The Dutch DigiD Veto: When 'Strategic Autonomy' Stops Being a Slogan

The most interesting sentence uttered in Europe this week was not pronounced in Brussels. It came from The Hague, where the outgoing Dutch government blocked the sale of the company that operates DigiD — the digital identity system through which roughly eighteen million Dutch citizens access tax authorities, hospital records, and municipal services. The American ambassador in The Hague has publicly criticised the decision. The Dutch caretaker prime minister has, in the same news cycle, called Europe 'naïve' for sheltering under the American security umbrella.

These two facts belong together. They tell us where the European regulatory project actually stands in May 2026.

Let us begin, as one should, with the text. The Dutch block rests on the national investment screening law that transposes the EU Foreign Direct Investment Screening Regulation, supplemented by the sector-specific Dutch statute on critical digital infrastructure. The operative provision is straightforward: a transaction touching a designated 'vital provider' requires governmental clearance, and clearance may be denied where national security, public order, or continuity of essential services is at stake. DigiD is not a borderline case. It is the registry through which the Dutch state recognises its citizens.

Which capitals wrote this regime, and which made the concessions? The FDI Screening Regulation of 2019 was, in its origins, a Franco-German-Italian project. Paris wanted a tool to slow Chinese acquisitions; Berlin wanted it filed under 'cooperation mechanism' rather than 'veto power'; Rome wanted a seat at the table. The compromise — a Commission opinion, member-state final say — was a Berlin victory disguised as a Paris one. The Dutch, who in 2019 still believed open markets were a sufficient doctrine, abstained from the political enthusiasm but voted for the text. They are now using a tool they did not particularly want, on a target the drafters did not particularly anticipate: an American buyer.

The institutional choreography from here is worth watching. The Commission has a formal role under Article 6 of the Regulation — it may issue an opinion on transactions notified by member states. It will not issue one that contradicts The Hague. The Council will say nothing in public and a great deal in working group. The Parliament's internal market committee will request a hearing; it will be granted, and it will produce a non-binding resolution that no buyer will read. The locus of action is bilateral: Washington and The Hague, with Brussels providing the legal architecture and the diplomatic cover.

Enforcement is where this gets interesting, and where most commentary will miss the point. The FDI Regulation has no enforcement apparatus of its own. It is a coordination instrument. Real enforcement lives in twenty-seven national screening authorities of wildly varying capacity. The Dutch one is now, by virtue of this decision, the most credible in the Union. Capital flows respond to credibility. Expect the next contested digital-infrastructure acquisition in the Netherlands to be withdrawn before notification, which is what successful screening regimes actually produce: not refusals, but deterrence.