The Netherlands will only let a European company near DigiD — after blocking a US buyer

A veto becomes a procurement rule

Days after the Dutch government blocked a US company from acquiring DigiD's infrastructure supplier, it turned that one-off veto into standing policy. State Secretary Eric van der Burg of the Interior told parliament that the next company to operate part of DigiD — the digital identity system Dutch citizens use to log into tax, healthcare, and benefits services — must be European.

What actually happened: Kyndryl, Solvinity, and a national-security screen

The trigger was concrete. DigiD is managed by Logius (an agency under the Interior Ministry) and hosted in a government data centre, but the underlying platform is supplied by Solvinity, a Dutch IT firm. When Kyndryl — the US infrastructure-services company spun out of IBM — moved to acquire Solvinity, the Dutch Investment Screening Bureau advised an outright prohibition, and on 25 May 2026 the government blocked the deal on national-security grounds.

The European-only requirement is the forward-looking half of that decision. Solvinity's current contract runs to 6 August 2028; the new rule bites at the next tender. "We will now look at which tender requirements we are going to set," van der Burg said. The reasoning is digital sovereignty in its plainest form: a foreign-controlled vendor sitting under a country's identity layer is a single point of geopolitical failure, and US extraterritorial law (the CLOUD Act) makes 'European-operated' a hedge against data being reachable from Washington.

The thread: 'why is this a product at all?'

The most-upvoted reaction in the thread wasn't about the veto — it was disbelief that the national login is outsourced to begin with.

"As a French person, I'm confused as to why DigiD is not a government-run project like FranceConnect is. I'm even more bewildered that an American company thought that they could take over the national identity management system of an European country, as if this was business as usual." — a French developer comparing it to FranceConnect

A second voice extended the same logic — if it's critical public infrastructure, why not just fund it directly?

"What's wrong with the government taking over admin of DigiD? … It's a public infrastructure service at this point." — a commenter arguing for direct state ownership

Then the cynics, who note 'European' is a thinner guarantee than it sounds. One pointed out that 'European' isn't the same as 'trustworthy':

"Why not just dutch company? There are European countries that are obviously pro-russia..." — a commenter on the limits of the European label

And the sharpest deflation — the rule governs the operator, not necessarily where the bytes live:

"Plot twist: the data will still be stored outside of the EU - the magic of cloud computing. :D" — a skeptic on cloud-jurisdiction loopholes

Another flagged the next front already opening: "now they want NL Wallet to use Google and Apple accounts for login, so this is happening again," warned an F/OSS and IT consultant.

Sovereignty as a procurement clause

The interesting move here isn't the veto — governments block sensitive acquisitions routinely. It's that the Netherlands converted a national-security screen into a standing tender requirement, pre-committing the next contract before it's even written. That's a template other EU states can copy without inventing new law: don't nationalise the system, just narrow the bidder pool. The open question the thread keeps circling is whether 'European operator' actually closes the data-jurisdiction gap, or just relocates the logo on the contract.