SQL Server 2016 Support Has Ended: What Now?

Microsoft SQL Server 2016 reached its end of extended support on 14 July 2026. From that date, Microsoft no longer provides security patches, bug fixes, or technical assistance for the product. If your business runs SQL Server 2016, you are now operating a database that will never receive another security update — meaning any vulnerability discovered from this point forward will remain permanently unpatched.

Many business owners are surprised to find out they are running SQL Server at all. It is not always a piece of software you installed deliberately — it often arrives quietly in the background when another application is set up years earlier, and then runs without ever announcing itself. If your business uses accounting software, a CRM, an ERP system, or any custom line-of-business application installed in the last decade, there is a reasonable chance SQL Server is underneath it somewhere.

What exactly ended on 14 July?

SQL Server goes through two support phases: mainstream support (active development and feature updates) and extended support (security patches only). Mainstream support for SQL Server 2016 ended back in July 2021. What ended on 14 July 2026 was extended support — the last remaining safety net. With both phases now closed, the software is completely unsupported.

Running an unsupported database is not just a technical inconvenience. It creates real risks for your business:

• Security exposure. New vulnerabilities will not be patched. Attackers actively scan for and target end-of-life database versions, knowing no fix is coming.
• Compliance risk. UK GDPR and ISO 27001 both require that systems processing personal data be kept secure and maintained. Running unsupported software undermines both — and could affect your ability to hold or renew certification.
• Application compatibility. Future versions of connected software — operating systems, middleware, third-party tools — may drop compatibility with SQL Server 2016, causing unexpected failures down the line.

Your three options

Microsoft has confirmed three paths forward for organisations still running SQL Server 2016.

1. Upgrade to SQL Server 2022 or 2025. This keeps your databases on-premises (or in a hybrid environment) and gives you a fully supported, actively maintained platform. Microsoft provides the Azure Database Migration Service to help assess compatibility between your existing databases and a newer version before you begin. Depending on the complexity of your environment, a migration can take anywhere from a few weeks to several months.

2. Move to Azure SQL. This is Microsoft’s cloud-hosted database service. It removes the need to manage the underlying server yourself, handles patching automatically, and scales with your business. If you are already using Microsoft 365 or other cloud services, this is often a natural next step — and it can reduce your on-premises server footprint significantly. Our cloud systems team can help you assess whether Azure SQL is the right fit.

3. Extended Security Updates (ESU) as a bridge. Microsoft offers paid security-only patches for SQL Server 2016 until July 2029. This can buy time while you plan a longer migration. However, ESU is explicitly a temporary measure — it does not restore full product support, does not fix general bugs, and does not turn SQL Server 2016 into a supported product. It is a bridge, not a destination.

The important point to understand is that the July 2029 ESU deadline is a hard stop, not a breathing space to be ignored. If you activate ESU, you still need a migration plan in place within the next two to three years.

What to do now

The first step is finding out whether you are actually running SQL Server 2016 — and if so, which applications depend on it. A server estate audit will reveal what versions are in use and map the business applications that sit on top of them.

From there:

• Identify which applications use SQL Server 2016 and whether they support a newer version
• Decide whether to upgrade on-premises or move to a cloud-hosted database
• Plan the migration with adequate lead time — six to nine months is realistic for most small businesses; more complex environments may need longer
• If migration cannot begin immediately, activate Extended Security Updates as a temporary safety net — but treat this as borrowing time, not solving the problem
• Ensure your backup and disaster recovery processes cover your SQL Server databases in the interim

How System Force IT can help

We carry out server estate reviews as part of our managed IT services, and we regularly help businesses plan and execute database migrations. Whether you need a quick audit to find out whether SQL Server 2016 is in your environment, a full migration plan, or help setting up Extended Security Updates while a longer project takes shape, we can manage the whole process for you.

Running unsupported software is one of the most common findings in Cyber Essentials assessments, and it can affect your position under ISO 27001. Resolving this protects both your data and your compliance posture. You can read more about how we approach IT security and accreditation on our website.

If you are not sure whether this affects your business, the simplest thing to do is ask. Get in touch with our team and we will check your environment and let you know exactly where you stand.