When support ends but the licence continues: what it costs to be wrong
When a support and maintenance contract lapses, the underlying licence to use the software does not disappear. The right to run the code survives; the right to receive patches, security fixes and vendor assistance does not. Treating the two as a single obligation is the most expensive mistake in this situation.
Grounds
Directive 2009/24/EC sets the baseline for what a licence covers on its own, without a maintenance layer on top. It protects computer programs as literary works. It lists the narrow rights a lawful acquirer keeps regardless of any separate agreement: use in accordance with its intended purpose, error correction where the contract allows it, and the limited acts needed for interoperability. None of these rights depends on an active support contract. None of them creates one either.
Where the software falls inside the scope of Directive (EU) 2022/2555 (NIS2), a second layer applies independently of the first. Security obligations attached to essential or important entities do not pause because a vendor's support desk closed a ticket queue. A licence that keeps running unpatched inside that scope carries a compliance exposure the contract itself does not describe.
A licence running without matching support behaves like an unmaintained branch: it drifts from the vendor's current version until a compatibility or security gap opens. The same pattern shows up outside software too: When a fork duplicates the token step by step, the divergence is a duplicate record rather than a stale build.
Practical consequence
Three clocks start moving the day support ends, and none of them waits for a formal notice. The warranty period attached to the last delivered version keeps running down. Any breach-notification duty tied to the software's role in processing personal data keeps running down. Any patch backlog keeps growing, silently, until an incident makes it visible.
If the software includes an embedded AI component inside the scope of Regulation (EU) 2024/1689 (AI Act), applicable from 2 August 2026, a fourth clock applies. Post-market monitoring duties do not transfer to the licensee just because the vendor stopped supporting the build. Whoever keeps operating the system keeps the monitoring duty that attaches to operation, not to support.
What to do
- Legal counsel separates the licence clause from the support clause in the contract, in writing, before any renewal talk starts.
- The IT security lead lists every patch released since the last update the organisation actually installed.
- The compliance officer checks whether the software's function places the organisation inside NIS2 scope, and records the answer.
- The data protection contact confirms which data flows still depend on the vendor's processing role; see Privacy notice: two roles, two bases step by step for how the two roles are usually split.
- The incident owner sets an internal deadline for closing the highest-severity gap on the patch list.
- Someone in the organisation writes down the exact date support ended. This date becomes the reference point for every deadline above.
Who decides
| Question | Who decides | Typical timeframe |
|---|---|---|
| Whether the licence itself remains valid | The parties, under the licence clause of the contract | Set by the contract's own term and termination clauses |
| Whether a patch obligation survives the end of support | The parties, unless a regulator's scope applies independently | Set by the contract, or by the regulator's own supervisory cycle |
| Whether NIS2 duties apply to this deployment | The competent national authority for the sector in question | Set by that authority's own procedure, not by the contract |
Scenarios
If the licence is perpetual and the support contract was always separate, the loss of support changes risk, not rights. The organisation keeps using the software; it takes on the patching effort itself, or contracts a third party for it.
If the licence itself is time-limited and tied to an active support subscription, its expiry needs checking on its own terms. A support lapse can trigger a licence review clause even where the two contracts look independent on paper.
If the software sits inside NIS2 scope and support ended without a patching plan, the exposure is regulatory as well as contractual. This scenario needs the compliance officer involved before, not after, an incident.
Limits
This page does not decide whether a specific contract's termination clause has already been triggered; that reading depends on wording no registry entry can substitute for. It does not set a national notice period, because none is confirmed for this situation. It does not address what a fork of the software's own codebase costs to unwind; that question sits in a different situation entirely.
Verified
Checked against: Directive 2009/24/EC; Directive (EU) 2022/2555 (NIS2); and Regulation (EU) 2024/1689 (AI Act), status as at its stated date of application. Verification date: 4 March 2025.
Where the question is not the licence but the counterparty behind it, the evidence sits in a different file. Counterparty in Hong Kong and its limits in detail sets out what a factual report can establish about the party itself.
A parallel question concerns the document that carries the licence terms. Document in Hong Kong step by step sets out the same limits for a document rather than a party.
Frequently asked questions
What is the first step when support ends but the licence continues?
Separate the two contracts on paper before deciding anything else. Most disputes start from treating a support lapse as a licence lapse, or the reverse.
Which deadline is already running?
At minimum, the patch backlog and any warranty period tied to the last delivered version. Neither pauses for a notice period.
Who decides, and on what evidence?
The parties decide most of it under the contract itself. A regulator decides the rest, on evidence of the software's function and scope, not on the contract's wording.
Related publications
A related failure pattern sits in AI-generated output rather than licensing. When the contract is silent on AI output step covers what happens when the contract never addressed the question at all.