Software License Audits in Türkiye: Criminal and Financial Risk

There is rarely a single record showing whether every piece of software on a company’s computers is actually licensed. Accounting knows how many licenses were purchased. IT knows how many copies are installed. The two numbers often drift apart quietly, one new laptop or one cloned image at a time. A software license audit is what happens when a vendor, or its authorized representative, steps into that gap and checks. In Türkiye this can start as a polite email asking for an inventory, or it can go straight to a court-ordered evidence inspection at the office. The penalty on the other end is not symbolic: under Article 71 of Türkiye’s Copyright Law for Intellectual and Artistic Works (FSEK), unlicensed software use carries one to five years in prison or a judicial fine.

How does an audit usually start?

Three paths show up most often. First, a “phone home” mechanism built into the software itself — once it connects online, it reports username, IP address, and device identifiers back to the vendor, and a license overage gets flagged automatically. Second, a tip-off: a former employee, a competitor, or a disgruntled ex-partner reports the company to the vendor or to a software industry association. Third, and rarer but heavier, ISP access logs get pulled into a case that moves straight toward a public prosecutor.

Because this is a complaint-based offense under Article 75, vendors typically open with a warning letter or a settlement offer rather than a lawsuit. The complaint is rarely withdrawn before compensation is paid.

How serious is the legal exposure?

Article	Subject	Penalty
FSEK Art. 71	Unlicensed use	1-5 years in prison or a judicial fine
FSEK Art. 72	Disabling license protection mechanisms	6 months - 2 years in prison
FSEK Art. 68	Compensation	Up to 3x the license fee
FSEK Art. 75	Prosecution requirement	Complaint-based

The numbers get more concrete once attached to a real case. If unlicensed use of a 10,000-euro engineering package is confirmed, the compensation claim can theoretically reach 30,000 euros — before legal costs and the reputational damage are even counted.

Which software actually causes the trouble?

Office suites (Microsoft 365, Google Workspace, and similar) mostly moved to cloud subscriptions, which cut this risk considerably on that front, but older on-premise installs are still common. The real exposure clusters elsewhere:

• Engineering and design software (AutoCAD, SolidWorks, and similar) — one license installed across several machines
• Server operating system CALs (client access licenses) that no longer match the actual number of users
• Endpoint security and antivirus seats exceeding what was purchased — especially after new devices get added without updating the license
• Individual design-tool subscriptions shared informally across a whole team

None of this is usually deliberate piracy. Most of it comes from license tracking quietly falling behind during a growth phase. The law does not weigh intent very heavily, though — an employer can be held liable even for an installation an employee made without permission or knowledge.

How do companies protect themselves?

The strongest defense is the one built before an audit ever arrives, not after.

1. Build an inventory (software asset management, SAM for short) that compares installed software against purchased licenses, and keep it updated on a schedule.
2. Treat license status as its own checklist item whenever a device is added or an employee leaves — this is usually the step that gets skipped.
3. Track whether free trial versions actually get removed once they expire.
4. RMM (remote monitoring and management) tools can pull an installed-software inventory automatically, so companies working with an outsourced IT provider tend to have this step largely covered without extra effort.

Frequently asked questions

If the owner didn’t know about a license violation, are they still liable? Yes. An employer can be held responsible even for an installation made without their knowledge or consent. “I didn’t know” doesn’t stop a criminal complaint — at best it becomes a point raised during settlement talks.

Do small companies get audited too, or only large ones? The trigger is usually a tip-off or phone-home data, and scale isn’t really the deciding factor there. A company running a handful of licenses can be exposed to the same risk as a much larger organization.

Does switching to open-source software remove the risk entirely? It cuts it substantially but not to zero. Open-source licenses (GPL, MIT, and similar) carry their own conditions, and commercial use that doesn’t respect those terms can create a different kind of legal exposure.

Is settlement more common than going to court? Much more common. Vendors generally prefer a settlement that includes compensation and a commitment to a licensed transition over the length of a court process.

If an audit has already happened once, does that mean it won’t happen again? It can happen again. The same vendor may request another check a few years later. An inventory that stays current avoids starting from zero each time.

If you’d like to review whether your company’s software inventory actually matches what was purchased, reach out through the contact form.