Digital Audit - KLM Royal Dutch Airlines

Domain: Digital (Digital / Technology nexus) Entity scope: KLM Royal Dutch Airlines (KLM N.V.), the Dutch operating airline subsidiary of Air France-KLM S.A. KLM’s own technology acts are in scope. Much enterprise technology is procured at group (Air France-KLM) level and shared across KLM, Air France, and Transavia - those are attributed to the group and noted as covering KLM, while KLM-specific deals are distinguished. Group arms (AFI KLM E&M, Martinair) are flagged. Directionality: the serious case is KLM providing technology/data to the Israeli state (not an airline’s activity); KLM procuring from Israeli-domiciled vendors is a weaker customer-side relationship, recorded as such. Only genuinely Israeli-domiciled vendors count as Israeli-origin; Israeli-founded but foreign-domiciled firms are flagged. Compiled: 2026-06-27 Method: Live web search (≈22 queries) against Google Cloud/Salesforce/Amadeus/TCS/BCG press, KLM and AF-KLM newsrooms, Vision-Box/Schiphol biometrics coverage, the Dutch DPA register, and Who Profits. No model training data.

Enterprise Technology Stack & Vendor Relationships

KLM’s enterprise technology is a well-documented set of US- and European-origin platforms, with no Israeli-domiciled vendor identified.

KLM has a long-standing relationship with Google Cloud (US) for data analytics, BigQuery, and predictive-maintenance AI; at group level, Air France-KLM signed a December 2024 strategic data and generative-AI partnership with Google Cloud covering all three airline brands, and a July 2025 Accenture–Google Cloud generative-AI “factory”¹². CRM runs on Salesforce (US) - a KLM-specific Service Cloud / Marketing Cloud deployment integrating omni-channel social service³. The passenger-service system is Amadeus (Spain), migrating from Altéa to the next-generation Nevio platform under a group multi-year deal announced February 2025⁴. Tata Consultancy Services (India) is a 30-year IT partner, leading a group cloud data-migration programme⁵. Other documented vendors are also non-Israeli: Microsoft Azure (US), Boston Consulting Group (US) for KLM’s AI airline-operations suite (Pathfinder, CrewVision, Terra)⁶, ORTEC (Netherlands) for punctuality prediction, Sabre (US) for NDC distribution (group, 2025), SITA (Switzerland, of which KLM is a founding member), SAP (Germany), DigitalGenius (UK) for customer-service AI, and Gurobi (US) as the optimisation solver.

No public evidence was identified of any KLM contract or deployment of an Israeli-domiciled enterprise or cybersecurity vendor - Check Point (Tel Aviv), NICE Ltd (Ra’anana), CyberArk (Petah Tikva), or Cognyte (Herzliya). Vendors often described as “Israeli” but in fact US-domiciled - Verint (Melville, NY), SentinelOne, Wiz, Palo Alto Networks, and Claroty (New York) - likewise show no identified KLM relationship. KLM’s endpoint-security (EDR) and contact-centre speech-analytics layers are not publicly disclosed, so an Israeli-origin product there cannot be positively excluded - an evidence gap, not a confirmed negative.

Surveillance, Biometrics & Retail Technology

Biometric boarding at Amsterdam Schiphol is operated by the airport authority, the Royal Schiphol Group, not by KLM directly; the FaceBoarding infrastructure uses facial-recognition software from Thales (France) and gates from Dormakaba (Switzerland)⁷. KLM’s own biometric work was a 2017 “Seamless Flow” boarding trial at Schiphol built on the Vision-Box platform (Lisbon, Portugal; acquired by Amadeus in 2024)⁸. No public evidence was identified of KLM, or of the Schiphol infrastructure it uses, deploying any Israeli-origin biometric or video-analytics vendor (Oosto/AnyVision, BriefCam, Corsight), nor of KLM using Israeli-origin predictive-analytics, social-media-monitoring, or workforce-surveillance tooling.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

KLM’s legacy data centre is in the Schiphol-Rijk area (Netherlands), and it is migrating to cloud (Google Cloud, Azure); no public evidence was identified of KLM operating, leasing, or co-locating data-centre infrastructure in Israel. Project Nimbus - the Israeli government cloud contract held by Google and Amazon Web Services - does not involve KLM: KLM’s use of Google Cloud is an ordinary airline-to-provider commercial relationship, entirely separate from Nimbus¹⁹. No public evidence was identified of KLM providing data-sovereignty, resilience, or disaster-recovery services to any state institution.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence was identified of any contract, partnership, or technology-licensing arrangement between KLM and the Israeli Ministry of Defence, the IDF, Israeli military intelligence (Aman), Mossad, or Shin Bet. KLM is a commercial carrier, not a technology vendor; no instance was identified of KLM-deployed technology (its Google Cloud analytics or Salesforce CRM) being repurposed for military, intelligence, or law-enforcement surveillance in Israel or the occupied territories, and KLM develops no offensive-cyber, signals-intelligence, or digital-weapons capability.

AI, Algorithmic & Autonomous Systems

KLM is an AI consumer: its documented AI/ML workloads are commercial - revenue management, predictive maintenance, crew and ground-operations optimisation (the BCG-built suite), customer service, and food-waste reduction - run on Google Cloud and partner platforms¹⁶. No public evidence was identified of KLM providing AI or ML systems, models, or data pipelines to any Israeli state, military, or security body, nor of KLM AI models incorporating surveillance-derived or population-monitoring data from Israel or the occupied territories. Autonomous or lethal systems are outside KLM’s business.

Technology Ecosystem & R&D Footprint

No public evidence was identified of KLM operating an R&D facility, innovation lab, or accelerator in Israel; KLM’s technology and AI development is anchored in the Netherlands and through its named (non-Israeli) partners. No public evidence was identified of KLM or Air France-KLM acquiring an Israeli technology company or investing in an Israeli startup or venture fund, of any Israel Innovation Authority partnership, or of patent/licensing/co-development arrangements with Israeli research institutions (Technion, Hebrew University, Weizmann).

Civil Society Scrutiny & Regulatory History

No KLM entry was identified in the Who Profits database on technology grounds¹⁰. BDS technology campaigning targets Israeli-domiciled vendors and the cloud suppliers behind Project Nimbus (Google, Amazon) over Israeli-state contracts; no technology-grounds BDS campaign targeting KLM was identified, and route-operations criticism of KLM is a separate (Political/Economic) matter outside Digital scope. On regulatory history, in 2025 Air France and KLM disclosed a data breach in which the ShinyHunters group accessed customer data (names, contact details, Flying Blue numbers) via a third-party customer-service (Salesforce) platform; the Dutch Data Protection Authority was notified under GDPR, and payment and passport data were not exposed¹¹¹². The incident is a supply-chain data-security matter with no Israel nexus. No export-control, sanctions, or technology-enforcement action involving KLM technology procurement from or sales to Israeli state entities was identified¹³.

End Notes