Imagine that you have worked with the same supplier for years for your cloud environment, email, document management and meeting platform. One day, that supplier decides to significantly increase its prices. Or a situation arises — a takeover or a geopolitical conflict, for example — that suddenly puts the continuity of your systems at risk. You decide to switch providers. And then you discover that, in practice, you cannot. Not really. Your data is locked into proprietary formats, your employees are unfamiliar with any alternative, and the exit costs are astronomical. This is vendor lock-in. And it is not a theoretical risk: it is the daily reality for virtually every organisation that relies on major technology providers.
Vendor lock-in is rarely the result of a single deliberate decision. It develops over time. An organisation switches to an all-in-one package from a major supplier — covering office software, storage, communications, video conferencing and security — because it is convenient and appears cost-effective. At present, European alternatives often cannot offer an integrated package of comparable scope. Over time, all internal processes become tailored to that package. The IT department knows the system inside out, but has largely lost the technical expertise needed to build or assess alternatives independently. Data is stored in closed formats that other software cannot readily read. Employees are trained to work in a single environment. When the time comes to renew the contract, the organisation has very little negotiating leverage.
A recent case illustrates just how vulnerable this position can be. In November 2025, it emerged that US IT company Kyndryl intended to acquire Dutch company Solvinity, which manages, among other things, the Picard digital platform used by government services such as DigiD. The Dutch State was suddenly faced with an urgent dilemma. The acquisition would bring Solvinity within the scope of US surveillance legislation, including the CLOUD Act and FISA. However, switching to an alternative was not a matter of weeks or months: the systems involved form part of critical infrastructure that cannot simply be replaced.
The General Government Terms and Conditions for IT Contracts 2022 (Algemene Rijksvoorwaarden bij IT-overeenkomsten 2022, or ARBIT-2022) are the standard terms and conditions used by the Dutch central government for IT procurement. They contain several provisions relevant to limiting vendor lock-in, but they were not designed as an instrument for safeguarding digital autonomy. The most recent version dates from 2022 and has not been amended since, despite the significant changes in the geopolitical landscape.
The exit and transition arrangements in Article 32 of the ARBIT-2022 provide a starting point. Upon termination of the agreement, the supplier is required to do “whatever is reasonably necessary” to enable a successor — or the contracting authority itself — to take over the services without impediment. At the end of the agreement, data must be returned or deleted, at the contracting authority’s discretion.
The change-of-control provision in Article 30.3 provides a right to terminate the agreement in the event of a material change in control of the supplier — precisely the situation that arose in connection with the proposed Solvinity/Kyndryl acquisition.
Data portability in usable formats. The ARBIT-2022 requires suppliers to return data, but does not specify the format in which it must be provided. An export function that technically exists but produces files that are practically unusable in another system offers no meaningful protection.
Interoperability and open standards as contractual obligations. The ARBIT-2022 contains no explicit requirement to use open standards or guarantee interoperability with third-party systems. Despite the Dutch central government’s “comply or explain” policy on open standards, such requirements are not requested in half of all public procurement procedures.
A realistic transition budget and timeframe. The ARBIT-2022 requires suppliers to cooperate with the transition, but the associated costs are borne by the supplier only where the transition results from an attributable failure to perform. In all other cases, the contracting authority pays the supplier’s standard rates. For complex migrations, these costs can reach levels that effectively make switching providers impossible.
Protection against the terms imposed by major vendors. The Solvinity case concerns a direct customer relationship, but the situation is different when procuring standard software from suppliers such as Microsoft, Oracle and SAP. Government-wide software procurement procedures in 2024 and 2025 demonstrate how difficult it is to ensure that the ARBIT-2022 actually takes precedence over the terms imposed by major vendors. The preliminary relief judge in The Hague ruled that the State’s sublicensing model — under which resellers were required to accept the ARBIT-2022 while the vendors continued to apply their own terms — was disproportionate, provided that the State could not demonstrate that vendors were willing to contract under this model. In practice, most major vendors refuse to do so.
