When the contract term outlives the product: what to do first
A contract term that keeps running after the underlying product stops working is a common gap in technology agreements. The fix is not a lawsuit. It starts with reading the notice you already received, checking which deadline it triggers, and deciding within days whether to terminate, renegotiate, or migrate before the term forces your hand.
The legal basis
The product itself, if it is software, sits under Directive 2009/24/EC, which governs the legal protection of computer programs across the Union. This is why the licence terms you signed control the outcome, not the fact that the vendor stopped shipping updates.
Where the product also functions as a network or information system, the customer's own security duties under Directive (EU) 2022/2555 (NIS2), in force from 18 October 2024, do not pause just because the vendor's support does. A patch gap does not excuse a compliance gap.
If the product embeds an AI system, obligations under Regulation (EU) 2024/1689 (AI Act), which enters into force on 2 August 2026 and is current as of 20 February 2025, attach to the deployer independently of whether the supplier keeps maintaining the model. Discontinuation on the vendor's side does not discontinue your own duties.
What changes in the risk profile
Three things change once the product is discontinued but the contract is not. First, the risk of a security gap grows, because patches stop while your obligations under NIS2 continue regardless. Second, your negotiating leverage shifts: a vendor who has already sunset a product has weaker grounds to resist an early exit than the contract wording suggests.
Third, any escrowed source code or migration assistance clause becomes the only remaining lever, and it needs to be checked before the term lapses, not after. A clause read too late is a clause that has stopped helping you.
What to do, in order
- Pull the end-of-life or discontinuation notice and record the date it was actually sent — this date, not the announcement date on the vendor's website, starts the clock.
- Check the termination and change-of-control clauses in the agreement, and identify whether discontinuation qualifies as a material breach or a stand-alone termination trigger.
- Ask whoever manages data flows to confirm the data processing agreement still matches how the product is being used during wind-down — see Data processing agreement in detail.
- Instruct IT to confirm whether security patches have actually stopped, and log the date the last patch was received.
- Send a written request for source code escrow release or migration assistance, citing the specific clause of your own contract.
- Set an internal deadline to decide between renegotiation, migration, or termination — before the vendor's own notice period runs out.
Who decides, and how
Inside your organisation, the decision sits with whoever owns the vendor relationship commercially, not with IT alone, because the trade-off is contractual rather than technical. IT confirms the facts; the business decides what to do with them.
Externally, if the vendor disputes termination, the forum is whatever the contract's dispute clause names — usually arbitration or the courts at the vendor's seat. The evidence that carries weight is narrow: the notice itself, the patch log, and the escrow release request. Correspondence about frustration or disappointment carries none.
If your situation differs
If the product is licensed rather than owned outright, the discontinuation notice usually triggers a final support period rather than an immediate cut-off. Check the notice period stated in the notice before assuming the worst has already happened.
If the deliverable includes a tokenised right rather than conventional software, ownership questions run differently, and a related failure mode is worth knowing about: When the buyer of a token is not the rights holder despite holding the token itself.
If the vendor disputes that the product is actually discontinued, the dispute turns evidentiary, and the burden falls on whoever wants to terminate early to prove the product no longer performs to the agreed standard.
| Signal received | What it usually means | What to do next |
|---|---|---|
| End-of-life notice | Support and patches will stop on a fixed date | Confirm the date, check it against the remaining contract term |
| No security patches for months, no notice | The vendor has stopped maintaining the product informally | Log the gap in writing, raise it as a breach, not a complaint |
| Escrow release clause exists | Source code becomes accessible once a defined trigger occurs | Check whether that trigger has already been met |
| Vendor offers a paid extension only | The vendor is monetising the gap rather than closing it | Treat the offer as a negotiating position, not an obligation |
What this page does not resolve
This page does not set a figure for renegotiating the contract, and it does not calculate damages for the period the product underperformed. Both depend on the specific clause and the specific loss, neither of which a general situation page can price.
It also does not replace a reading of your own termination clause, which varies by vendor, by product, and by the jurisdiction named in the governing law provision.
Verified
Verified as of 20 February 2025. Primary sources: Directive 2009/24/EC on the legal protection of computer programs (Codified version); Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2); Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act).
Where the underlying question is not the clause but the counterparty itself, the relevant registry file is Counterparty in France and its limits in detail.
Where the question is which document actually proves the notice was sent and when, see Document in France step by step.
Related situations
A related risk sits on the liability side of the same contract: When a customer demands unlimited liability and the deadline that comes with agreeing to it.
Frequently asked questions
What is the first step when the contract term outlives the product?
Pull the discontinuation or end-of-life notice and fix the date it was actually sent, because that date, not the term's expiry, starts the clock you need to work against.
Which deadline is already running?
Usually the vendor's own notice period for ending support, and separately, any notice period your own contract requires for early termination. Check both, because they rarely match.
Who decides, and on what evidence?
The commercial owner of the contract decides internally. Externally, if the vendor disputes termination, the forum named in the dispute clause decides, and it decides on the notice, the patch log, and the escrow request, nothing more.