The Dutch tax office keeps its mail at home

The Dutch tax authority chose Microsoft 365 in 2025. This week it said it would not finish the move. In a letter to parliament dated 5 October, Eelco Eerenberg, the State Secretary for Finance, wrote that the Belastingdienst, Customs and the benefits agency Toeslagen "now choose an on-premises solution in combination with open source" for their office software, in our translation from the Dutch. In that scenario, he wrote, the software runs on servers belonging to or controlled by the tax administration.

The timetable is specific. "In 2027, the provision for mail and calendar will be realized on-premises. Later in 2027 and 2028, European open source solutions for personal storage and collaboration functionalities will follow," Eerenberg wrote, in the English rendering published by The Register. He said the approach would reuse existing licences where possible to keep additional investment down, and that the option had become feasible partly because the tax administration had managed to increase its data-centre capacity.

That second point is a reversal of the agency's earlier position. Initially, the tax authority had considered implementing a sovereign alternative "niet realistisch en uitvoerbaar", not realistic or feasible, Computable reported. The rollout had already been paused, and in June the government's Advisory Council on ICT Assessment, the Adviescollege ICT-toetsing, had recommended that it be rolled back. By then it had reached about 5,000 of the 47,500 staff across the tax, customs and benefits services, according to The Register. The council found that the design of Microsoft 365 in the public cloud "falls short on information security, information processing and future-proofing."

Its objections were partly about the configuration and partly about the supplier. The Register reports that the council was concerned about confidential documents that now travel over government networks being sent via American servers, about reliance on standard Microsoft encryption rather than Double Key Encryption, which would give the administration more control, and about Teams calls that lacked end-to-end encryption by default. On future-proofing, it flagged lock-in to a single American cloud provider and the absence of an exit strategy. Eerenberg's letter says the new approach is in line with the council's advice: not to assume one solution from one supplier, but to look for alternatives function by function.

The cost is not only money. Eerenberg acknowledged that several planned tools for putting the agency's record-keeping in order were part of the Microsoft 365 package and are not available on-premises. The tax administration is working out what is needed to solve that, and he will report back no later than the next progress letter. Records management is not a side issue for a tax authority: the same letter describes a planned central platform for document and archive management, meant to bring all documents from its primary processes onto one platform and better secure compliance with the Archives Act.

The office suite is not the only system the Belastingdienst is pulling closer. In the same letter, Eerenberg says geopolitical developments have increased attention to digital autonomy, and points to the modernisation of the VAT system, where the tax administration is taking over hosting from the supplier so it can implement the new system responsibly "in the current geopolitical context", in our translation. That extra work has pushed the go-live of VAT refunds to April 2027 and moved the rollout of domestic VAT from 1 July 2027 to the third quarter of 2027.

The letter also shows how little room the agency has. About 55 per cent of its available IT change capacity goes to essential modernisation to avoid continuity risks, 40 per cent to legislation and external commitments, and five per cent to strategic renewal. Eerenberg wants to move gradually to no more than 20 per cent for modernisation and at least 20 per cent for renewal, with a turning point expected at the end of 2028. Replacing office software with an on-premises and open-source stack has to fit inside that budget.

Vendors of the alternatives welcomed the decision. "It is great to see Dutch tax authorities have decided to work toward a sovereign digital workplace," Frank Karlitschek, chief executive of Nextcloud, said, according to The Register. The letter does not name suppliers for the open-source phase. Eerenberg was due to discuss it with the finance committee of the House of Representatives at a debate scheduled for Wednesday, and has promised a fuller roadmap for the agency's IT priorities in the first quarter of 2027.