Dutch AI startups target the public sector, but procurement rules and GDPR remain challenging

Dozens of Dutch AI startups are pursuing government clients, but the path there is rarely straightforward. Procurement rules, GDPR obligations and slow decision-making at municipalities and ministries make the public sector a demanding market, one that simultaneously offers stable contracts and societal visibility.

According to available industry data, the Netherlands has 39 govtech startups. Within that broader category, a subset focuses specifically on AI applications: automation of spatial analysis, privacy-preserving data exchange between public agencies and decision support for policy staff. How they go to market differs by niche, but the challenges are largely the same.

Privacy technology as the key to government collaboration

Roseman Labs (Utrecht, founded 2020) builds software that enables organisations to conduct joint analyses on encrypted data without sharing that data with one another. The technique is called Multi-Party Computation (MPC). The company has raised €9.4 million to date, including €5 million in a Series A led by G+D Ventures, with participation from Swiss Post Ventures and Mozilla Ventures, among others.

Its client list includes the National Cyber Security Centre, the Municipality of Rotterdam and UMC Utrecht. Together with the Municipality of Rotterdam, Roseman Labs won the 2025 Dutch Privacy Award in the Application category. The company also assisted the Dutch government with the launch of SecureNed, a cybersecurity data-sharing network with five thousand members.

The go-to-market strategy operates through direct partnerships with large systems integrators. For example, Roseman Labs works with Capgemini, which integrates the technology into existing client environments. This means the company does not have to navigate every procurement procedure itself; the partner takes on that role. In terms of scalability, this model differs from a purely standalone SaaS approach, but it does provide access to procurement processes that would otherwise be difficult for a small company to enter.

Linksight (Utrecht, founded 2021) operates along similar lines. Its platform enables data scientists from multiple organisations to collaborate without exposing the underlying sensitive data, using techniques such as MPC, secret sharing and fully homomorphic encryption. Linksight works together with TNO. Applications include healthcare, where organisations map waiting lists and jointly train AI models without centralising patient data.

Digital twins for municipalities

Tygron (The Hague, founded 2005) occupies a different position. The company has spent nearly twenty years building digital twins for spatial simulations in urban environments. Senior policy staff at large Dutch municipalities use the Tygron Geodesign Platform for issues related to nitrogen pollution and the Environment and Planning Act (Omgevingswet).

Tygron sells licences in various bundles and works with consultants who guide municipalities through the setup and integration of digital twins into their workflows. This gives the company a combination of product sales and a partner network of advisory firms, a common approach with government clients, where in-house expertise at municipalities is often lacking.

On the regulatory front, Tygron makes a deliberate choice: the platform is independent of American cloud providers and holds ISO 27001 certification. Neural networks and training data are published as open source, and the platform supports open standards such as ONNX. For government clients wary of vendor lock-in or with a strong focus on data sovereignty, these are concrete selling points.

Consultancy as a bridge to market

Bigdata Republic (Utrecht, founded 2015) operates as a data and ML consultancy and raised €9.2 million in a Series A in 2021. The company focuses on generating measurable results from data investments and serves clients across multiple sectors, including the public sector.

Bigdata Republic organises meetups on AI governance and the EU AI Act, featuring speakers from the Ministry of Justice and Security and the Ministry of Economic Affairs. This serves as both substantive positioning and lead generation: those who debate the AI Act with policymakers also register on their radar as a potential implementation partner. For a consultancy that works project to project, visibility in policy networks is a direct commercial strategy.

Procurement and GDPR as structural hurdles

The obstacles these companies encounter are widely known but remain persistent. Procurement rules require transparent selection procedures, which significantly extends the lead time from an initial conversation to a signed contract. Small startups sometimes lack the financial reserves or the references needed to compete at all. Procurement expertise centre PIANOo has developed an innovation toolkit that is being specifically supplemented with elements for AI procurement, but in practice many municipalities still lag behind.

The GDPR imposes strict requirements on the processing of personal data, particularly when multiple government organisations want to combine data. That is precisely the niche Roseman Labs and Linksight address: their technology enables collaboration without organisations having to bear legal responsibility for each other's data. Compliance is therefore not only a requirement, but also a sales argument.

The Dutch government has published a vision on generative AI, emphasising that AI applications must be human-centred and trustworthy, supported by impact assessments and audits. Startups that account for these kinds of requirements early in their product development are better positioned in procurement processes where such criteria are increasingly being made explicit.

For the broader Dutch AI scene, the govtech market illustrates a pattern that recurs frequently: public clients demand high reliability, staying power and a willingness to invest in compliance, while the commercial cycle moves more slowly than in the private sector. Startups that succeed in this environment typically build a partner strategy alongside their product and deliberately target positions where regulation creates a barrier to entry that protects them once they are established.