When support ends but the licence continues: what to do first
When a vendor's support ends but the licence keeps running, the software continues to work under the terms you already signed. Nothing lapses automatically. The task is to confirm what the licence still permits, flag the security gap left by missing updates, and set an internal deadline for renegotiating support or replacing it.
The legal basis
The licence and the support contract are two different instruments, even when one document contains both. Where the software qualifies as a computer program, your position as a lawful acquirer is shaped by Directive 2009/24/EC, which protects continued use of the program independently of any maintenance promise. If the software sits inside a chain covered by Directive (EU) 2022/2555 (NIS2), the missing updates turn into a risk-management question for the organisation, separate from anything the vendor owes you commercially.
What changes in practice
Three things change the day support ends: patching stops, the vendor's response-time promise stops, and your own risk register needs a new line. The right to use the software under the licence does not shrink. Your ability to show ongoing risk control does, unless someone inside the organisation picks up the gap.
| Element | Continues | Stops |
|---|---|---|
| Right to use the software | Yes, under the licence terms | — |
| Bug fixes and patches | — | Yes, once support ends |
| Vendor's response-time promise | — | Yes |
| Right to correct errors yourself, where the licence allows it | Yes, addressed under Directive 2009/24/EC | — |
| Duty to document security risk, where NIS2 applies | Yes, ownership shifts to the organisation | — |
What to do first
- Separate the support agreement from the licence agreement, even if both sit in one document; the contracts lead confirms which clause has actually lapsed.
- Ask the vendor in writing for the exact date support ended and whether a wind-down period applies; procurement sends the request and keeps the reply on file.
- Map every system running on this software against the organisation's NIS2 risk register, where that regime applies; the security officer runs the check.
- Check whether the licence allows self-maintenance or a third-party maintainer before anyone touches the code; legal reads the clause against Directive 2009/24/EC first.
- Set an internal deadline for renegotiating support or sourcing a replacement; the budget owner confirms the date and who signs off.
Who decides
The decision belongs to whoever owns the vendor relationship commercially, not to the technical team alone. Where the software feeds a service covered by NIS2, the security officer has a formal say, and the evidence is the organisation's own risk register rather than the licence text. If the vendor later claims a breach and moves to enforce the licence against you as the holder, that dispute runs on separate grounds: When enforcement is sought against a holder and who.
Three common branches
- If the licence is perpetual and silent on support, the right to use the software stays exactly as it was; only the promise of updates disappears.
- If the licence is subscription-based and tied to an active support fee, check whether non-renewal of support also ends the licence — the two are sometimes drafted as a single condition.
- If the software sits inside a NIS2-covered chain, treat the gap as a live risk now, before any incident forces the question.
Sources and limits
This page does not calculate the financial exposure created by the lost support, and it does not draft the renegotiation letter. It does not confirm whether your organisation falls under NIS2 — that depends on sector and size thresholds that sit outside a licence review. For the methodology behind how sources are tiered and delivered, see Sources by tier and delivery route explained.
Where the counterparty behind the licence sits in Sweden, the practical limits of what can be established about it are set out separately: Counterparty in Sweden and its limits in detail.
Where the dispute turns on the licence document itself, the preparation steps are covered here: Document in Sweden and what to prepare.
Verified: 4 June 2025. Sources: Directive 2009/24/EC on the legal protection of computer programs; Directive (EU) 2022/2555 (NIS2).
Related reading
When the contract is silent on AI output covers the neighbouring gap that appears in the same family of contracts.
FAQ
What is the first step when support ends but the licence continues?
Separate the two documents. Confirm, in writing, what the licence still permits and what date support actually stopped.
Which deadline is already running?
No statutory countdown starts automatically. The clock that matters is the one the vendor already gave you — a support end date or a wind-down window stated in the contract. Where none exists, the date support stopped becomes day one of your own risk-management timetable.
Who decides, and on what evidence?
The commercial owner of the vendor relationship decides. The evidence is the support agreement's end clause and, where NIS2 applies, the organisation's own risk register.