The proposed acquisition of Solvinity by US company Kyndryl, a subsidiary of Kyndryl International LLC, represents the first concrete stress test of the ARBIT-2022 in the context of digital sovereignty.
The State Advocate has established that, following an acquisition by Kyndryl, Solvinity would fall within the scope of US legislation with extraterritorial effect. Nevertheless, terminating the agreement is not straightforward. Citizens who sought, in summary proceedings, to compel the State to terminate the agreement under Article 30.3 of the ARBIT were unsuccessful. The preliminary relief judge held that the right to terminate the agreement probably existed, but that the ARBIT provided only for termination with immediate effect, not for a gradual transition. A managed migration therefore requires the supplier’s consent.
This illustrates the precise gap in the framework: the ARBIT provides an emergency stop button, but no controlled transition pathway. For critical IT infrastructure, an emergency stop button without a transition plan is not a viable alternative.
Whether you use the ARBIT as a public-sector organisation or draw up your own terms and conditions as a private enterprise, a number of contractual safeguards are essential to keeping vendor lock-in manageable.
Data portability in open formats. Stipulate that, upon termination of the contract, all data must be made available in an open, machine-readable and standardised format. Also specify the deadline for doing so, including the provision of metadata and configuration data.
Interoperability as an obligation. Require systems to comply with open standards — for public-sector organisations in the Netherlands, this means the standards listed by the Forum Standaardisatie — and prohibit the supplier from obstructing connections with third-party systems.
A transition clause with a phased process. Do not merely require the supplier to cooperate with a transition. Specify a reasonable transition period, such as six to twelve months, an obligation to actively transfer knowledge to a successor, and a cap on transition costs.
Restrictions on unilateral variation rights. Limit the supplier’s ability to change functionality, prices or terms unilaterally, or provide that material changes entitle you to terminate the agreement without penalty.
Change of control with a right to transition. The ARBIT-2022 provides for termination in the event of a change of control, but does not grant a right to continue receiving services temporarily while the transition takes place. Consider expressly stipulating in the contract that, following a change of control, the supplier must continue providing the services for a specified period on the existing terms, regardless of whether the agreement has formally been terminated. The Solvinity case demonstrates that this cannot be taken for granted.
Supply chain transparency. Require the supplier to inform you of its subprocessors and subcontractors, and stipulate that your consent is required before any changes are made to these arrangements.
Price stability. Limit price increases during the contract term or link them to an objective index.
No new versions of the ARBIT have been published or announced to date. The ARBIT-2022 remains the version in force. However, developments are under way. Through an initiative led by the Government Chief Information Officer (CIO Rijk), the State Secretary for the Interior and Kingdom Relations has announced work on government-wide policies for incorporating autonomy requirements into public procurement. The ICT Service Continuity Task Force (Taskforce Continuïteit ICT Dienstverlening) is working on measures to mitigate risks. In addition, the ongoing evaluation of the European public procurement directives may, in due course, create scope for embedding strategic autonomy objectives as award criteria.
In practice, however, major vendors have shown little willingness to contract on the basis of Dutch government terms and conditions. This means that strengthening the ARBIT alone will not be sufficient. A broader market strategy is also needed to increase customers’ negotiating power.
Contractual protection against vendor lock-in begins not when a contract is terminated, but when it is signed. Every organisation should ask itself the following question before entering into an IT contract: if we decided to switch providers tomorrow — because of a price increase, an acquisition or a geopolitical incident — what would it cost us in terms of time, money and data? If the answer is unclear, the exit strategy is incomplete.
The Solvinity case brings into focus what until now may have seemed abstract: a Dutch supplier is acquired by a US company, potentially bringing government systems such as DigiD within the reach of US intelligence legislation. The ARBIT provides a termination mechanism, but no controlled alternative. This is precisely the gap that future autonomy requirements will need to address. Until such requirements are in place, however, contracting authorities must ensure that these protections are incorporated into their contracts themselves.
Would you like to know how best to protect your organisation against vendor lock-in? Please feel free to contact one of our specialists in our IT, Privacy & Cybersecurity team.
Would you like to receive a monthly overview of our latest legal updates and blog articles? Subscribe to our newsletter.
