Got cease and desist from software vendor claiming we over-deployed licenses - what's my exposure?

I'm the IT director at a 200-person company. We use a specialized CAD software (won't name the vendor). We purchased 50 licenses 3 years ago for $3,000 per license ($150K total).

Vendor just contacted us saying they did a "compliance audit" and found we have 78 active installations. They're demanding we either:

Here's the thing - we definitely have 78 installs, but most are on laptops that people barely use. Maybe 50-55 concurrent users max at any given time. Does that matter? What's our legal exposure here?

First, don't panic. Software licensing disputes are very common and usually settle. But you need to act quickly. Key questions:

• What does your license agreement actually say? "Named user" vs. "concurrent user" vs. "device" licensing?
• How did they discover the 78 installations? Did you consent to an audit?
• Do you have documentation of your 50 license purchase and any communications about deployment?
• Did your license agreement include audit rights?

The concurrent vs. installed users distinction MIGHT matter depending on your license terms, but if the agreement says "50 installations" then concurrent usage is irrelevant.

I pulled our license agreement. It says "Customer may install the Software on up to fifty (50) devices." No mention of concurrent vs. named users.

They discovered it because the software "phones home" for updates and they track activation keys. We didn't consent to an audit - they just emailed us the results of what they found via their telemetry.

The agreement does say they can audit us with 30 days notice, and we have to comply or they can terminate the license.

The agreement does have a fee-shifting clause - "prevailing party in any dispute shall be entitled to reasonable attorney fees."

I did find one thing that might help us - in 2023, our account manager sent an email saying "you can install on as many devices as needed as long as you stay under 50 concurrent users." We definitely have that email.

Does that verbal/email assurance override the written license agreement?

That email is HUGE. It might not override the written agreement (most license agreements have "entire agreement" clauses that prevent oral modifications), but it's strong evidence of:

• Waiver: Vendor's conduct indicated they wouldn't enforce the 50-device limit
• Estoppel: You relied on their representation to your detriment
• Good faith: You weren't willfully infringing - you had reason to believe your deployment was compliant

This completely changes your negotiating position. They can't claim willful infringement if their own rep gave you permission. And it shows you were trying to comply.

Was the account manager authorized to make licensing decisions? If so, this is even stronger.

This is incredibly helpful. A few follow-ups:

• Should I respond directly to the vendor or hire an attorney first?
• The 10-day deadline is tomorrow - what happens if we miss it?
• Can I uninstall the software now or does that look like we're destroying evidence?