The Netherlands Tax and Customs Administration has scrapped its planned Microsoft 365 cloud migration in favor of services hosted on infrastructure it controls, alongside European open source alternatives. Email and calendars will shift to on-premises systems in 2027, with storage and collaboration services following later that year and in 2028. The reversal comes after the Dutch Advisory Council on ICT Assessment recommended halting the rollout, which had reached roughly 5,000 of the 47,500 employees across tax, customs, and benefits services by the time the pause was called in June.
State Secretary for Finance Eelco Eerenberg notified parliament this week that the administration will implement mail and calendar provision on-premises in 2027, then deploy European open source solutions for personal storage and collaboration functionalities later in 2027 and 2028. The tax authority originally selected Microsoft 365 in 2025, but the decision drew criticism. The advisory board found that the design of Microsoft 365 in the public cloud fell short on information security, information processing, and future-proofing. Specific concerns included routing confidential documents through American servers rather than government networks, reliance on standard Microsoft encryption instead of Double Key Encryption that would grant the administration greater control, and the lack of default end-to-end encryption for one-to-one Teams calls with no availability for group calls under the chosen configuration.
The board also flagged risks around vendor lock-in and diminished flexibility and sovereignty from selecting a single-supplier solution with one American cloud provider, according to the letter. Eerenberg stated that increased datacenter capacity has enabled the on-premises option, and the revised approach will reuse existing licenses where feasible to limit additional investment. The reversal creates complications for records management, however, as some planned capabilities in the Microsoft 365 package aren't available on-premises and the administration is still evaluating how to replace them.
The shift reflects broader European concerns about US authorities' ability to compel disclosure of data held by US providers under the CLOUD Act, which has prompted European governments to consider reducing dependence on American providers and transitioning to more sovereign solutions. Matthew Hodgson, CEO of Element, which provides a Teams alternative used by the European Commission, said "European governments are moving to alternatives that give them greater sovereignty" and that they "can't leave themselves exposed to being deplatformed." Frank Karlitschek, founder and CEO of Nextcloud, a storage and collaboration software vendor, noted that European public sector organizations mostly use software from a few large proprietary providers, which has led to strong dependencies, and that organizations have recognized the risks of digital dependencies and are seeking better options to maintain full control over their data, infrastructure, and underlying technology. According to Nextcloud, it added more than two million sovereign workspace seats in 2025, suggesting a trend forming across Europe.
The Dutch tax authority's decision signals a concrete test case for whether governments can operationalize digital sovereignty without sacrificing user experience or budget efficiency. While the appeal of on-premises control is clear in principle, the practical trade-offs around lost functionality and migration friction will determine whether this becomes a template for other agencies or a cautionary tale about the cost of autonomy.