Got a software license audit letter from BSA - am I screwed?

Our company (manufacturing, 45 employees) just received a letter from the Business Software Alliance demanding a full software license audit within 21 days. They claim they have "credible evidence" of unlicensed software use.

Honestly - yeah, we probably have some compliance issues. When I started as IT manager 8 months ago, software licensing was a mess. Previous IT guy just installed whatever was needed without tracking licenses. I've been trying to clean it up but haven't finished.

I'm pretty sure we have:

• 3-4 unlicensed copies of Adobe Creative Cloud
• Maybe 5-6 extra Windows Pro installs beyond our volume license
• Some AutoCAD installations that might not be properly licensed (our engineers share logins)

The letter says we have to provide a complete inventory of all software, license documentation, and proof of purchase within 21 days or they'll pursue legal action.

What should I do? Ignore it? Respond and hope for the best? Hire a lawyer immediately? How bad can this get?

$100K+ settlement?? Our CEO is going to lose his mind. We're a $3M/year revenue company, that's huge for us ngl.

Two questions:

2. If I run the audit myself and find we're missing like $15K worth of licenses, can I just go buy them now and then say we're compliant?

Former software asset manager here. For your internal audit, use tools like:

• Microsoft: MAP Toolkit (free) or License Advisor
• Adobe: Adobe License Decoder or manual Creative Cloud admin console review
• General: Lansweeper, Spiceworks, or PDQ Inventory to scan all endpoints

Document EVERYTHING:

• Every installation found
• All license certificates/purchase orders you have
• Email trails showing purchase approvals
• Credit card/invoice records from software vendors

The better documented your audit, the more credibility you have in negotiations. If you show up with a professional inventory and honest accounting, BSA is more likely to be reasonable 🤷.

Update: Talked to CEO and CFO. They're freaking out but agreed to hire an attorney. Got a referral to someone who handles these cases.

Started running inventory scans. It's looking worse than I thought:

• 7 unlicensed Adobe CC seats (we only bought 3, have 10 active)
• 12 extra Windows Pro beyond our volume agreement
• 6 AutoCAD seats vs 4 licenses
• 2 copies of some random engineering software I didn't even know we had

Rough math is like $35K in retail software cost. I'm looking at $70-100K total exposure. CEO is talking about firing the previous IT guy but he left 2 years ago so probably can't do anything.

For anyone else reading this thread in similar situation: Take software licensing seriously. The BSA is aggressive and they have the resources to pursue companies of any size.

They represent Microsoft, Adobe, Autodesk, Oracle, and dozens of other major vendors. When you see their demand letters, they're not bluffing sadly.

For DMCA takedowns: the platform has to remove the content "expeditiously" but there's no specific timeline. In practice, most platforms respond within 24-72 hours. If they don't, they lose their safe harbor protection.

Reading this six months late but thank you for posting the full breakdown. We just got our own BSA letter last week (logistics company, ~30 employees) and I felt sick to my stomach until I found this thread.

The $68.5K resolution is sobering but at least it gives me a realistic number to bring to ownership instead of just panicking. Going to start the internal inventory tomorrow and call a few attorneys.

One thing I'd add from going through this last year: the letter you get is usually a self-audit demand, not an actual on-site audit (at least at first). A lot of people read "audit" and assume people are showing up at the door. They're asking YOU to inventory and report.

That distinction matters because it means you have more control over the process than it feels like in the moment. Get counsel, slow it down, and present an organized picture rather than a chaotic data dump.

Question for anyone who's been through this: does the BSA only go after the software they have "evidence" about, or do they want a complete inventory of everything across all vendors?

Our letter specifically mentions Autodesk but the demand language asks for "all software." Trying to figure out how wide we actually have to open the door.

Does anyone know if having open-source or freeware alternatives installed alongside the paid stuff helps or hurts? We swapped a bunch of paid tools for free ones during cleanup but the old installs are technically still on some machines.

Worried that having both makes it look like we knew we were over-deployed.

I'd loop your attorney in before you touch those old installs, for the spoliation reason the lawyer above mentioned. Having a free alternative installed isn't itself a violation, but uninstalling the paid copy after a demand letter is the part that can look bad.

Document the swap with dates and approvals so there's a clean paper trail showing it was a planned migration, not a panic cover-up.

The login-sharing detail in the original post is the one that got us too. Our engineers passed around a couple of AutoCAD logins for years thinking a "seat" meant a person actively using it at that moment.

Turns out most of these licenses are per-named-user or per-device, not per-concurrent-user, unless you specifically bought a concurrent/network license. Worth checking your actual license type before you assume how many you're short. We thought we were 4 over and were actually 7 over once we understood the model.