The Clock is Already Running on Your ERP

Most business owners with a legacy ERP system know, in the back of their minds, that they’ll have to deal with it eventually. The problem is that ‘eventually’ has a specific date, and for a large portion of US SMBs, it’s closer than they realize.

This isn’t a vague warning about modernization. It’s a calendar problem with real consequences.

The Dynamics GP Timeline Is Confirmed and Non-Negotiable

If you’re running Microsoft Dynamics GP, one of the most widely deployed ERP systems in the US SMB market, here are the dates Microsoft has confirmed and will not change:

End-of-life dates for the most common legacy Microsoft ERP platforms and the SQL Server and Windows Server versions they run on. The window to plan a migration is now.

Every vulnerability discovered after April 2031 remains permanently open. There’s no patch coming. No exception. No extension.

Mid-market ERP migrations take 12 to 24 months from project initiation to go-live, and that’s for well-run projects. If you want vendor support during your migration and the ability to course-correct when challenges arise, the window to start planning is now, not 2029.

The Hidden Risk GP Customers Miss

Most Dynamics GP customers think they have until 2031. They don’t.

SQL Server 2016, the database version most commonly paired with GP, reached end of security support on July 14, 2026. That deadline is already behind you. Windows Server 2016, its usual companion, follows on January 12, 2027, now only months away. Microsoft sells paid Extended Security Updates for SQL Server 2016 through July 2029, but that is an expensive stopgap that buys time, not a fix.

That means organizations running the most common Dynamics GP configuration are already living through a compound stack expiration, even though the ERP application itself remains supported until 2031. As of mid-2026 the database layer has already lost security support and the operating system layer is next. You are running a supported ERP on top of an unsupported database and a soon-to-be-unsupported operating system, with no patches available at any layer below the application.

Dynamics NAV: Even Less Runway Than GP

If you are running Microsoft Dynamics NAV (formerly Navision), the timeline is tighter still. Unlike GP, NAV follows Microsoft’s Fixed Lifecycle Policy, and nearly every version has already reached the end of the road. NAV 2016 and earlier lost extended support as of April 2026. NAV 2017 loses it on January 11, 2027. NAV 2018, the final release before the product became Dynamics 365 Business Central, reaches end of support on January 11, 2028.

There is no 2029 or 2031 backstop for NAV the way there is for GP. Once your version’s date passes, Microsoft issues no further security patches, bug fixes, or compliance updates. And because NAV is typically deployed on the same SQL Server and Windows Server versions as GP, NAV customers face the identical compound-stack exposure: an unsupported application sitting on an unsupported database and operating system, with no vendor remediation available at any layer.

The Broader Picture: 7 of 11 Major SMB Platforms Are Already Expired

The matrix below illustrates how risk compounds across the full technology stack. When the ERP application layer, the Windows Server version it requires, and the SQL Server version it runs on are all assessed together, 7 of the 11 most widely deployed legacy SMB ERP platforms currently have a fully expired security stack.

Sources: Microsoft Lifecycle Policy, end of life date, vendor documentation. Assessed August 2026.

What About Sage and QuickBooks?

Sage 100 and Sage 300 remain under active vendor support, but organizations running versions from 2020 and earlier have already lost support. Sage applies a rolling three-year support window. If you haven’t kept up, your environment may be in the same unpatched position as a formally end-of-life platform.

QuickBooks Enterprise was not built to be an ERP. If you’re running $20M or more in revenue through it, held together with spreadsheets, workarounds, and third-party add-ons, you’re operating a platform that doesn’t meet the security, audit trail, or access control standards that cyber insurance underwriters and larger business partners now expect. That gap is widening every year.

The Insurance Problem

21% of cyber insurance claims were denied or partially denied in 2025, up from 15% in 2023.

This is where the deadline risk becomes a business risk, not just an IT risk. The single most common reason for denial is failure to maintain the security controls the policyholder said they had, which accounts for roughly a third of denied claims, and more than 80% of denied claims involve organizations that lacked multi-factor authentication. Running unpatched legacy ERP without a documented remediation plan is exactly the kind of control failure that voids a claim at the worst possible moment.

For a business that can’t absorb a $3 million loss out of pocket, that’s not a technicality. It’s an existential exposure.

A Planned Migration Beats a Forced One Every Time

The deadlines on your ERP platform are not abstract risk factors. They are dates on a calendar. April 2031 for GP security patches. July 2026 for SQL Server 2016, already behind us. January 2027 for Windows Server 2016. Each one represents a point at which your exposure grows and your options narrow.

Starting the conversation now doesn’t commit you to anything. It gives you the one thing a hard deadline will eventually take away: the ability to choose your own timing.

START WITH ONE QUESTION

When does your current ERP, and the infrastructure it runs on, stop receiving security patches? We offer a no-obligation environment assessment to help you answer that honestly. No pitch. Just clarity.

Don’t put this off more than you need to, contact us at: info@customsystems.com