End-of-life software (EOL/EOS) in 2026: compliance risk, ESU costs and how Vietnamese businesses should plan upgrades

Quick answer

End-of-life software does not stop running — it stops being patched. That is precisely why EOL is a compliance problem rather than a purely technical one: the system keeps working, the licence paperwork still looks clean, but every vulnerability discovered after the end-of-support date will never receive a fix. You do not lose the right to use software you bought; you lose the ability to demonstrate that you applied "management and technical measures… to prevent and combat risks" as Vietnamese law requires.

Three dates matter right now for businesses in Vietnam: Windows 10 reached end of support on 14 October 2025, SQL Server 2016 left Extended Support on 14 July 2026 — less than two weeks ago — and Windows Server 2016 ends Extended Support on 12 January 2027, roughly 18 months away.

Vietnamese law does not leave the software lifecycle unregulated. Law on Cyberinformation Security No. 86/2015/QH13, Article 23(1) requires organisations to issue rules on cyberinformation security across the *"design, construction, management, operation, use, upgrade and disposal of information systems"* — upgrade and disposal being exactly the EOL phase. Decree 85/2016/ND-CP, Article 19(2)(g) then lists *"termination of operation, exploitation, liquidation and disposal"* as a mandatory component of an information system security plan.

The practical answer is not a binary choice between "leave it alone" and "replace everything now". Build a lifecycle calendar per product, price the extension year by year — Microsoft publishes Windows 10 ESU for organisations at USD 61 per device for Year One, with the price doubling every consecutive year for a maximum of three years — and compare that against a one-off upgrade. Dzo.software advises on and supplies genuine licences with Vietnamese e-VAT invoices and VND payment.

Lifecycle dates and numbers worth memorising

Every figure below comes straight from the vendor's own lifecycle page, with links so you can verify it yourself instead of trusting this article.

• 14 October 2025 — Windows 10 end of support. Microsoft states: *"Windows 10 will reach end of support on October 14, 2025. The current version, 22H2, will be the final version of Windows 10"* — Microsoft Lifecycle.
• 14 July 2026 — SQL Server 2016 Extended Support ends (Mainstream ended 13 July 2021). ESU Year 1 runs 15 July 2026 to 13 July 2027 — Microsoft Lifecycle.
• 14 October 2025 — Office 2016 Extended Support ended (Mainstream ended 13 October 2020) — Microsoft Lifecycle.
• 12 January 2027 — Windows Server 2016 Extended Support ends (Mainstream ended 11 January 2022) — Microsoft Lifecycle.
• USD 61 per device for Windows 10 ESU Year One through Volume Licensing. Microsoft adds *"The price doubles every consecutive year, for a maximum of three years"* and *"ESUs are cumulative"* — Microsoft Learn.
• Five years of Mainstream Support minimum is Microsoft's commitment under the Fixed Lifecycle Policy: *"A minimum of five years Mainstream Support"* — Microsoft Lifecycle Policy.

1. EOL, EOS, ESU and Sustaining Support — four terms that get conflated

Most internal arguments between IT and finance start with these four terms being used interchangeably. The short definitions:

EOL (End of Life) is when the vendor stops selling and developing the product. EOS (End of Support) is when the vendor stops shipping fixes — this is the date that decides your risk exposure. A product can be EOL for years while still having EOS several years ahead.

Microsoft splits the commercial product lifecycle into three phases in its Fixed Lifecycle Policy. During Mainstream Support customers can request design and feature changes and receive both security and non-security updates. In Extended Support, Microsoft is explicit: *"Microsoft will not accept requests for warranty support, design changes, or new features during the Extended Support phase"* — what remains is security updates at no additional cost plus paid support. Once Extended Support ends, security updates are available only through the paid Extended Security Update programme.

ESU is not an extension of support. Microsoft lists what ESU does not include: *"New features · Customer-requested nonsecurity updates · Design change requests"*, and answers the question *"Is technical support included in ESU?"* with *"No, technical support isn't included in the ESU program"* — Microsoft Learn. ESU is an oxygen tank that buys you time to migrate, not a place to live.

Oracle uses different vocabulary for the same shape. Per Oracle Lifetime Support Policy — Oracle Technology Products (effective 1 May 2026): *"Premier Support provides a standard five-year support policy for Oracle Technology products. You can extend support for an additional three years with Extended Support for specific releases or receive indefinite technical support with Sustaining Support."* The word "indefinite" is reassuring until you read what Sustaining Support does not include: *"New updates, fixes, security alerts, data fixes, and critical patch updates · New tax, legal, and regulatory updates · New upgrade scripts · Certification with new third-party products/versions · Certification with new Oracle products."*

Put plainly: Oracle Sustaining Support gives you someone to call, not new security patches. This is the single most misunderstood point among Vietnamese businesses who believe they are "still supported".

