The verdict in three sentences
Serious application maintenance costs 15 to 25 % of the initial development cost every year, on-call coverage excluded. For a critical application, what really gets negotiated is the response times (1 to 8 business hours depending on severity) and the reversibility clause, far more than the monthly fee. In Berlin in 2026, a CIO who signs a maintenance contract without a measurable SLA or a framework upgrade plan is buying a promise, not a service.
What application maintenance covers and what it costs
Maintenance contracts group three families of work: corrective maintenance (fixing defects), preventive maintenance (updating dependencies, frameworks and certificates) and evolutive maintenance (small functional changes). Serious contracts separate the three, because only corrective work is truly predictable.
| Maintenance tier (2026 ballpark) | Annual budget as % of build cost | For an app built for 120,000 EUR | Typical scope |
|---|---|---|---|
| Essential | 10 to 15 % | 12,000 to 18,000 EUR | Corrective in business hours, security updates |
| Standard | 15 to 20 % | 18,000 to 24,000 EUR | Corrective + preventive, 2 upgrades per year |
| Enhanced | 20 to 25 % | 24,000 to 30,000 EUR | Standard + evolutive (5 to 10 d/year), monitoring |
| Critical | 25 % and above | 30,000 EUR and above | Enhanced + 24/7 on-call, tested recovery plan |
| Out-of-hours on-call | Extra | 500 to 1,500 EUR per month | Evenings, weekends, public holidays |
The real five-year cost of an application is therefore often close to twice its build cost. A CIO who ignores this at budget time ends up, from year two, choosing between security and new features.
SLA: the numbers to put in writing
An SLA (service level agreement) only has value if it distinguishes severity levels and includes penalties. A "responsiveness commitment" without numbers does not protect you.
| Severity | Definition | Response | Workaround | Permanent fix |
|---|---|---|---|---|
| P1 blocking | App down or data corrupted | 1 business hour (30 min with on-call) | 4 h | 2 business days |
| P2 major | Key feature unusable, no workaround | 2 to 4 business hours | 1 day | 5 business days |
| P3 minor | Inconvenience with a workaround | 8 business hours | Not required | Next release |
| P4 cosmetic | Label, display | 2 business days | Not required | Next release |
| Monthly availability | Excluding planned maintenance | 99.5 % to 99.9 % | Not applicable | Not applicable |
| Usual penalties | Per P1 or P2 breach | 2 to 5 % of the monthly fee | Cap 15 to 20 % | Not applicable |
Watch the difference between response (someone has read the ticket) and resolution. Weak contracts only commit to the first. For a critical application, require at least a workaround time on P1 and P2 incidents.
Upgrades and reversibility: the two blind spots
Web frameworks have short support cycles: a major Node.js release is maintained for about 30 months, a PHP version for about 3 years, and front-end libraries move even faster. A maintenance contract limited to bug fixing lets the application age until a vulnerability forces an emergency rebuild.
| Contract item | Recommended 2026 practice | Risk if missing |
|---|---|---|
| Version upgrades | 1 to 2 per year included, planned 3 months ahead | Technical debt, forced rebuild at 40 to 60 % of build cost |
| Security watch | Critical patches applied within 72 h | Exposure to published vulnerabilities |
| Documentation | Updated with every release | Hard handover to a third party |
| Reversibility | Written plan, 1 to 3 months of handover support | Full vendor lock-in |
| Code ownership | Git repository and hosting in the client's name | Blocked in case of dispute |
| Reporting | Monthly dashboard: tickets, times, days used | No way to verify the SLA |
Reversibility is the clause everyone forgets, because contracts are signed at the start of a trusting relationship. It must cover handing over the code, access, documentation and a priced number of support days at the contract rate.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Katrin, CIO of a distribution group in Berlin (600 employees), must renew maintenance for the order management application, built for 140,000 EUR. The outgoing vendor charged 1,200 EUR per month with no written SLA. In 2025, two P1 outages each lasted a full day, with an estimated loss of 9,000 EUR in revenue per day of downtime.
She tenders for an Enhanced tier: 22 % of the build cost, or 30,800 EUR per year, plus on-call at 800 EUR per month (9,600 EUR per year), for a total of 40,400 EUR. If the 4-hour workaround target halves outage duration, she avoids about 9,000 EUR of losses over two incidents. That gain alone does not cover the extra cost over the old contract (26,000 EUR per year), but the new contract includes two upgrades per year that avoid a rebuild estimated at 60,000 EUR within three years. Over three years: 78,000 EUR of extra cost against about 87,000 EUR avoided (27,000 EUR of losses and 60,000 EUR of rebuild), so the math turns favorable.
FAQ
What annual budget should you plan for web app maintenance?
Plan 15 to 25 % of the build cost per year for a business application in production. An app built for 100,000 EUR therefore needs 15,000 to 25,000 EUR per year, on-call extra.
Is 24/7 on-call essential?
Only if out-of-hours downtime costs more than the on-call fee, about 500 to 1,500 EUR per month. For a tool used from 8 am to 7 pm on weekdays, a business-hours SLA is often enough.
What penalty should you ask for when the SLA is missed?
Common practice is 2 to 5 % of the monthly fee per P1 or P2 breach, capped at 15 to 20 %. The goal is not compensation but making SLA compliance a priority for the vendor.
Does maintenance include new features?
Not always. Standard contracts often stop at corrective and preventive work, while Enhanced tiers include 5 to 10 days of changes per year. Beyond that, changes are quoted as fixed price or at the contract day rate.
How long does a reversibility period last?
Plan 1 to 3 months of handover support, with a number of days priced in advance. Code, documentation and access must be handed over on day one of that period.
Let's scope your project. Tell us about your application, how critical it is and when it is used: we will propose a maintenance tier, an SLA with targets per severity and an annual budget. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.