Received a BSA Letter? What to Do and Not Do

A letter from the Business Software Alliance is best understood by what it is: an invitation to report yourself, neatly wrapped. It says your company may be using software without a valid licence, asks you to cooperate with a voluntary audit, and lets a threat of damages hang over the page. The most important decision you make is in the first few days, and it is nearly always the same: do not answer straight away.

Below is what the BSA actually is, what it may and may not do, how a claim is built, and how to respond without assembling a file against yourself. No scaremongering, just the level-headed facts, because the letter works on fright, and fright is a poor adviser in what is at heart a commercial and legal game.

What is the Business Software Alliance?

The Business Software Alliance is a private interest body acting on behalf of large software makers, among them Microsoft, Adobe and Autodesk. Its job is to trace companies using software without a valid licence and to collect a payment on those makers’ behalf.

The word to remember is “private”. The BSA is not a government agency, not an investigative service and not a court. It cannot raid your systems, impose a fine or compel you to do anything. Its letters are written to feel otherwise, with legal terms and references to large sums, and it is exactly on that feeling that many business owners slip up.

Why do you get such a letter?

Usually it begins with a tip. An angry ex-employee, an IT person who left, sometimes a competitor: someone who knows what is on the computers reports it. The BSA, or a law firm on its behalf, then sends a request to cooperate voluntarily with an audit, with questions like: which software do you use, on how many devices, and can you show the licences?

Important to grasp: a tip is not proof. Someone claiming that illegal software runs somewhere rarely has the details, and certainly not the numbers. The letter that follows sounds as if the case is already settled, but in reality it is an attempt to get the missing facts on the table, from the only party that has them: you. That explains the urgent tone, and it explains why that tone is unrelated to how strong the case actually is.

What many owners do not realise is that the word “voluntary” is meant literally. You are not obliged to give that information. And cooperating is not neutral, because the answers you send are precisely the evidence a claim is later built on.

Do I have to cooperate with the audit?

Not without advice first. This is where it most often goes wrong: a company takes fright, wants to show it has nothing to hide, and sends off an overview of all its software unprompted. In doing so you hand over the very file you should be defending against.

The sensible first step is therefore not to respond on the substance, but to put the letter to someone who has seen this before, an IT lawyer or a solicitor experienced in software licensing. They know which reply limits your liability and which enlarges it. A correct, formally drafted answer can settle a matter before it escalates, while an impulsive email sometimes gets it truly going. That consultation costs money, but it is almost always a fraction of what an unfortunate first reply can cost you.

What the BSA may and may not do

The distinction is simpler than the tone of the letter suggests, and it pays to have it clear.

The BSA may	The BSA may not
Send a letter or email requesting an audit	Force you to cooperate without a court order
Ask questions about your software use	Enter your systems or seize documents
Propose a settlement on behalf of member makers	Impose a fine itself
Take a dispute to court	Pose as a government or enforcement body

That last row on the right matters. A private party can go to court, but then the ordinary rules apply: you need disclose nothing until a court has ordered it. The pressure in the letter is real, but it is not a legal obligation. That difference between insistence and compulsion is exactly what the letter would rather blur, and restoring it is the first step that brings you calm.

Is a BSA letter the same as a summons?

No, and that difference is where the first relief sits. A summons comes from a court and obliges you to appear or respond within a deadline. A BSA letter comes from a private organisation or its lawyer and is, however formal it looks, a request. There is no court order behind it.

That does not mean you can bin it and forget it. If a company does not respond at all, the BSA may decide to put the matter to a court after all, and then you want to have demonstrably acted properly. The right posture is thus neither to ignore nor to confess everything at once, but to respond calmly and with advice. See the letter as the start of a conversation you help steer, not a verdict already fixed.

How a claim is built

Understanding how the amount comes about takes some of the fright away and explains why cooperating voluntarily works out so badly.

It helps to picture the two extremes. A sole trader with one unlicensed program on one laptop is a small, easily corrected matter. A fifty-seat office running the same unlicensed suite on every machine is a different order of magnitude, because the same per-seat figure is multiplied fifty times over. Nothing about that maths is exotic; it simply rewards knowing your own numbers before anyone else does.

The method is essentially always the same: the retail value of the software involved, multiplied by the number of installations for which there is no valid licence, plus a mark-up as compensation. Two things stand out. First, the amount scales with the number of machines, so a handful of workstations is a very different thing from a whole office. Second, and this is the crux: the number of installations and the titles used are precisely the data the BSA itself does not have. As long as you do not supply them, the other side has to make them plausible, which is a good deal harder than copying a list you sent voluntarily.

That is why restraint is not a game but common sense. You conceal nothing you are obliged to disclose; you simply do not hand over the building blocks of a claim unasked.

And if something really is not in order?

It happens, and more often by accident than on purpose: a trial version that stayed in business use, a key put on more machines than the licence allows, software that came along with a departed employee. That does not make you a fraudster, but it does mean you must be careful now. In most small companies such a shortfall was never a deliberate choice but a sum of small slips no one ever tidied up.

Even then, admit nothing without legal advice. What you can already do, outside the communication with the BSA, is put your own house in order: take stock of what runs, and where needed buy valid licences so your situation is correct. Buying legally is, apart from any letter, the best protection, and it is a good deal cheaper than a settlement.

The best defence is a shoebox of invoices

Almost all the stress around a BSA letter comes down to one question: can you show your software is legal? In an audit no one asks for the codes themselves, they ask for proof. And proof is paperwork.

So record, per purchase, what you buy, from whom, and what you paid. Keep the invoices in the company’s name, and for second hand licences the confirmation that the previous owner gave up their copy. That chain is exactly what a serious seller supplies, and exactly what an audit wants to see. Why that provenance matters so much we set out in is second hand software legal.

A company that buys its licences properly and keeps the papers has little to fear from a BSA letter: after taking advice it sends a neatly supported answer and that is usually the end of it. The misery arises with companies that do not know what runs and try to close that gap by cooperating. Prevention here is literally cheaper than cure. There is a further reason that goes beyond fending off one letter: software makers and those acting for them target resale and businesses because that is where the money is, and their policy is stricter than the law requires. A company that can show where every licence came from is therefore not only stronger in an audit, but also less dependent on the discretion with which such parties can act.

What a good internal inventory looks like

Letter aside, this is something every company is better off doing sooner than later, because it removes the uncertainty that makes an audit frightening. You need no expensive software for it; a simple overview will do.

Go workstation by workstation through which paid programs are on each, and set beside it which licence covers it and where the proof of purchase is. Wherever you find no proof, your action list forms itself. Usually it turns out better than feared, with the gaps sitting in a few predictable places: an old PC someone took over, a trial that lingered, or a program put on more machines than the licence covers.

Keep that overview internal and do not send it with a reply to the BSA unless your lawyer advises it. It is your compass, not their exhibit. Its very existence keeps you calm, because you then know exactly where you stand, and that is the position from which you negotiate best.

The four steps when the letter arrives

Short and concrete, so you know what to do today and what to leave. Print this out and lay it by the letter if you like, because it is in the first days after arrival that the temptation to do something quickly is greatest.

1. Do not respond on the substance at once. Acknowledging receipt is fine, no more.
2. Put the letter to an IT lawyer or a solicitor experienced in software licensing.
3. Map internally what runs and which licences you hold, for yourself, not to send off.
4. Fix real shortfalls by buying legally after all, and keep the proof.

That is the whole of it: do not hand over a file in a panic, do make your own situation correct. Anyone buying software for a business would do well to understand why buying legally returns more than it costs, letter or no letter; that is in why businesses choose legal software.