BSA | The Software Alliance investigates thousands of companies each year for software copyright infringement. For small and mid-size businesses, a BSA letter can be alarming — but it is manageable with the right response strategy. This is your complete guide to understanding, responding to, and resolving a BSA investigation.
BSA | The Software Alliance (commonly still referred to by its original name, the Business Software Alliance) is a non-profit trade association that advocates for the global software industry. Its member companies include Adobe, Autodesk, Bentley Systems, CNC/Mastercam, Microsoft, Salesforce, Siemens, Trimble, and numerous other major software publishers. BSA's enforcement programme investigates organisations suspected of using unlicensed or under-licensed software on behalf of these members.
BSA operates one of the largest software copyright enforcement programmes in the world, with offices and legal teams in over 60 countries. In the United States, BSA typically pursues claims under the Copyright Act, which provides for statutory damages of $750 to $30,000 per work infringed (or up to $150,000 per work for wilful infringement). This is separate from the vendor-initiated licence compliance audits covered in the broader software audit defense guide — BSA investigations carry specific legal dimensions that require immediate legal counsel involvement.
Unlike a vendor-initiated licence true-up, a BSA investigation is a copyright enforcement action. The moment you receive a BSA letter, you should engage legal counsel with intellectual property experience before taking any other action. Do not respond directly to BSA, do not conduct internal software audits that could be used against you, and do not make any admissions in writing or verbally until your legal team is engaged.
Understanding why BSA targets specific organisations helps both in responding to a current investigation and in implementing preventive measures. The vast majority of BSA investigations are triggered by one of the following:
| Trigger | Details | Prevalence |
|---|---|---|
| Employee / ex-employee tip | BSA operates a confidential reporting programme (bsa.org) offering rewards for verified reports of unlicensed software. Disgruntled or departing employees are the primary source of reports. | ~80% of cases |
| Partner / reseller referral | Software resellers or channel partners occasionally report customers suspected of using unlicensed software, particularly when losing a deal to a competitor believed to have lower cost bases due to under-licensing. | Moderate |
| Vendor telemetry | Some BSA member software products include usage telemetry that can identify installations not linked to valid licence keys. This data is shared with BSA for enforcement purposes. | Increasing |
| Online activity | BSA monitors online marketplaces, job postings (which may reference specific software), and social media for evidence of unlicensed use at scale. | Lower |
| Targeted campaigns | BSA periodically conducts enforcement campaigns targeting specific industries (construction, architecture, engineering, manufacturing) where piracy rates are historically high. | Periodic |
BSA investigations follow a relatively predictable pattern, giving you time to prepare and respond strategically at each stage.
BSA sends an initial demand letter by post (sometimes accompanied by an email) asserting that the company may be using unlicensed software. The letter typically offers a "self-audit" option: conduct your own review, report the results, and BSA will offer a settlement. The letter usually sets a 30-day response deadline. Do not respond or conduct any self-audit without legal counsel.
If the initial letter goes unanswered, BSA sends escalating correspondence, sometimes invoking the prospect of litigation. A response through legal counsel acknowledging receipt and requesting additional time is appropriate at this stage. It demonstrates good faith and buys time to prepare a proper internal assessment under privilege.
BSA will typically request a software audit — either a self-assessment using a BSA-provided template, or a third-party audit conducted by a BSA-approved auditor. Your legal counsel should negotiate the scope, methodology, and confidentiality terms of any review process before you participate. The scope should be limited to BSA member software, not all software on your systems.
Once the scope of any compliance gap is established, BSA presents a settlement demand. This typically includes the cost of licences for any unlicensed software (at retail pricing) plus a penalty multiplier. Settlement negotiations occur between your legal counsel and BSA's legal team. The multiplier is negotiable, particularly for companies that can demonstrate good-faith compliance efforts.
The majority of BSA investigations settle before any court proceedings. Understanding the settlement economics helps you evaluate any offer from a position of knowledge rather than fear.
BSA's initial demand is typically calculated as the retail purchase price of all identified unlicensed copies, multiplied by a factor of 2–5× to account for the copyright infringement element. This initial demand is a negotiating position, not a fixed liability. Key factors that affect the final settlement include:
BSA cannot search your premises, access your systems, or compel a self-audit without your consent or a court order. The demand letter creates a legal threat, not an immediate legal obligation to open your doors. Your obligation is to respond through counsel. A structured, good-faith response buys time to prepare and typically resolves the matter more favourably than either ignoring BSA or immediately providing full access to your systems.
The following response strategy is appropriate for most SMBs receiving an initial BSA demand letter. Note that this is general guidance — your specific situation should be reviewed by qualified legal counsel with IP enforcement experience.
The most effective response to BSA risk is not receiving a letter in the first place. A basic software asset management (SAM) programme protects you from BSA investigations and from vendor-initiated audits simultaneously. Key elements include maintaining a software inventory in a centralised asset register, requiring purchase authorisation for all software installations, conducting annual licence reconciliations, and implementing technical controls (such as software deployment tools) that prevent unauthorised software installation on company devices.
For most SMBs, a lightweight SAM programme using tools like Microsoft's Intune (for Windows estates), JAMF (for Mac estates), or a dedicated SAM tool can provide adequate visibility at modest cost. The investment is trivially small compared to any BSA settlement. The software audit defense buyer's guide covers SAM programme design in the broader context of audit risk management.
Don't respond alone. Our network of audit defense specialists includes firms with specific BSA investigation experience who can guide your response, protect your interests, and negotiate a favourable resolution.
Get practical guidance on audit defense, licence compliance, and vendor negotiations delivered to your inbox.