meta_id 3317804

On July 10, 2026, the Dutch Data Protection Authority (AP), alongside the Dutch Authority for Consumers and Markets (ACM), the Dutch Financial Markets Authority (AFM), De Nederlandsche Bank (DNB), and the State Inspectorate for Digital Infrastructure (RDI), released a joint report titled "The Route to Digital Autonomy." The report addresses growing dependencies on a small number of information technology (IT) service providers and recommends accelerating the transition toward greater digital autonomy for businesses and government bodies. The regulatory bodies identified significant risks stemming from concentrated reliance on non-European IT service providers, including service disruptions, cyber incidents, and geopolitical developments that could severely impact businesses, government agencies, and society. The authorities emphasise that digital autonomy does not require complete technological independence but rather promotes open IT architecture, interoperability, and competition to enhance organisational resilience and choice. The regulators issued recommendations across multiple stakeholders. Governments should assume a catalytic role by consolidating demand for new European digital services and acting as early adopters. Both public and private organisations should prioritise digital autonomy when procuring IT services, including requirements for open standards, interoperability, and vendor switching capabilities. Businesses are encouraged to collaborate within sectors as early adopters of sector-specific IT services, with significant scope for such cooperation under competition rules. IT providers should strengthen European alternatives through enhanced collaboration. The report aligns with broader digital risk management initiatives, including the Digital Operational Resilience Act (DORA) and the new Cybersecurity Act implementing the Network and Information Systems Directive 2 (NIS2), which takes effect August 15, 2026. Both frameworks emphasise managing supply chain risks and strengthening resilience in essential and important organisations. The regulators delivered the report to State Secretary Aerdts (Digital Economy and Sovereignty) and invite organisations to contact them with questions regarding the recommendations.