While many IT suppliers are already winding down for the Christmas holidays, municipalities are quietly rewriting the rules of the game. In practice, these rules are better known as the Municipal IT Procurement Conditions, or the GIBIT. If you, as an IT supplier, contract under the GIBIT, this blog is for you.
In our previous blog, we discussed the new NL Digital Conditions 2025. Today, the focus shifts to the GIBIT 2025. These are a set of terms designed to support Dutch municipalities in procuring IT services. The current version dates back to 2023. Since then, the municipal IT landscape has changed rapidly, making an update necessary. Although the intention was to finalize the new version in 2025, for now only a consultation draft is available.
So while it remains to be seen whether the GIBIT 2025 will make it home before Christmas, the key changes in the consultation version are already clear. These changes are relevant not only for municipalities, but also for the IT suppliers they work with. In this blog, we outline the most important changes, giving you plenty of talking points for the upcoming Christmas and New Year gatherings.
Open source
The star on the GIBIT Christmas tree is the addition of a new chapter on open source. Open-source software makes the source code freely available, allowing anyone to view, copy and modify it. The new chapter establishes open source as the default for custom-developed software, unless there are clear reasons to deviate from this principle. The software must be published in the name of the municipality on a platform such as GitHub. At the moment of publication, the intellectual property rights of the software will vest in the municipality. The chapter also prescribes the use of open-source licenses, such as the European Union Public License.
This approach aligns with the ambition of municipalities to develop software that can be reused by other municipalities, as repeatedly developing the same software is simply too costly. It also reduces dependency on a single IT supplier, preventing so-called vendor lock-in. As a result, open source has become an essential element of the government’s IT landscape.
Artificial intelligence
Artificial intelligence (AI) also receives a clear place under the GIBIT Christmas tree in the 2025 version. For IT suppliers, this brings concrete obligations, and it is wise for them to be aware of these at an early stage.
While the GIBIT 2023 already included a definition of algorithmic applications, the 2025 version adds a definition of an “AI system”. This definition is taken directly from the AI Act. The definition of algorithmic applications has also been expanded so that all AI systems fall within its scope. Note, however, that the reverse is not necessarily true: not every algorithmic application qualifies as an AI system.
A number of important obligations therefore rest with the IT supplier. The supplier must be able to explain how the AI system works and is responsible for the risk classification of the system. Where a high-risk AI system is involved, the supplier must guarantee compliance with the requirements of the AI Act. In that context, the supplier must also ensure that the municipality is not inadvertently regarded as the provider of the AI system. In addition, several obligations from the AI Act are contractually imposed on IT suppliers, including the obligation to cooperate with a Fundamental Rights Impact Assessment.
Finally, the rules on data use in algorithmic applications have been tightened. Data processed in AI applications may not be used for the IT supplier’s own purposes, unless the data are fully anonymized. This is not the only change relating to data.
Data
As a final highlight, the rules on data have been significantly revised to reflect new legislation, such as the Data Act. The core principle is that municipalities must be able to retain their data upon termination of the contract with their IT supplier. This applies both to data generated by software and to data generated by physical products, such as smart cameras. IT suppliers must also inform municipalities that data are being processed. The parties must agree whether, and if so how, such data are shared. Since the IT supplier processes the data on behalf of the municipality, it may not delete the data without consent, unless this is technically impossible or required by law.
For cloud and hosting services, the key focus is on ensuring data availability and data migration. Municipalities are granted extensive rights to switch cloud or hosting providers. In the event of such a transition, the municipality must be able to continue working with the existing system on a temporary basis. At the municipality’s request, an exit plan must also be drawn up. The principle is that this is done periodically, as an up-to-date exit arrangement is in the interest of both parties.
Conclusion
The consultation version of the GIBIT 2025 leaves little doubt about the direction municipalities are taking. More control over software and data, less dependency on individual suppliers, and a clear contractual embedding of new legislation such as the AI Act and the Data Act. Open source is no longer a nice-to-have, but the default. AI is not only technically regulated, but also legally framed in detail. And data? Even at the end of the contract, it clearly remains with the municipality.
For IT suppliers, this means that the GIBIT 2025 is far more than a cosmetic update. The conditions directly affect business models, IP structures, data accessibility and responsibilities relating to AI. Anyone working with municipalities would be well advised to take this consultation version seriously now and to start internal discussions about its implications for existing and future contracts.
Whether the final GIBIT 2025 will be placed under the Christmas tree before the end of the year remains to be seen. In any case, the consultation version already provides a solid basis for preparations in the new year. Need assistance with this? We are happy to think along with you.
