What you need to know about software compliance

TL;DR

• Software compliance has two dimensions: license compliance (using software within contractual entitlements) and regulatory compliance (meeting legal and industry standards like GDPR, ISO 27001, and SOC 2).

• Penalties for license noncompliance can reach seven or eight figures.

• Cloud migration, SaaS sprawl, and shadow IT are making compliance harder.

• You can’t prove compliance with software you don’t know you’re running. Automated software discovery across SaaS, on-prem, and cloud is the foundation.

Software compliance covers two distinct obligations

Software compliance means ensuring your organization meets two sets of requirements: that the software you’ve deployed matches what you’ve purchased, and that the software in your environment meets the legal and industry standards your business is held to. 

A lot of organizations underfund or ignore both until an audit letter arrives.

Getting either wrong is expensive. Getting both wrong at the same time is how enterprises end up paying seven-figure true-up fees while simultaneously failing their ISO 27001 certification.

What software compliance actually means

Most definitions of software compliance cover only one side of the obligation.  

Security-focused content covers GDPR, SOC 2, and ISO 27001 while ignoring license entitlements entirely. ITAM-focused content does the opposite, covering license reconciliation while skipping the regulatory dimension. 

Software license compliance means ensuring the software deployed across your environment matches what you’ve purchased. Every license agreement comes with terms: how many seats, which devices, what use cases, which geographic regions. Deploying beyond those terms, even accidentally, puts you in breach. This is what vendors audit for.

Regulatory compliance means ensuring the software you operate meets legal, industry, and contractual standards. GDPR governs how personal data is handled. ISO 27001 sets the framework for information security management. SOC 2, HIPAA, PCI DSS, and the EU AI Act each add their own requirements depending on your industry and data types.

The link between these two sides is visibility.

Proving regulatory compliance requires knowing every application in your environment. Reconciling license entitlements requires the same thing: accurate, current inventory data.

ISO 19770, the international standard for software asset management, exists precisely to bridge this gap. It provides a framework for identifying, managing, and governing software assets throughout their lifecycle. Yet most organizations treat SAM and compliance as separate workstreams, assigning them to different teams with different tools. If that sounds like your organization, you’re not alone.

Why software compliance matters more than you think

The financial exposure from noncompliance is concrete and well-documented.

Vendor audits are not hypothetical. Oracle, Microsoft, Adobe, and Broadcom (VMware) all run active audit programs. NPI Financial reports¹ that fees for software license noncompliance can easily reach seven or eight figures for enterprise-scale deployments. Oracle audits have surged following missed revenue targets, particularly targeting Java, database, and middleware deployments. Broadcom’s audit activity escalated sharply after its VMware acquisition.

These audits aren’t purely about enforcement. Vendors use them as revenue-generation tools and product adoption pressure tactics. If you refuse to upgrade, a vendor may threaten an audit. If you’re found noncompliant, they may waive penalties in exchange for purchasing new products at full list price. Anyone who’s been through a surprise audit letter on a Friday afternoon knows how quickly “we think we’re fine” can turn into a six-month remediation project. Xensam’s comprehensive guide to software license audits covers how to prepare for and respond to these situations.

On the regulatory side, the cost of noncompliance is equally measurable. Organizations that experience noncompliance-related data breaches pay $4.61 million on average².

Beyond penalties, compliance is increasingly a business enabler:

• 87% of CEOs agree³ that cyber and privacy regulations are effective in reducing organizational cyber risks.

• 24% of organizations⁴ cite client acquisition as the primary driver behind their compliance program. Customers, particularly enterprise buyers, treat compliance certifications as a prerequisite.

• Nearly two-thirds of organizations⁵ say AI is important to their compliance program, signaling that the scope of compliance work is expanding.

Organizations that treat compliance as operational infrastructure tend to be better prepared, more trusted by customers, and more efficient with their software spend.

The two sides of software compliance

Software license compliance 

License compliance is the original software compliance problem, and it’s still the one that catches most enterprises off guard.

The core question is straightforward: does the software installed and running across your environment match the entitlements you’ve purchased?

In practice, answering that question is anything but simple. You probably have a general sense that your licenses are “mostly right.” Most organizations do. That confidence tends to evaporate the moment an auditor asks for proof.

Common violations include:

• Over-deployment: More copies installed than licenses purchased. This happens silently as employees install software, VMs get cloned, or devices get reimaged.

• License type misuse: Using an educational or nonprofit license for commercial purposes, or deploying a Standard edition feature set that requires an Enterprise license.

• Shadow IT installations: Software acquired and installed without IT’s knowledge or approval, often through personal accounts, browser extensions, or departmental purchases.

• Geographic or use-case restrictions: Many license agreements restrict deployment to specific regions, subsidiaries, or use cases. Violating those terms counts as noncompliance even if the total seat count is correct.

The root causes are predictable. License agreements are complex, often running to hundreds of pages with nested terms. Organizations lack centralized SAM processes. IT teams don’t have real-time visibility into what’s deployed. Cloud and SaaS transitions introduce new licensing models that don’t map neatly onto on-prem entitlements. And employees install software without understanding the compliance implications.

Vendors know this. That’s why audit programs exist. Each audit-active vendor has dedicated teams, third-party audit firms, and well-established playbooks for identifying noncompliance and converting it into revenue.

Regulatory and security compliance

The regulatory dimension of software compliance keeps expanding.

Key frameworks that intersect with software management include:

• GDPR: Governs the processing, storage, and transfer of personal data for EU residents. If you’re running software that handles personal data, you need to know where that software is, who has access, and where data is stored.

