The news
The Dutch tax office is abandoning its move to Microsoft 365 in the public cloud. In a letter to parliament reported on October 7, 2026, State Secretary for Finance Eelco Eerenberg said the agency will instead run office tools on servers it controls, alongside European open-source software.
The decision covers the Netherlands Tax and Customs Administration, including its customs and benefits services, which together employ about 47,500 people, according to The Register. The agency had announced its Microsoft 365 plan in October 2025 and paused the rollout on July 9, 2026, The Next Web reported. By then about 5,000 employees had already been moved.
Under the new plan, email and calendars move to the agency's own servers in 2027. Open-source tools for personal storage and collaboration follow later in 2027 and in 2028. The Register reported that the agency is looking at Element, a messaging app built on the open Matrix protocol, as a replacement for Microsoft Teams, and Nextcloud for storage and collaboration.
The pause followed a June 2026 recommendation from the Dutch Advisory Council on ICT Assessment, the government's review board for large IT projects. According to The Register, the council concluded that the design of Microsoft 365 in the public cloud fell short on information security, information processing and future-proofing.
The specific concerns, as reported by both outlets, included confidential documents passing through US servers, reliance on standard encryption rather than Double Key Encryption (a setup where the customer holds one of the keys), and end-to-end encryption not being on by default for Teams calls. The board also flagged vendor lock-in and the lack of a workable exit strategy. The Register added that the US CLOUD Act, which lets US authorities compel American providers to hand over data, was part of the concern.
The Next Web reported that the agency plans to reuse existing licenses where it can to limit extra spending. No budget figure for the switch was given in the reports.
The numbers
- Staff across tax, customs and benefits services
- About 47,500
- Employees already moved to Microsoft 365 before the pause
- About 5,000
- Rollout paused
- July 9, 2026
- Email and calendars move on-premises
- 2027
Why CEOs should care
For CIOs in regulated industries, this is a public example of a large buyer reversing a cloud suite migration midway, after roughly one in ten staff had moved. The reasons given were concrete: who holds the encryption keys, whether calls are encrypted end to end by default, where documents travel, and how the organization would leave. Those are the same questions auditors and regulators in banking, health and defense can ask. Ask your Microsoft 365 team which of these settings you use today and what it would cost to change them.
For CFOs and boards, the lesson is about exit cost. The review board's complaint was not only about security but about having no workable way out. Before signing or renewing a multi-year suite deal, ask for a written exit plan: how data is exported, in what format, how long it takes and what licenses can be reused. The Dutch agency is trying to reuse licenses to limit new spending, which shows that the commercial terms matter as much as the technology.
For CISOs, the case puts features such as Double Key Encryption back on the agenda. If your organization handles data that a foreign government could demand, document how a legal request under the CLOUD Act would be handled, and whether customer-held keys would block access.
The bigger picture
European governments have been weighing how much to depend on US cloud providers. The Next Web noted that the European Commission is testing Element as a backup to Microsoft Teams. The Dutch decision gives that debate a large, named example, and it may encourage other public bodies and regulated firms to put sovereignty requirements into tenders.
It also shows the limits of a quick switch. The tax office plans a phased move over 2027 and 2028, which suggests that leaving an integrated suite is a multi-year project even for an organization that has decided to do it.
What’s next
Watch for the agency's procurement for email, storage and collaboration tools in 2027, any cost estimate shared with the Dutch parliament, and whether other Dutch or EU agencies cite the same review findings in their own plans. Microsoft's response, if any, on encryption defaults will also matter to customers raising the same questions.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
Companies in this story
