch personal data is exposed to American legislation and could potentially be monitored by the American government. Since this involves tax matters, healthcare data, and pension information, many believe this is undesirable.
Tax Authority outsources VAT system
At the same time, it was also revealed that the Tax Authority is outsourcing the VAT processing system to the American software company FAST Enterprises.
What initially seemed to be a contract for software delivery now includes full execution, maintenance, and management of the VAT system by the American supplier, with remote management. Critics warn that this could lead to significant dependence on foreign technology and undermine the digital autonomy of the Dutch government, especially in conjunction with the acquisition of DigiD.
GroenLinks-PvdA MP Barbara Kathmann even called the plan 'inconceivable' in the media and warned that with this approach, the Netherlands is placing a financially critical infrastructure in the hands of a foreign party. Tech analysts have outlined that the connections between the new VAT system and other tax and state applications also have overlaps, which could increase the risks.
What now?
Whether the acquisition of DigiD will go ahead and whether the VAT processing system will return to Dutch hands is still uncertain. As an IT decision-maker, there are already several things you can do. Digital dependence is, after all, not exclusively a government problem.
1. Reassess your cloud and sourcing strategy
Organizations should take a good look at their cloud architecture:
- Where is critical data physically stored?
- Under which jurisdiction do suppliers fall?
- Is there multi-cloud or single-vendor dependence?
An explicit risk analysis regarding geopolitical dependence is now part of mature IT governance.
2. Prevent unintended vendor lock-in
Contractual flexibility and technical portability are becoming more important than ever. Pay attention to:
- Open standards and interoperability
- Exit scenarios in contracts
- Data export options
- Transparency in management and access
Without an exit strategy, digital autonomy is primarily a paper ambition.
3. Integrate legal assessment into IT decision-making
IT architecture is no longer just a technical discipline. Legal and compliance aspects are playing an increasingly larger role. Therefore, consider:
- Impact analysis regarding foreign legislation (such as the CLOUD Act)
- Data residency policy
- European alternatives or sovereign cloud solutions
Collaboration between IT, legal, and risk management is becoming structurally necessary.
4. Think in scenarios, not assumptions
The past few years have shown that geopolitical stability is not a given. Scenario planning therefore belongs in strategic IT planning:
- What happens in the event of sanctions?
- What if access to certain infrastructure is restricted?
- How quickly can migration take place?
Digital infrastructure is now as strategic as energy or telecom.
Towards strategic control
The acquisition of DigiD and the outsourcing of the VAT system illustrate how IT decisions increasingly have political and geopolitical implications.
For IT professionals and CIOs, this means that sourcing choices are no longer solely about costs, performance, and scalability. Strategic control, legal autonomy, and exit options are becoming equally important.