2. Why EOL is a compliance issue, not just a technical one

The common objection runs: *"We bought a perpetual licence, so we can keep using it legally after support ends."* That is correct about usage rights and irrelevant to information-security obligations. These are two separate duty sets sitting in two different laws.

On the security side, Law on Cyberinformation Security No. 86/2015/QH13 provides in Article 23 (Measures to protect information systems): *"1. Issue regulations on cyberinformation security assurance in the design, construction, management, operation, use, upgrade and disposal of information systems. 2. Apply management and technical measures in accordance with cyberinformation security standards and technical regulations to prevent and combat risks and remedy cyberinformation security incidents."* It is difficult to argue you are "preventing and combating risks" while running a system the vendor has declared will never be patched again.

The same law, Article 22 (Tasks of protecting information systems), lists six duties including *"2. Assess and manage information system security risks."* An end-of-support product is a known risk, quantifiable, with an expiry date published on the vendor's own website — if that class of risk is not on your risk register, the risk assessment process itself has a gap.

At decree level, Decree 85/2016/ND-CP on information system security by classification level sets out in Article 19(2) the seven mandatory components of a security plan: *"a) security in the design and construction phase; b) security during operation; c) information security inspection and assessment; d) information security risk management; dd) information security monitoring; e) contingency, incident response and disaster recovery; g) termination of operation, exploitation, liquidation and disposal."* Point (g) is the EOL phase — the law already treats end-of-life as part of the compliance file, not an IT housekeeping chore.

The second duty set is copyright, and this is where EOL creates a dangerous temptation. Once a product is out of support, reinstalling the old version often fails because the official download channel has closed, and IT staff drift toward unofficial installers or activation tools. At that moment the organisation moves from "information security risk" straight into "copyright infringement". The current penalty framework sits in [Decree 341/2025/ND-CP](/en/blog-nghi-dinh-341) — a maximum administrative fine of VND 500 million for organisations and VND 250 million for individuals, per the Copyright Office of Vietnam.

3. Extend or upgrade: the cumulative ESU maths

When a product leaves Extended Support you have three real options: (a) upgrade to a supported version, (b) buy ESU to purchase time, or (c) move the workload to a cloud platform where ESU is bundled. Option (b) looks cheap in year one and becomes expensive by year three — by deliberate design.

Microsoft prices Windows 10 ESU for organisations at USD 61 per device for Year One, with two rules that matter: *"The price doubles every consecutive year, for a maximum of three years"* and *"If you decide to purchase the program in Year Two, you have to pay for Year One too, as ESUs are cumulative"*. You cannot skip Year One to save money. Table 3 works the cumulative cost through using exactly those two rules.

One detail many organisations miss: Microsoft states that ESU is included at no additional cost for Windows 10 virtual machines on Windows 365, Azure Virtual Desktop, Azure virtual machines, Azure Local, Azure Stack Hub and Azure Stack Edge, among others. If you are weighing a move to cloud-hosted desktops, the avoided ESU spend belongs inside that ROI calculation rather than in a separate project. If you want to carry existing licences into the cloud, see [BYOL — bringing software licences to the cloud](/en/byol-mang-license-phan-mem-len-cloud).

• The minimum ESU purchase is one licence — small businesses are not blocked by a minimum order quantity.
• You cannot buy part of a year: Microsoft states *"Customers can't buy partial periods, for instance, only six months"*.
• Devices must be running Windows 10 version 22H2 to be eligible to install ESU updates.
• ESU does not run forever: a maximum of three years after end of support for commercial and educational organisations.
• Machines without ESU keep working normally — which is exactly the psychological trap that pushes the upgrade from one quarter to the next.

4. A six-step process for managing software lifecycle

Managing EOL does not require expensive tooling. It requires one accurate table and a fixed review cadence. The six steps below are the minimum viable process for a 50–500 person business with one part-time owner.

Step 1 is the foundation: if you do not know what you are running and at which version, every later step is guesswork. This is also why inventory is the first pillar of [software asset management (SAM)](/en/sam-quan-ly-tai-san-phan-mem-doanh-nghiep-vua).

