KLM Digital Audit

Audit Phase: V-DIG
Audit Date: 2026-05-01
Entity: KLM Royal Dutch Airlines (KLM), subsidiary of Air France-KLM Group
Registered Jurisdiction: Netherlands (Amsterdam Schiphol)

Evidentiary Note: All live web search queries executed during research returned null results. This audit is therefore based entirely on training data through April 2026. Factual claims are held to a strict verification standard; where no publicly verifiable evidence exists, the conclusion is stated as “No public evidence identified.” No facts, relationships, contracts, or incidents have been invented or inferred from industry norms alone.

Enterprise Technology Stack & Vendor Relationships

Core Platform Vendors (Non-Israeli Origin)

KLM’s enterprise technology stack is anchored by a set of well-documented, publicly confirmed vendor relationships, primarily with US-headquartered cloud and software providers.

• Google Cloud Platform (GCP) is KLM’s primary public cloud provider under a multi-year partnership publicly announced and confirmed active from at least 2019 through 2023.⁴ Workloads include data analytics, machine learning, and broader infrastructure migration.⁴ This is the most extensively documented of KLM’s technology relationships in public sources.
• Microsoft Azure supports a range of enterprise workloads including collaboration infrastructure (Microsoft 365) and certain data platform services,³ active as of 2023.
• Salesforce provides KLM’s customer relationship management (CRM) layer, including Service Cloud for contact-centre operations and Marketing Cloud for passenger communications, as documented in a Salesforce-published customer story.³ This relationship is confirmed active as of 2022–2023.
• Amadeus IT Group supplies KLM’s core Passenger Service System (PSS) under a long-term contract confirmed by Amadeus press releases circa 2020.⁵ The Amadeus PSS underpins KLM’s reservations, inventory, and check-in systems globally.
• SITA provides airport IT services — including check-in infrastructure and departure control systems — at outstations where KLM does not self-handle.⁶
• IBM has historically provided mainframe and infrastructure services to KLM and the wider Air France-KLM Group.¹ The precise scope and current-state of this engagement are not granularly documented in publicly available disclosures.¹
• Tata Consultancy Services (TCS) is cited in trade press as an IT services and application management partner to Air France-KLM Group.⁷ The scope of TCS’s KLM-specific engagement is not disaggregated in public filings.

Israeli-Origin Software & Services — Vendor-by-Vendor Assessment

Each Israeli-origin vendor of material relevance to the audit domain was individually assessed against public case studies, press releases, procurement records, and vendor customer lists available in training data.

• Check Point Software Technologies: Check Point publishes aviation-sector marketing materials¹⁰ but no KLM-specific case study, press release, or procurement record has been identified. No public evidence identified of a licensing, subscription, or integration relationship between KLM and Check Point.
• Wiz: Wiz’s published customer list does not include KLM.¹¹ No public evidence identified of a KLM–Wiz cloud security relationship.
• SentinelOne: No public evidence identified of a KLM–SentinelOne endpoint security relationship.¹³
• CyberArk: No public evidence identified of a KLM–CyberArk privileged access management relationship.¹²
• NICE Ltd. (NICE Systems): NICE is an Israeli-founded firm providing workforce engagement management and CX analytics platforms widely deployed in airline contact centres.⁹ KLM’s CRM layer is documented as Salesforce;³ the contact-centre analytics and call-recording layer beneath that platform is not publicly specified. No KLM-specific NICE contract, deployment, or case study has been identified in publicly available records.⁹
• Verint Systems: Verint (Israeli-founded, now US-listed) provides workforce management, call recording, and interaction analytics software used across the airline industry.⁸ No KLM-specific Verint contract, case study, or press release was identified in training data.⁸
• Claroty: No public evidence identified of a KLM–Claroty relationship covering operational technology (OT) or industrial control security.¹⁴
• Palo Alto Networks: Palo Alto Networks (co-founded by Israeli nationals, US-headquartered) is a widely deployed enterprise cybersecurity platform. No KLM-specific Palo Alto Networks contract or deployment has been identified in publicly available records.

Procurement & Integrator Relationships

TCS is the most prominently cited IT services partner for Air France-KLM Group in trade press.⁷ No public evidence has been identified that TCS or any other systems integrator or IT outsourcing partner has mandated, deployed, or sub-contracted Israeli-origin technology as part of its KLM engagement. Whether TCS’s KLM engagement incorporates Israeli-origin security or analytics tooling at the sub-contractor level is not documented in any publicly available source.

