Windows 10 in Monaco: October Deadline

Windows 10 stopped receiving free security updates on 14 October 2025. Almost a year later, plenty of Monaco offices, boutiques, agencies and reception desks still run it, usually on machines that work perfectly well. The next decision point is weeks away: the first year of Microsoft's paid Extended Security Updates (ESU) programme for organisations ends in mid-October 2026, and year two starts on 14 October 2026 at roughly double the price.

This is not a switch-off. Windows 10 PCs will work on 15 October exactly as they did on 13 October. The issue is quieter and, for a business in the Principality, more consequential: every month without patches widens the gap between what you can defend and what you are legally expected to defend.

Where things stand in September 2026

Microsoft's published terms changed over the summer, so it is worth being precise:

• For organisations, ESU is a paid, per-device, annual subscription bought through volume licensing. Year one cost 61 USD per device. The price doubles each consecutive year, for a maximum of three years — so year two (from 14 October 2026) is about 122 USD per device and year three about 244 USD. ESU is cumulative: join in year two and you pay for year one as well. Devices must run Windows 10 version 22H2.
• For individuals (Windows 10 Home, personal use), Microsoft extended consumer ESU in July 2026 until 12 October 2027: free if you sync your PC settings to a Microsoft account, or for Microsoft Rewards points or a one-off 30 USD payment. Microsoft says options "may vary by region", citing the European Economic Area. Monaco is not an EU or EEA member, so check what your own device offers rather than assuming French or EU terms apply.
• ESU covers security updates only. No new features, no non-security fixes, no general technical support. It is a bridge, not a destination. The consumer extension is a trap for small businesses: a sole trader's laptop used for invoicing and client files is not "personal use", and the free route is not designed for company devices.

Why this is a compliance question in Monaco

Law No. 1.565 of 3 December 2024 requires organisations that process personal data in Monaco to implement appropriate technical and organisational security measures and, under its accountability principle, to be able to demonstrate that they have done so. The APDP showed on 10 September 2026 that it will publish formal notices against named organisations.

An operating system without security patches is very hard to explain away after an incident. If a client database, a hotel's booking records or a real-estate agency's mandate files are taken from an unpatched Windows 10 machine, the question "what measures did you have in place?" has an uncomfortable answer, and Monaco's breach notification rules put a clock on the conversation. Our guide to APDP data protection compliance covers the wider picture; the narrower point is that unpatched endpoints are a security measure you have chosen not to take.

The timing helps: the Assises de la cybersécurité run in Monaco from 7 to 10 October, and Extended Monaco Entreprises hosts a cybersecurity session on 20 October.

Step one: know what you actually have

Most Monaco SMEs cannot say from memory how many Windows 10 devices they own. List them, including the machines people forget: the PC behind the reception desk or the boutique till, the accountant's laptop, the back-office machine running the stock or property software, and every device used to log in to your website admin, CRM, e-commerce back end or bank.

For each one, note the Windows version (22H2 or not), whether it meets Windows 11's hardware requirements (TPM 2.0, a supported processor, Secure Boot), and what it is used for. The last column drives the decision.

Step two: choose per device, not per company

There are five realistic outcomes for each machine:

1. Upgrade in place to Windows 11. Free if the hardware is eligible, and the right choice for any device that touches customer data.
2. Replace the hardware. For machines that fail the Windows 11 check, a new PC is usually cheaper over three years than three escalating ESU payments plus the risk.
3. Buy ESU year two as a deliberate bridge. Sensible when a device runs a business-critical application not yet certified on Windows 11 and you have a dated migration plan. Not sensible as a way to avoid deciding.
4. Move the workload to a Cloud PC. For roles that only need a browser and office tools, a Windows 365 Cloud PC turns an old device into a thin client — and Windows 10 endpoints connecting to one are entitled to ESU while the subscription is active. Check your data-hosting obligations before moving regulated data.
5. Isolate and retire. A machine that only drives a display or a legacy printer can be taken off the internet and removed from shared drives. Nothing unpatched should hold credentials or personal data.

Write the decision next to each line of the inventory; that document is itself part of the "demonstrable" security posture Law 1.565 asks for.

The web angle most people miss

Your website, online shop and marketing tools are only as secure as the devices that log in to them. Credential theft through an infected browser on an unpatched PC is one of the most common ways a site gets defaced, a Shopify store acquires a rogue payment gateway, or a Google Ads account starts spending someone else's budget. If your team administers a site we look after under a website maintenance plan, the endpoint policy on your side matters as much as the patching on ours.

It is also the moment to clean up access: remove former staff, enforce two-factor authentication on the CMS and e-commerce back office, and stop sharing one admin login across the team.

A four-week plan before 14 October

• Week one: inventory every Windows device and flag anything that holds or accesses personal data.
• Week two: run the Windows 11 compatibility check and upgrade the machines that pass, starting with those that access customer data or your website admin.
• Week three: for the rest, decide between replacement, ESU year two, a Cloud PC or isolation — and order hardware now, because Q4 lead times are not short.
• Week four: tidy access to your web and cloud tools, switch on two-factor authentication, and file the inventory with your data protection documentation.

If you are unsure how ESU licensing, cloud hosting or data-location rules apply to you, ask your IT provider or a qualified adviser; this article reflects Microsoft's published terms as of September 2026, which may change again. The underlying decision needs no consultant, though: a Monaco business still running Windows 10 on machines that hold client data has, by mid-October, either a plan or a problem.

BSS helps Monaco businesses keep their websites, e-commerce platforms and marketing systems secure and well maintained, working alongside your IT provider rather than instead of them. For a second pair of eyes on the digital side of this transition, get in touch.