• Step 1 — Inventory: list every application, its exact version (including service pack/build), install count, owning department, and the business systems that depend on it.
• Step 2 — Attach an EOS date to every row: look it up on the vendor's own lifecycle page (Microsoft Lifecycle, Oracle Lifetime Support, Broadcom Product Lifecycle) — never from a secondary blog, where dates are routinely copied wrong.
• Step 3 — Classify by exposure: internet-facing systems, systems processing personal data, and customer-facing systems rank highest; isolated offline machines can carry accepted risk under controls.
• Step 4 — Set T-18 and T-6 alerts: eighteen months before EOS to enter next year's budget cycle, six months before to lock the technical approach. This is why Windows Server 2016 (12 January 2027) needs to be handled in the current budget cycle.
• Step 5 — Decide and record the reasoning: every row ends in one of four decisions — upgrade, buy ESU, move to cloud, or accept the risk with compensating controls such as network isolation and enhanced monitoring. Record who approved it and when; that record is the file you will need in an inspection.
• Step 6 — Close the lifecycle properly: when decommissioning, complete the "termination of operation, exploitation, liquidation and disposal" stage — securely wipe drives, reclaim and retire keys, update the asset register, and file the disposal record.

5. Five mistakes that make EOL expensive

Across reviews for Vietnamese businesses, these five patterns recur most often — and all five stem from misreading how lifecycles work, not from a lack of budget.

• Confusing "still usable" with "still supported." EOS software still boots, still prints reports, still issues invoices — so nobody sees a problem until there is an incident.
• Assuming Oracle Sustaining Support is safe. Oracle states plainly that Sustaining Support excludes *"new updates, fixes, security alerts, data fixes, and critical patch updates"* — you get a support desk, not a patch.
• Buying ESU and stopping there. ESU is purchased time, not a solution. Anyone who buys ESU without simultaneously starting a migration project meets the same problem again at four times the price in year three.
• Forgetting embedded software in machinery and appliances. Time-attendance terminals, CNC machines, medical devices and camera recorders often run very old Windows Embedded or Linux builds that never appear on IT's inventory.
• Looking only at the operating system and ignoring the application tier. Upgrading Windows Server while leaving an old SQL Server or runtime in place leaves the risk untouched. A layer-by-layer sweep pairs well with an [internal software audit checklist](/en/blog-audit-phan-mem-checklist).

6. How Dzo.software helps

Dzo.software works with Vietnamese businesses at the three bottlenecks of the EOL problem: knowing what you run, knowing which dates are coming, and buying the right thing with valid invoicing.

In practice that means building a software inventory with an EOS date on every row; setting up a lifecycle calendar with T-18/T-6 alerts; costing all three options (upgrade / ESU / cloud) against your real numbers; and supplying genuine licences with Vietnamese e-VAT invoices, VND payment and Vietnamese-language support. We do not default to selling a full upgrade programme — the cheapest option that actually closes the risk is the right option.

Disclaimer: this article is for general reference, compiled from Vietnamese legal texts and official vendor documentation as at 27 July 2026. It is not legal advice. Businesses should consult a lawyer or the competent authority for their specific situation, and should always re-check dates on the vendor's official lifecycle page, since vendors do adjust them.

Frequently asked questions

Can we be fined for using software that is out of support?

Using out-of-support software is not itself a sanctioned act if you hold a valid licence. Legal exposure arises indirectly in two ways: (1) failing to show you applied "management and technical measures… to prevent and combat risks" under Article 23 of Law 86/2015 during an inspection or after an incident; and (2) drifting into copyright infringement by reinstalling from unofficial sources once the official download channel has closed.

We bought perpetual licences — are they still valid after end of support?

Yes. A perpetual licence does not lapse when the product leaves support. What lapses is security patching, technical support and certification against newer products. The two are entirely separate.

Does buying ESU include technical support?

No. Microsoft answers directly: *"No, technical support isn't included in the ESU program"*. ESU covers critical and important security updates plus support for ESU activation and installation itself. Technical support for the operating system requires a separate active support plan.

SQL Server 2016 just expired on 14 July 2026 — how much time do we have?

Per Microsoft's lifecycle page, ESU Year 1 for SQL Server 2016 runs 15 July 2026 to 13 July 2027, Year 2 from 14 July 2027 to 18 July 2028, and Year 3 from 19 July 2028 to 17 July 2029. That is the absolute ceiling; after the final date no security updates are available in any form.

Where should we start if we have nothing today?

Start with a single spreadsheet holding five columns: product name, exact version, install count, Extended Support end date (from the vendor page), and exposure level. Simply filling that table usually surfaces two or three systems already past EOS that nobody had flagged. Budget conversations come after that.