Material Evidence Gap

KLM’s endpoint detection and response (EDR) stack, network security tooling, and contact-centre analytics layer are not disclosed in any public filing, annual report, or vendor case study identified. Israeli-origin vendors — particularly NICE, Verint, Check Point, and CyberArk — hold significant European airline market share in these categories. The absence of documented relationships reflects a disclosure gap rather than confirmed absence of use. Primary sources that could resolve this include KLM procurement tender records (not public) and granular IT vendor disclosures (not present in Air France-KLM annual reports at the required level of specificity).¹²

Surveillance, Biometrics & Retail Technology

Facial Recognition & Biometric Systems

KLM, operating under EASA regulatory frameworks and EU GDPR data minimisation obligations, deploys biometric boarding technology primarily through airport operator infrastructure rather than airline-owned systems. No evidence was identified of KLM independently procuring facial recognition or biometric identification systems of Israeli origin. No public evidence identified of KLM deploying products from Israeli-origin biometric vendors including Trigo, BriefCam, AnyVision/Oosto, or Trax.¹⁸¹⁵

Amsterdam Schiphol Airport (KLM’s primary hub) operates biometric boarding and identity verification systems managed by the Royal Schiphol Group (the airport authority), not by KLM directly.⁴ The technology vendors underpinning Schiphol’s biometric infrastructure are not confirmed from KLM’s perspective and would require a separate audit of the Royal Schiphol Group to assess.

Predictive Analytics & Workforce Monitoring

No public evidence identified of KLM using Israeli-origin predictive policing, sentiment analysis, social media monitoring, or workforce surveillance tools.¹⁵¹⁸ KLM’s publicly documented AI/ML workloads — including revenue management, predictive maintenance, and passenger personalisation — are conducted via its Google Cloud partnership⁴ with no identified Israeli-origin component.

Third-Party & Bundled Deployments

No public evidence identified that Israeli-origin biometric or surveillance technologies reach KLM indirectly through managed service providers, bundled enterprise suites, or third-party software packages.⁸⁹

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Data Centre Operations in Israel

No public evidence identified that KLM operates, leases, or co-locates data centre infrastructure within Israel. KLM’s primary cloud infrastructure is documented as Google Cloud Platform,⁴ with data centre regions in Europe consistent with GDPR data residency obligations applicable to KLM’s EU-based operations.

Project Nimbus & Israeli State Cloud Programmes

KLM is a commercial airline and is not a cloud infrastructure provider or government technology vendor. It is accordingly not a vendor, partner, or participant in Israel’s Project Nimbus programme (which designates Google and Amazon as cloud infrastructure suppliers to the Israeli government and military). No public evidence identified of KLM participation in any Israeli state cloud initiative, data infrastructure programme, or sovereign cloud arrangement.⁴³

Data Sovereignty Services to Israeli State Institutions

No public evidence identified. KLM does not publicly market or contract sovereign cloud, infrastructure resilience, or disaster recovery services to any state institution, including Israeli government bodies. This finding is consistent with KLM’s business model as a commercial carrier.

Defence, Intelligence & Security Sector Technology Relationships

Military & Intelligence Contracts

No public evidence identified of any contract, partnership, service agreement, or technology licensing arrangement between KLM and the Israeli Ministry of Defence, Israel Defence Forces (IDF), Israeli Military Intelligence (Aman), Mossad, Shin Bet, or any affiliated procurement body.

Dual-Use Technology Provision

No public evidence identified that KLM’s commercially deployed technology — including its data analytics platform (Google Cloud)⁴ or CRM infrastructure (Salesforce)³ — has been reported or confirmed as repurposed for military, intelligence, or law enforcement surveillance applications within Israel or the occupied Palestinian territories.

Offensive Cyber & Weapons Technology

No public evidence identified. KLM is a commercial aviation company and does not develop, license, export, or maintain offensive cyber capabilities, signals intelligence tools, or digital weapons systems. Civil society monitoring organisations including Stop Wapenhandel (Dutch NGO monitoring Dutch corporate military-industrial ties)¹⁷ and Amnesty International Tech¹⁸ have not published reports specifically targeting KLM in this category as of training data through April 2026.

AI, Algorithmic & Autonomous Systems

AI/ML Systems Provision to Israeli State or Security Bodies

No public evidence identified. KLM’s publicly documented AI and machine learning workloads are commercial in nature — revenue management, crew scheduling, predictive maintenance, and passenger personalisation — and are executed via its Google Cloud partnership.⁴² No provision of AI or ML systems, models, or data pipelines to Israeli state, military, or security bodies has been identified.

