Selling to a Dutch municipality: what to prepare for GIBIT 2025
GIBIT is the set of IT procurement terms of the Association of Netherlands Municipalities (VNG). According to the VNG, all 342 municipalities use GIBIT as the starting point for ICT procurement. GIBIT 2025 was published in March 2026 and adds topics such as AI, data, open source and cloud. Prepare evidence on security, data, AI and your software supply chain, and leave the interpretation of the contract to your lawyer.
If you sell software or a SaaS service to a Dutch municipality, you will meet GIBIT in the tender and in the contract. This is what you need to know and have ready as a supplier.
What GIBIT is
GIBIT stands for Gemeentelijke Inkoopvoorwaarden bij IT, the municipal IT procurement terms. The VNG maintains them. According to the VNG, all 342 municipalities use GIBIT as the starting point for ICT procurement. GIBIT is not a ready-made contract: the VNG calls it a set of purchasing terms that a municipality applies proportionately to the specific situation, often with the VNG’s contract generator (VNG, GIBIT, in Dutch). So every contract can turn out differently. Always read the terms of your own assignment.
What is new in GIBIT 2025
GIBIT 2025 replaces GIBIT 2023 for new contracts. Existing contracts based on GIBIT 2023 remain valid. The VNG lists these renewed themes (VNG, changes in GIBIT 2025, in Dutch):
- algorithmic applications (AI)
- digital fundamental rights and ethics
- data and data use
- open source software
- cloud
- sanctions policy
Two points that matter directly to suppliers:
- Certificate or TPM statement. If you have an ISO certificate or a TPM statement (a statement by an independent auditor), preventive tests are not needed.
- Central instead of per municipality. Audits and incident response can run centrally through the municipalities’ Information Security Service (IBD), instead of separately per municipality.
What to prepare
| Topic | What the municipality may ask | What to prepare |
|---|---|---|
| Security | How is your information security organised? | ISO certificate with scope or TPM statement; see also BIO2 |
| Personal data | Are you a processor, and how is that arranged? | Data processing agreement, sub-processor list, locations |
| AI and algorithms | Does your service use AI, and with which data? | Description of the AI features, data and human oversight |
| Software supply chain | Which components and open source does it contain? | Overview of components and dependencies |
| Incidents | How and how quickly do you report incidents? | Incident procedure and notification times |
| End of contract | How does the municipality get its data back? | Exit and data return procedure |
How to approach it
- Ask which GIBIT parts are in the assignment. Municipalities apply GIBIT per assignment. Ask for the draft agreement and its annexes.
- Prepare your evidence up front. Certificate or TPM statement, sub-processors, AI description and component overview.
- Tell one story. Your answers, your data processing agreement and your privacy notice must say the same. See the GDPR processor questionnaire.
- Have the contract reviewed. Liability and the interpretation of contract terms are for your lawyer, not the questionnaire.
How Holdvero helps
With Questionnaire Rescue we answer the municipality’s security and privacy questions based on your own documentation, with a source for every answer. Holdvero does not give legal advice on the contract. More about Dutch customers on the Netherlands page.
Frequently asked questions
Is GIBIT mandatory for municipalities?
It is not a law. According to the VNG, all 342 municipalities use GIBIT as the starting point for ICT procurement, and the VNG advises using GIBIT 2025 for new contracts.
What is a TPM statement?
A Third Party Mededeling: a statement by an independent auditor about your controls. Under GIBIT 2025, preventive tests are not needed if you have such a statement or an ISO certificate.
Do I have to sign a data processing agreement?
If you process personal data on behalf of the municipality, you are usually a processor and a data processing agreement is required under Article 28 GDPR. Have its content reviewed by your lawyer.
Do old GIBIT 2023 contracts still apply?
Yes. Existing contracts based on GIBIT 2023 remain valid. For new contracts the VNG advises GIBIT 2025.
Received a questionnaire from a municipality?
Within 1 working day you'll hear the price and when you get it back. You only pay after agreeing the price.
Get a fixed price