• ISO 27001: The international standard for information security management systems. 81% of organizations⁶ report current or planned ISO 27001 certification, up from 67% in 2024.

• SOC 2: Trust criteria for service organizations covering security, availability, processing integrity, confidentiality, and privacy.

• HIPAA: Protects health information in the US. Any software that touches patient data must meet HIPAA requirements.

• PCI DSS: Required for organizations that process payment card data.

• EU AI Act: The newest compliance frontier. The EU AI Act introduces obligations around AI transparency, risk assessment, and governance that directly affect which AI tools organizations can deploy.

What connects all of these frameworks is software visibility.

You can’t demonstrate GDPR compliance if you don’t know which applications are processing personal data. Also, you can’t pass an ISO 27001 audit if you don’t have an accurate inventory of information assets. And obviously, you can’t govern AI use if you can’t see which AI tools employees are using.

Regulatory compliance compounds the license compliance obligation. Both require the same foundation: knowing exactly what software is running across your environment, who’s using it, and how.

The modern compliance challenge: cloud, SaaS, and shadow IT

The compliance problem has gotten meaningfully harder in the last five years, and the trend isn’t reversing.

Global SaaS spending is projected to rise from $318 billion in 2025 to $576 billion by 2029⁷. Each new SaaS subscription is a license agreement, a data processing relationship, and a potential compliance obligation. Most organizations don’t have a central system tracking all of them. If you’ve ever discovered a SaaS tool only because an invoice showed up in accounts payable, you know the feeling.

Shadow IT continues to expand. An estimated 40% of enterprise IT spending occurs outside IT visibility⁸. Every untracked application is a license you may not own, a data flow you can’t govern, and an audit finding waiting to happen. SaaS visibility remains one of the largest gaps in most enterprises’ compliance programs.

Shadow AI adds a new layer. Gartner predicts⁹ that by 2030, more than 40% of enterprises will experience security or compliance incidents linked to unauthorized AI use. Shadow AI breaches already cost $670,000 more on average¹⁰ than standard breaches. With the EU AI Act now in effect, the regulatory stakes for ungoverned AI are rising fast.

Modern software estates change weekly. Employees spin up new SaaS tools without procurement involvement, and AI adoption outpaces governance. Counting on-prem licenses once a year and reconciling against purchase records simply can’t keep up.

The convergence of SAM and SaaS management is an emerging industry trend. SAM has traditionally focused on on-premises compliance and audit readiness; SaaS management handles cloud subscriptions. Organizations that keep these in separate silos will keep finding compliance gaps in the space between them.

How to build a software compliance program that works

Compliance programs fail when organizations treat them as periodic projects. Annual audits, quarterly license reconciliations, and fire-drill responses to vendor letters don’t work when your software estate changes daily.

A compliance program that actually holds up needs to be continuous, automated, and built on real data. Here’s what that looks like in practice.

Start with visibility 

You can’t manage what you can’t see. Automated discovery across SaaS, on-prem, and cloud is the non-negotiable first step. This means identifying every application in your environment, including the ones employees provisioned without IT’s involvement.

Manual inventory methods like spreadsheets, surveys, and periodic scans are too slow and too incomplete. By the time you’ve finished a manual inventory, it’s already outdated. If you’ve ever spent weeks building a license spreadsheet only to find it wrong by the time it reached a stakeholder, you understand the problem.

Establish continuous license reconciliation

Discovery tells you what’s deployed. Reconciliation tells you whether it matches what you own. This comparison needs to happen continuously, not once before audit season.

Continuous reconciliation catches over-deployment, license type mismatches, and subscription expirations before they become audit findings. It also gives procurement teams the data they need for renewal negotiations: actual usage, not estimated usage. That distinction matters when you’re sitting across from a vendor rep who’s quoting list price for 500 seats and you can prove only 200 are active.

Build audit readiness into operations

69% of organizations¹¹ say regulations are too complex, too numerous, or that verifying third-party supplier compliance is difficult. That complexity is real, but it’s manageable when compliance data is always current.

Audit readiness shouldn’t be a scramble. When you have continuous discovery and reconciliation running, an audit request becomes a reporting exercise rather than a crisis. You pull the data, generate the report, and respond with confidence.

Integrate compliance data with governance

License data, usage data, and regulatory obligations shouldn’t live in separate systems. Connecting them means compliance teams can answer questions like: Which applications process personal data and are we licensed for them? Which SaaS tools were provisioned without security review? Where are we exposed if a vendor launches an audit?

Follow a structured framework

Xensam’s approach to compliance follows four steps:

• Connect existing systems and data sources with minimal setup and no disruption.

• Discover software automatically across SaaS, on-prem, and cloud. No manual tagging or spreadsheets.

• Understand usage by tracking how software is actually used over time, not just whether it’s installed.

• Take control by removing unused licenses, optimizing spend, and going into renewals and audits with real data.

This framework turns compliance from a periodic exercise into a continuous operational practice. It gives IT asset managers, compliance teams, and procurement leaders a shared foundation of reliable data.

Software compliance isn’t getting simpler. SaaS sprawl, shadow AI, expanding regulations, and aggressive vendor audit programs are all moving in the same direction: more risk for organizations without visibility and control over their software estate.

Xensam gives IT asset managers, compliance teams, and procurement leaders complete visibility across SaaS, on-prem, and cloud. One platform. Real usage data. Continuous compliance readiness.

FAQ