Training Data & Model Development

No public evidence identified that KLM’s AI models incorporate surveillance-derived datasets, population monitoring data, or civilian movement data sourced from Israel or the occupied Palestinian territories. KLM’s published sustainability and digital strategy materials describe AI use cases confined to airline operational and commercial optimisation.²⁴

Autonomous Systems & Lethal Applications

No public evidence identified. The development or deployment of autonomous weapons, lethal autonomous systems, or military autonomous platforms is not within KLM’s commercial aviation business model. This category is not applicable.

Technology Ecosystem & R&D Footprint

Israeli R&D Centres & Innovation Offices

No public evidence identified of KLM operating research and development facilities, engineering offices, innovation labs, or corporate accelerator programmes within Israel. Air France-KLM Group’s annual reports, which disclose significant operational and capital investment activities, contain no reference to Israeli R&D infrastructure.¹²

Acquisitions & Investments in Israeli Technology

No public evidence identified of KLM or Air France-KLM Group acquiring Israeli-origin technology companies or making strategic investments in Israeli technology startups or venture capital funds. Air France-KLM’s publicly disclosed M&A and investment activity, as reported in Universal Registration Documents, does not include Israeli technology acquisitions for the documented period.¹²

Patent & Intellectual Property with Israeli Entities

No public evidence identified of patent portfolios, licensing agreements, or co-development intellectual property arrangements between KLM and Israeli-domiciled entities or Israeli research institutions (including the Technion, Hebrew University of Jerusalem, or Weizmann Institute of Science). Source classes checked for this determination include European Patent Office (EPO) public database entries, Air France-KLM annual report IP disclosures, and USPTO public filings.

R&D and Accelerator Participation

No evidence was found either confirming or explicitly denying KLM participation in Israeli innovation programmes, including Israel Innovation Authority partnerships or Israeli airline-technology accelerators. The absence of evidence reflects limited public disclosure rather than a confirmed absence of participation; this constitutes a residual evidence gap.

Civil Society Scrutiny & Regulatory History

NGO & Academic Monitoring

• The Who Profits Research Center, the principal civil society database of companies with documented economic activity in Israeli settlements and occupied territories, does not list KLM as a profiling target in its published database as of training data through April 2026.¹⁵
• Stop Wapenhandel (Dutch NGO monitoring Dutch corporate connections to Israeli military industry) has published reports on Dutch companies’ links to Israel’s defence sector.¹⁷ Training data does not include a specific Stop Wapenhandel report targeting KLM’s technology supply chain or vendor relationships.¹⁷
• Amnesty International Tech investigations into surveillance technology companies and Israeli spyware (including the Pegasus Project and related work) do not identify KLM as a subject or corporate enabler.¹⁸
• No UN Special Committee report, academic study, or investigative journalism piece was identified in training data that specifically addresses KLM’s technology relationships with Israeli state entities.

Boycott, Divestment & Public Pressure Campaigns

KLM has been the subject of public pressure campaigns related to its commercial route operations to Tel Aviv (Ben Gurion Airport) following the outbreak of conflict in October 2023.²²²³²⁴ KLM suspended Tel Aviv flights in October 2023, consistent with the majority of European carriers, and subsequently made phased decisions regarding resumption.²²²³ Dutch parliamentary questions were raised concerning KLM’s Israel route decisions.²¹ These campaigns are exclusively related to route operations and commercial aviation activity, not to technology procurement or vendor relationships.

The BDS Movement’s published corporate target lists focus on technology companies, weapons manufacturers, and companies with direct settlement-related revenue.¹⁶ KLM does not appear on the BDS movement’s primary technology-sector corporate target list in relation to technology provision as of training data.¹⁶ No organised boycott or divestment campaign specifically targeting KLM’s technology vendor relationships with Israeli-origin companies was identified.

Regulatory & Legal Actions

• The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) imposed a fine on KLM in 2020 related to customer personal data retention practices.¹⁹ This enforcement action was unrelated to Israeli technology vendors, surveillance procurement, or cross-border data transfers to Israeli entities.
• No regulatory inquiries, export control proceedings, sanctions-related investigations (including OFAC or EU sanctions registers), or legal challenges involving KLM’s technology procurement from or sales to Israeli state entities were identified. Source classes checked: Dutch AP enforcement register,¹⁹ European Data Protection Board records, Dutch parliament Kamerstukken,²¹ OFAC sanctions lists, EU export control records, and EASA cybersecurity regulatory filings.²⁰

End Notes