The verdict in three sentences
Serious application maintenance costs, as a 2026 order of magnitude, 15 to 20% of the build cost per year, meaning 900 to 4,000 EUR a month excluding VAT for a mid-size Amsterdam company. Price matters less than three clauses: a 4-hour SLA on blocking incidents, penalties of 1 to 5% of the monthly fee, and a reversibility clause guaranteeing you get the code and documentation back. A contract that measures nothing protects nothing.
What modern maintenance covers
The CIO of a mid-size logistics company near Amsterdam must renegotiate maintenance for a planning application delivered in 2023. The current contract boils down to « best-effort support » billed on time spent. The result: fixes that take 3 days, dependencies never updated and a Node.js version past end of life.
A well-built contract separates three kinds of work: corrective (bugs), preventive (security updates, version upgrades, tested backups) and evolutive (small improvements within an included number of days). It is steered with monthly metrics and a quarterly review.
| Maintenance plan | Included scope | 2026 monthly fee (excl. VAT) | For a build budget of |
|---|---|---|---|
| Essential | Corrective, monthly security, backups | 900 to 1,400 EUR | 55,000 to 90,000 EUR |
| Standard | Essential plus 2 evolutive days a month | 1,700 to 2,500 EUR | 100,000 to 160,000 EUR |
| Critical | Standard plus 24/7 on-call, 4 evolutive days | 2,800 to 4,000 EUR | 180,000 to 280,000 EUR |
| Time and materials | No commitment | 750 to 1,000 EUR per day | Not advised for critical apps |
| Takeover audit (new supplier) | Code, technical debt, documentation | 3,500 to 9,000 EUR one-off | All budgets |
The SLAs to demand
The SLA must be quantified per severity level, with a response time and a resolution or workaround time. Business hours must be defined (for example 8:00 to 19:00 Monday to Friday).
| Severity | Definition | Response | Workaround | Penalty if missed |
|---|---|---|---|---|
| Blocking | App down or operations stopped | 30 min | 4 h | 5% of monthly fee |
| Major | Key feature degraded, manual workaround possible | 2 h | 1 business day | 3% |
| Minor | Annoyance with no business impact | 1 business day | 10 business days | 1% |
| Critical security (CVE) | Published exploitable flaw | 4 h | 48 h | 5% |
| Availability | Excluding planned maintenance | Monthly measure | 99.5% minimum | 2% per missing 0.1 point |
Cap cumulative penalties at around 15 to 20% of the monthly fee: beyond that, no serious supplier will sign, and the goal is to align incentives, not to fund the application through penalties.
Clauses CIOs forget
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
- Reversibility: handover of source code, deployment scripts, credentials and up-to-date documentation within 30 days, with 5 to 10 days of successor support included.
- Git repository ownership: the repository belongs to your organization; the supplier is invited to it.
- Monthly security updates: dependencies, framework, OS, with a report.
- Rollover of unused days: limited to one quarter, to avoid paying for nothing.
- Price revision: indexed on the Dutch CBS services index, capped at 3% a year.
Mini case study
Pieter, CIO of a 320-employee company near Amsterdam, currently pays time and materials: 26 days in 2025 at 900 EUR, 23,400 EUR, with 4 planning outages longer than a day. Each day of outage costs about 10,000 EUR in delays and overtime, 40,000 EUR for the year. He switches to a Standard plan at 2,100 EUR a month, 25,200 EUR a year, with a 4-hour SLA. If outages drop to 1 a year, he saves about 30,000 EUR for 1,800 EUR more.
FAQ
Isn't 15 to 20% a year too much? It is the observed range for a properly maintained critical application. Below 10%, security updates are usually sacrificed.
Can we change supplier mid-contract? Yes if reversibility is written in. Budget a takeover audit of 3,500 to 9,000 EUR and 1 to 2 months of transition.
Do we need 24/7 on-call? Only if the app is used at night or on weekends, for example in shift-based operations. On-call usually adds 700 to 1,400 EUR a month.
How do we verify SLA compliance? Require a timestamped ticketing tool and a monthly report. Penalties are calculated from that data, not from statements.
What commitment length? One year, renewable, with 3 months' notice is the most common balance. Beyond 3 years, negotiate a 5 to 10% discount.
Let's scope your project. Send us your current contract and application architecture and we will propose a takeover audit, a priced maintenance plan and a measurable SLA. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
