In our previous blog post, we discussed vendor lock-in and contractual safeguards. However, contractual protections only work if you still have freedom of choice when signing the agreement. That freedom begins with the procurement process: the point at which a public contracting authority decides what to purchase and from whom. The question, then, is whether procurement law allows digital sovereignty to be taken into account when awarding IT contracts. The answer is yes - and there is more scope to do so than many contracting authorities realise.
The Dutch Public Procurement Act 2012 (Aanbestedingswet 2012) provides that public contracts must, in principle, be awarded on the basis of the most economically advantageous tender, determined by reference to the best price-quality ratio. The contracting authority decides which qualitative criteria to apply. These criteria must relate to the subject matter of the contract and may concern, among other things, “social, environmental and innovative characteristics” and “conditions of delivery”.
Crucially, this connection may be interpreted broadly: criteria are considered to relate to the subject matter of the contract if they concern the services to be provided “in all respects and at any stage of their life cycle”. This means that, when awarding an IT contract, a contracting authority may take into account how the service performs at the end of its life cycle. Consider the exit process: how easily can the customer switch providers, in what format will its data be returned, and what costs will arise upon termination?
Procurement law provides a specific instrument for looking beyond the initial purchase price: life-cycle costing. Section 2.115a of the Dutch Public Procurement Act 2012 expressly permits contracting authorities to take into account not only acquisition costs, but also “costs arising at the end of the life cycle”.
This provides a direct basis for taking exit and migration costs into account. A supplier that relies on proprietary formats and creates significant barriers to data migration will, in practice, have higher life-cycle costs than a supplier that uses open standards and offers a straightforward exit process. Such costs may be included in the award assessment, provided that the procurement documents specify which information tenderers must supply and which methodology will be used to calculate life-cycle costs.
In addition to award criteria, contracting authorities can impose requirements through technical specifications: the prescribed characteristics that the product or service to be supplied must meet. Section 2.75 of the Dutch Public Procurement Act 2012 provides that these characteristics must relate to the subject matter of the contract and be proportionate to its value and objectives.
Contracting authorities may formulate technical specifications by referring to standards — including open standards listed by the Dutch Standardisation Forum (Forum Standaardisatie) — or by setting performance-based and functional requirements. A requirement such as “the proposed service supports full data export in format [X]” or “the system communicates using open standards included on the Dutch Standardisation Forum’s list” constitutes a functional requirement directly related to the subject matter of the IT contract.
The legal framework nevertheless requires technical specifications to provide tenderers with equal access and to avoid unjustified obstacles to competition. Paradoxically, this can work in favour of digital sovereignty requirements: requiring the use of open standards promotes competition because more suppliers may be able to meet the requirement than if a closed standard were prescribed.
Proportionality is the guiding principle of procurement law. Section 1.10 of the Dutch Public Procurement Act 2012 provides that requirements, conditions and criteria must be reasonably proportionate to the subject matter of the contract. This applies at every level: selection criteria, award criteria and contractual conditions.
The Dutch Proportionality Guide (Gids Proportionaliteit), which serves as a statutory guideline and may be departed from with appropriate justification, provides further guidance on this principle. In practice, an autonomy requirement must be justified by reference to the interests served by the contract itself, such as service continuity, the protection of personal data and the independence of critical processes.
Recent case law illustrates how this assessment works. In early 2025, a court in ’s-Hertogenbosch ruled that a contracting authority is not required to maximise competition, but must not restrict competition unnecessarily. The same court also held that a specific technical requirement that could instead have been expressed in functional terms may be disproportionate if the contracting authority cannot explain why the specific technical description is necessary.
The lesson is clear: formulate digital autonomy requirements in functional terms — what must the system be able to do? — rather than as specific technical prescriptions that only one supplier can satisfy.
The legal framework allows considerable flexibility, but the practical reality is more challenging. Government-wide software procurements in 2024 and 2025 illustrate how difficult it can be to ensure that public-sector contractual terms — including the Dutch Government Model Agreement for IT (ARBIT-2022) — prevail when procuring standard software from major vendors.
The Dutch State sought to require resellers to supply standard software to government entities under ARBIT-2022 through a sublicensing model. In late 2025, the preliminary relief judge in The Hague ruled that this requirement was disproportionate because a substantial proportion of vendors were unwilling to contract under that model and resellers lacked sufficient bargaining power to compel them to do so.
Specifically, resellers submitted dozens of statements from vendors showing that those vendors made their software available exclusively under their own terms of use. The State had not substantiated its proposed model with market research demonstrating that vendors were willing to cooperate. Such substantiation is essential: imposing requirements that cannot realistically be met may constitute disproportionate conduct.
This illustrates the central tension. Public authorities may impose requirements relating to interoperability, data portability and open standards, but they must be able to demonstrate that more than one supplier can meet those requirements. If a requirement effectively excludes all dominant suppliers without there being a realistic alternative offering, the proportionality assessment becomes critical.
Based on the legal framework and recent case law, contracting authorities wishing to take digital sovereignty into account have four practical options:
As an award criterion (Section 2.115 of the Dutch Public Procurement Act 2012). Include “degree of supplier independence” as a qualitative sub-criterion, assessed using a weighted score. Define measurable indicators, such as whether the solution supports data export in open formats, is based on open standards, allows migration without the supplier’s cooperation, and how long a transition would take. The link to the subject matter of the contract is clear: these factors concern the conditions under which the service operates throughout its life cycle.
As part of life-cycle costing (Section 2.115a of the Dutch Public Procurement Act 2012). Explicitly ask tenderers to state their estimated exit and migration costs as part of the total cost of ownership. Compare tenders not only on purchase price and licence fees, but also on the cost of switching providers after five years. This makes the financial consequences of vendor lock-in visible and allows suppliers offering open formats and lower switching costs to be assessed accordingly.
As a technical specification (Sections 2.75 and 2.76 of the Dutch Public Procurement Act 2012). Formulate functional requirements for interoperability and data portability. For example: “The proposed solution must export all data in a machine-readable, standardised format that third parties can process without a licence.” Where possible, refer to open standards listed by the Dutch Standardisation Forum. Frame the requirement in functional terms rather than by reference to a specific product or protocol, thereby reducing the risk of failing the proportionality test.
As a contractual condition. Include an exit clause in the ARBIT-2022 agreement or in supplementary special conditions, requiring the supplier to actively cooperate with the transition and specifying a maximum transition period and a cap on transition costs. Require transparency regarding subprocessors and the supply chain.
The Solvinity/Kyndryl case illustrates why this approach matters. Although ARBIT-2022 contains a change-of-control provision allowing the State to terminate the agreement in the event of a significant change in control, the preliminary relief judge ruled that this provision provides only for immediate termination, not for a gradual, controlled transition.
Had the procurement process already required the supplier to submit an operational exit plan with a phased transition roadmap as part of its tender, the State would have had a contractually enforceable way out in such circumstances.
This is precisely where the combination of award criteria, technical specifications and contractual conditions adds value: together, they establish a framework of safeguards at the time the contract is concluded, rather than waiting until a crisis occurs.
Procurement law provides sufficient scope to take digital sovereignty seriously. The law permits it, case law confirms that functional interoperability and data portability requirements can be proportionate, and the concept of life-cycle costing offers an objective method of accounting for vendor lock-in.
What is missing is not the legal scope to act, but the routine application of these possibilities.
Would you like to know how to incorporate digital sovereignty into your procurement process? Please contact Natascha van Duuren, Partner and Attorney-at-Law specialising in IT, Privacy & Cybersecurity.
Would you like to receive a monthly overview of our latest legal updates and blog articles? Sign up for our newsletter.
