Autodesk license compliance audits

Autodesk license compliance audits require Autodesk's own paying business customers, within 15 days of an audit notice, to run an Autodesk-approved tool across every device that accesses its software & submit the results, then to buy licenses covering any shortfall the audit finds plus Autodesk's own cost of the audit. The requirement is Section 17.8 of Autodesk's General Terms, which labels a customer's failure to comply a "material breach". Attorneys who defend companies in these audits describe settlement demands "as high as $50,000 or more", trade coverage reports that EULA missteps can cost a studio "six-figure fines", and a compliance consultancy reports that Autodesk escalates to its legal department or outside lawyers when a target objects.

Background

Autodesk distributes its software under license rather than sale, so a customer never owns the copy. That rule was settled in Vernor v. Autodesk, Inc., 621 F.3d 1102 (9th Cir. 2010). Timothy Vernor bought several used, boxed copies of AutoCAD Release 14, one at a garage sale and four more from another business that had originally obtained them from Autodesk, and resold them on eBay. Autodesk filed copyright take-down notices to pull the listings, so in 2007 Vernor sued Autodesk to establish that reselling copies he had bought was lawful. A federal district court in Seattle first ruled for Vernor, but on appeal in 2010 the Ninth Circuit sided with Autodesk and reversed that decision. The court held that an Autodesk user is "a licensee rather than an owner" of the copy, so the first sale doctrine that normally lets a buyer resell what they bought (17 U.S.C. § 109(a)) does not apply. The practical result: a person who buys Autodesk software cannot legally resell it, and installing a copy without a valid license infringes Autodesk's copyright (17 U.S.C. § 117(a)(1)).

In Vernor v. Autodesk, Inc., the Ninth Circuit sided with Autodesk, ruling that its customers are licensees rather than owners of their copies and so cannot resell the software.

Autodesk has moved its customers off perpetual licenses & onto subscriptions. Its fiscal-2025 annual report ties that change to unauthorized use, which it says "negatively impacts our revenue". The filing describes moving customers "from perpetual use software licenses to a subscription-based business model".

Audit clause

Autodesk's end-user license agreement reserves a contractual right to audit a customer's use, & the mechanics have changed across contract generations. The current General Terms, last updated March 30, 2026, set out a self-audit in Section 17.8, "Verification of Compliance":

You must use an Autodesk-approved tool to gather information from all devices accessing Your Offerings and obtain any necessary access and consent from Your Authorized Users. Within 15 calendar days of audit notification, You must submit Your audit results to the notifying party. Audit results must include machine IDs, serial numbers, Autodesk IDs, NT/Windows username, device ID and other information relating to Your Offerings. If, through a Verification, Autodesk determines You are in violation of these Terms, You must immediately purchase new Offerings at least equal to the total of the value of the identified noncompliance and Autodesk's reasonable costs to complete the Verification. Failure to comply with this Section 17.8 is a material breach of these Terms.

This version puts the scan on the customer, who runs the tool & produces the machine-level data.

An earlier generation of the agreement, Autodesk's fiscal-year 2017 License and Services Agreement, put the audit in Autodesk's hands rather than the customer's and expressly allowed it to be conducted "electronic or otherwise". Section 9.7 gave Autodesk the right, on 15 days' notice, to inspect the customer's records, systems, & facilities:

As part of any such audit, Autodesk or its authorized representative will have the right, on fifteen (15) days' prior notice to Licensee, to inspect Licensee's records, systems and facilities, including machine IDs, serial numbers and related information, to verify Licensee's Installation of and Access to the Autodesk Materials.

The same clause required the licensee to provide "full cooperation" and, on a finding of noncompliance, to buy licenses to cure & "pay the reasonable costs of the audit". Autodesk shifted the audit onto the customer in a 2021 revision of its General Terms. A version archived on March 8, 2021 required the customer, on an audit request, to "provide a report to Autodesk using an Autodesk approved verification tool" within 15 days, in place of the earlier model in which Autodesk conducted the inspection itself.

Section 9.7 of Autodesk's fiscal-year 2017 License and Services Agreement gave Autodesk the right to audit a customer "electronic or otherwise" and, on a finding of noncompliance, to make the customer buy licenses and pay the costs of the audit.

Verification tool

The current General Terms name only "an Autodesk-approved tool" & do not identify a specific product. In practice, Autodesk directs audited customers to a particular scanner that named sources call by different names. The German compliance consultancy ProLicense identifies it as ScanWin & says customers are told, on short deadlines, to install it & transmit the data it collects. The defense firm Scott & Scott says Autodesk has begun to "advocate heavily for the use of its own AIA scanning tool".

Product documentation for a ScanWin scanner published by the software-asset-management vendor License Dashboard describes an agentless system that uses Microsoft Windows Management Instrumentation (WMI) to inventory Windows machines, discovers devices by Active Directory registration & by IP-address range, & requires that Windows firewalls be configured to permit WMI communication. Scott & Scott warns that the tool over-reports: its clients have found that free viewer installations are counted as product installations, so submitting raw scan output could produce "drastically over-inflated audit exposure".

Selection of audit targets

Autodesk selects audit targets using data its own products report back to it. Its analytics page states that desktop products collect the user's Autodesk ID, IP address, & product & license information, & that some of this collection is required & cannot be turned off, expressly including data used to "identify non-valid use of our offerings". Scott & Scott describes the enforcement side of that telemetry: many Autodesk products contain embedded reporting technology that updates the company on installation & usage, & its compliance teams check those deployments against a company's registered licenses. The same firm says Autodesk also tracks "cracked" serial numbers, & that entering one into an Autodesk database or online profile can itself trigger an audit.

In a February 2, 2021 CGArchitect account, Jeff Mottle described a contractor who connected a laptop carrying pirated software to a studio's network; Autodesk's "phone-home" tools flagged the installation, & the studio became the audit target.

Enforcement and settlements

Attorney Steve Vondran, whose firm defends companies in these matters, describes the enforcement arm as an "Autodesk internal" team, "a small team of lawyers inside of Autodesk" who force targets to run scans & then seek settlements "as high as $50,000 or more". Vondran calls the opening demand a "love letter" & reports that Autodesk attorneys have threatened "shutoff of even licensed software" if a company refuses to engage.

ProLicense, which markets itself as an audit-defense consultancy, calls Autodesk "very aggressive in the industry" & says it audits "several million customers worldwide". The firm says audits often conclude that a target needs five to ten times the licenses it holds.

One studio owner told CGArchitect that Autodesk's first contact was "very confrontational and aggressive" & that its compliance team "had no desire to listen to any explanations". Scott & Scott adds that Autodesk's settlement agreements often impose an "invasive audit provision that supersedes the license agreement", which shortens the notice period, shifts the cost of the audit onto the customer, & requires future purchases directly from Autodesk.

Consumer and industry response

ProLicense says targeted customers "often feel helpless and up against the wall" & tend to comply rather than object. In the case CGArchitect reported, retaining counsel changed the dynamic: the studio owner said that once they "hired the lawyer, the tone of communications changed". Scott & Scott, Vondran Legal, & ProLicense each publish guidance for companies facing these audits.

A studio owner told CGArchitect that Autodesk's first contact was "very confrontational and aggressive", that the studio was made to install auditing software, and that it spent thousands in legal fees before Autodesk agreed there were no infringing copies.

See also

• Autodesk
• Digital rights management