The risks of using unlicensed software

The risks of using unlicensed software fall into three categories: criminal (Law 8/1996 punishes the unauthorized installation and use of computer programs with 6 months to 3 years in prison or a fine), civil (damages that can reach three times the amounts legally owed) and security-related (pirated programs often come with viruses and don’t receive updates).

The main legal provisions on the use of computer programs are found in Law No. 8/1996 on copyright and related rights, republished in 2018 and amended several times since. When you have the time, we recommend reading it, so you know the risks you’re exposed to and the situations in which your licensing is correct.

Who can report a company for unlicensed software?

The main party entitled to take action is the rights holder itself, usually the program’s producer. However, the law also allows the same claims to be made on its behalf, under a mandate, by collective management organizations, anti-piracy associations or persons authorized to use rights protected by law (Art. 188(1)).

Using programs without a license is a criminal offense, so it can also be investigated by the police, under a prosecutor’s supervision. At the request of the criminal investigation bodies, the Romanian Copyright Office (ORDA) carries out technical and scientific examinations of the programs found, at the defendants’ expense if their guilt is proven (Art. 181(1)(j)).

However, in our experience, the most common trigger for such inspections has been a complaint from a recently departed employee, unhappy with how the working relationship ended. Another common trigger has been complaints from partner companies whose invoices had stopped being paid.

In addition, major software producers usually reserve the right, through their license agreements, to check whether a company has licenses for everything it has installed.

What penalties does a company that uses unlicensed programs face?

• Prison or a criminal fine. Unauthorized reproduction of programs on computer systems, by installing, storing, running or executing, displaying or transmitting them over the internal network, is a criminal offense punishable by 6 months to 3 years in prison or a fine (Art. 195).
• Damages. The court sets damages based on the harm caused to the rights holder, in particular lost profits and the benefits unfairly obtained by whoever used the programs, or, if these criteria can’t be applied, at three times the amounts that would have been legally owed for the licenses (Art. 188(2)).
• Provisional measures, even before trial. The court can order, among other things, the preservation of evidence, precautionary measures on the company’s assets, including freezing its bank accounts, and the seizure of the materials and tools used (Art. 188(3) and (6)).
• Seizure of evidence. The court can authorize the seizure of objects and documents that prove the infringement, even if they are on the company’s premises (Art. 188(7)).
• Criminal liability of the company and of individuals. Under the Romanian Criminal Code, the company itself, as a legal entity, can also be held criminally liable, not just the people who installed the programs or asked for them to be installed, including the company director.

The old version of this article cited Article 139 and a fixed fine for legal entities. When the law was republished in 2018, its articles were renumbered, and the penalties above are the ones in the law’s current form.

What security risks do pirated programs bring?

• Viruses and spyware. “Cracked” programs and key generators are one of the most common ways of spreading ransomware, programs that steal passwords and programs that mine cryptocurrency on company computers.
• No updates. A pirated program usually doesn’t receive security updates, so vulnerabilities stay open.
• No support. When the program breaks or loses data, the producer won’t help you.
• Compliance. For companies covered by NIS2 (transposed in Romania by GEO 155/2024), unlicensed programs that receive no updates are hard to reconcile with the obligation to manage security risks. And if they cause a personal data leak, the company is also liable under the GDPR.

How do you prevent these problems?

Licenses can be expensive, but many programs are now paid for monthly, by subscription (Microsoft 365, for example), which spreads the cost over time. For some needs, there are also free and legal alternatives, such as LibreOffice. The best approach is still a licensing policy that you actually follow, so that every program you use is licensed.

A licensing policy is drawn up individually for each company, based on the number of devices, the programs used and how often you buy new equipment. It should include:

• an inventory of installed programs, checked regularly and compared with the licenses purchased;
• proof of licensing: invoices, contracts, certificates and access to the producers’ licensing accounts;
• restricted administrator rights, so employees can’t install programs as they please;
• attention to licenses tied to hardware, for example OEM Windows licenses, which can’t be moved to another computer;
• closing licenses when employees leave, so subscriptions are reassigned or canceled, not paid for nothing.

Also find out how to make sure the licenses you hold are valid.

This article is for information only and is not a substitute for legal advice; for a specific situation, consult a lawyer.

Keeping track of licenses and the inventory of installed programs is part of IT maintenance at RezolvIT. If you want to know whether all the programs in your company are correctly licensed, we start with a free IT audit, which also gives you the exact price.