The Dutch tax authority (Belastingdienst) announced on 11 June 2026 that it was taking back control of the IT infrastructure underpinning its VAT system — infrastructure that had until now been operated by US software vendor Fast Enterprises. Servers will henceforth be hosted in the government’s own datacentres. Fast Enterprises loses production access but retains responsibility for software development and maintenance. The go-live date, originally set for 1 July 2026, has been postponed with no new date announced (Computable.nl, 11 June 2026).
Context: outsourcing under geopolitical strain
The Belastingdienst had contracted Fast Enterprises to develop and operate a new VAT management system — one of the most sensitive IT projects in the Dutch public sector. Against a backdrop of rising trade tensions with the United States under the Trump administration, State Secretary for Finance Eelco Eerenberg concluded that the data confidentiality and service continuity risks had become too significant to maintain the existing arrangement. The decision reflects a broader concern: technological dependence on non-European vendors for critical fiscal systems.
The partial repatriation of control also comes in the wake of a major new European regulation. On 3 June 2026, the European Commission announced the Cloud and AI Development Act (CADA), which prohibits public administrations and critical infrastructure operators from configurations that give a non-European third party control over their servers, or that force them to comply with foreign sanctions (Computable.nl, 12 June 2026). The timing is not coincidental.
What this means in practice for CIOs and CFOs
For IT and finance leaders watching this case, three signals stand out.
Digital sovereignty is becoming a contractual requirement, not just a strategic preference. Under CADA, public administrations and certain regulated businesses will need to demonstrate that no non-European vendor can block or intercept their systems. For CIOs running ERP on SAP, Oracle or Microsoft Azure infrastructure, this raises concrete questions about hosting clauses and production access rights. European vendors such as Unit4, AFAS and Exact gain a structural commercial advantage in public-sector and regulated-industry procurement.
Separating infrastructure from software is not enough. Marcel van Kooten, expert at consultancy Highberg, put it plainly: taking back the servers is progress, but the source code still belongs to Fast Enterprises. If Fast becomes unable to operate — due to US sanctions, insolvency, or a shift in commercial policy — the Dutch government would be left holding infrastructure it cannot maintain. Source code escrow clauses and step-in rights are now non-negotiable points in any ERP contract involving a non-EU vendor (ibid.).
A signal for public-sector ERP procurement across the Benelux. The Belastingdienst decision will not remain isolated. Other Dutch, Belgian and Luxembourgish administrations are watching this case closely. Upcoming tenders may explicitly incorporate infrastructure sovereignty requirements, and potentially a criterion of anticipated CADA compliance. For vendors currently in a sales cycle targeting this segment, it is a qualification parameter they can no longer ignore.
What to watch next
Two issues will remain on the radar. First, the new go-live date for the Dutch VAT system: if the delay stretches further, the political and budgetary cost could push the government toward a more radical revision of its contract with Fast Enterprises — well beyond a simple infrastructure repatriation. Second, the first CADA implementation guidelines expected before end 2026: these will clarify whether “sovereign infrastructure + proprietary US software” configurations are deemed compliant, or whether a more complete contractual break will be required for EU member states’ fiscal systems.
To go deeper, read our analysis of ERP and digital sovereignty: SecNumCloud, EUCS and sovereign cloud and our breakdown of SAP consolidation in the Netherlands with the Expertum acquisition.
