only address digital risks after an incident   62% of organisations

Digital sovereignty: the Netherlands waits until things go wrong   

Dutch organisations are broadly aware of their digital vulnerabilities, yet tend to take action only after an incident has occurred. 62% of Dutch respondents acknowledge that risks related to foreign legislation only receive attention following an incident, compared to a European average of 55%. This is according to the Tech Reality Check 2026, a study by Conclusion among 1,058 IT decision-makers across four European countries (the Netherlands, Germany, Portugal and Spain). 

Digital sovereignty is high on the European agenda. Geopolitical tensions, new legislation such as NIS2, DORA and the Cyber Resilience Act, and a growing awareness of dependency have firmly positioned the topic in many boardrooms. 86% of European respondents are aware of the risks when technology or data falls under foreign legislation. At the same time, only half have translated that awareness into active policy that is actually implemented. As a result, the gap between knowing and doing has itself become a risk.  

Another signal emerges from how organisations assess internal knowledge. 68% of Dutch respondents indicate that critical systems rely on technology understood by only a small number of people within the organisation — again the highest percentage among the countries surveyed. This means that in the Netherlands, digital sovereignty is not only a matter of suppliers and jurisdictions, but also of internal knowledge dependency and legacy systems.

Lucas Jellema, CTO of Conclusion: “Digital sovereignty is about understanding which technologies, suppliers and knowledge you depend on, and the risks that come with them. That analysis requires structure: map dependencies across systems, processes and datasets, assess the impact of potential disruptions, and determine the residual risks after mitigation. In the Netherlands, we like to see ourselves as a digital frontrunner, but this study shows that awareness of risks is less often translated into concrete decisions and actions compared to similar countries. It reflects a broader pattern: we know there is work to be done, yet postpone it until an incident occurs. What is needed now is not more technology or more policy on paper, but governance that drives decision-making: which risks do we accept, which mitigation measures do we implement, and who within the organisation takes ownership? Only by making these choices explicit can organisations establish the control needed to truly strengthen digital sovereignty.”