Free Software at Work: The EULA Traps to Check (2026)

Quick answer

"Free" in software is a PRICE, not a RIGHT. There are at least four different kinds of free: (1) open source that may be used inside commercial organizations (7-Zip, LGPL); (2) closed software the vendor lets everyone use for free under its own terms (Oracle JDK 21 and later under the NFTC); (3) freeware for NON-COMMERCIAL use only (IrfanView, Avast Free); and (4) a free tier capped by company size (Docker Desktop). Only groups (1) and (2) are safe to install on company machines; installing group (3) or (4) on employee laptops already steps outside the permitted scope.

The clearest example is Docker Desktop: its official licence page states it is free for small businesses (fewer than 250 employees AND less than $10 million in annual revenue), personal use, education and non-commercial open source projects, but requires a paid subscription for professional use in larger organizations, government entities, and commercial use beyond the free tier limits.

The least-read example is the Avast EULA: Avast Free Antivirus, AVG Free Antivirus, CCleaner Free and every other no-fee product are classed as a "Consumer Solution", licensed only to "a natural person, or members of his household for personal, noncommercial purposes" — and expressly not licensed to any "business, company, government entity, non-governmental organization or other not-for-profit entity, or educational institution".

The Vietnam angle: "we only use it internally, we do not sell it" is not a defence. The consolidated Intellectual Property Law (Văn bản hợp nhất, Công báo No. 361+362 dated 13-02-2023) states in khoản 3 Điều 25 that the copying exceptions do not apply to computer programs. Using software outside the permitted scope infringes the economic rights (khoản 2 Điều 28) and can be sanctioned administratively under Nghị định 341/2025/NĐ-CP (effective 15/02/2026, caps of VND 250 million for individuals and VND 500 million for organizations).

*Disclaimer: This article is for information only and is NOT legal or official licensing advice. Vietnamese legal document names are kept in the original. Every licence quote was taken from the vendor's official page at the time of writing (22/07/2026) — EULAs can change at any time, so read the current version that applies to the build you install. Legal text is quoted from the consolidated law published by the Office of the National Assembly in Công báo.*

• Company-size thresholds are real: Docker Desktop is free for small businesses with "fewer than 250 employees AND less than $10 million in annual revenue"; above that, professional use needs a paid subscription (docs.docker.com).
• Free security suites are not for companies: the Avast EULA states a Consumer Solution (Avast Free Antivirus, AVG Free Antivirus, CCleaner Free…) is not licensed to any "business, company, government entity, non-governmental organization or other not-for-profit entity, or educational institution".
• Same product, two licences: Oracle JDK 21 and later under the NFTC "permits free use for all users – even commercial and production use"; but Oracle JDK 17 releases after September 2024, JDK 11 and JDK 8 fall under the OTN Licence, which only allows "personal use, development, testing, prototyping, demonstrating" and some other limited uses (oracle.com).
• Freeware means non-commercial: the IrfanView home page states plainly "Freeware for non-commercial use" — installing it on company machines is outside that free scope.
• Vietnamese law has no "internal use" exception for software: khoản 3 Điều 25 of the consolidated Intellectual Property Law excludes computer programs from the copying exceptions; penalties under Nghị định 341/2025/NĐ-CP cap at VND 250 million (individuals) / VND 500 million (organizations), effective 15/02/2026.

1. Four kinds of "free" — and only two are safe at work

The word "free" on a download button hides at least four different licensing models, and only two of them let a company install freely. The first safe group is open source under a licence that permits commercial use: the official 7-Zip licence file states "You can use 7-Zip on any computer, including a computer in a commercial organization. You don't need to register or pay for 7-Zip", with most code under the GNU LGPL. The second safe group is closed software the vendor deliberately makes free even in production: Oracle describes the NFTC licence (in use since September 2021, covering Oracle JDK 21 and later) as one that "permits free use for all users – even commercial and production use".

The other two groups are where Vietnamese businesses usually trip. Group three is non-commercial freeware: genuinely free, but only for individuals and households — for example IrfanView ("Freeware for non-commercial use") or the Free editions of Avast/AVG/CCleaner. Group four is a capped free tier: free until the organization exceeds a stated size, with Docker Desktop as the textbook case at 250 employees and USD 10 million in annual revenue.

The practical consequence: the exact same act of "download and install" is lawful or not depending on (a) who you are, (b) how big your organization is, and (c) which version you install. Table 1 summarises the four groups with examples checked word-for-word against each vendor's official page.

2. How to read a EULA: four questions, four real examples

You do not need to read twenty pages of EULA — you need answers to four questions, and all four sit in the opening clauses of almost every agreement: (1) WHO may use it (an individual, a household, an organization)? (2) FOR WHAT (commercial, non-commercial, development/testing, production)? (3) AT WHAT SCALE (devices, headcount, revenue)? (4) WHICH VERSION and in which time window (many vendors switch licences between releases)?

Docker Desktop answers (1)(2)(3) briskly: the terms state Docker Desktop is licensed under the Docker Subscription Service Agreement, free for small businesses (fewer than 250 employees AND less than $10 million in annual revenue), personal use, education and non-commercial open source projects, and requires a paid subscription for professional use in larger organizations, government entities, and commercial use beyond the free tier limits. Avast answers (1)(2) by direct exclusion: the Free editions are a Consumer Solution licensed to "a natural person, or members of his household for personal, noncommercial purposes", and "no Consumer Solution is provided or licensed for use by any: (i) natural person for commercial purposes; or (ii) business, company, government entity, non-governmental organization or other not-for-profit entity, or educational institution".

Oracle is the classic case for question (4): the same "Oracle JDK" name carries different licences depending on the release and the date. Oracle's official FAQ states that Oracle JDK 21 and later releases use the NFTC (free for all users, including commercial and production use), while Oracle JDK 17 releases after September 2024 (17.0.13 and later), Oracle JDK 11, Oracle JDK 8 and Oracle JRE 8 with Java Web Start fall under the OTN License Agreement for Java SE, which permits only personal use, development, testing, prototyping, demonstrating and some other limited uses. Table 2 lines the examples up side by side.

One detail worth noting in the Avast EULA: using the product other than as expressly authorized "constitutes a material breach of this agreement and may violate applicable copyright laws" — the vendor itself ties out-of-scope use to copyright risk, not merely to contract breach.

3. The Vietnam angle: why "internal use only" is not a shield

The most common defence when freeware is found on company machines is "we do not sell that software, we only use it internally". Vietnamese law does not offer that shield for software. The consolidated Intellectual Property Law (Office of the National Assembly, Công báo No. 361+362 dated 13-02-2023, consolidating Law 50/2005/QH11 with Laws 36/2009/QH12, 42/2019/QH14 and 07/2022/QH15) states at khoản 3 Điều 25: "Việc sao chép quy định tại khoản 1 Điều này không áp dụng đối với tác phẩm kiến trúc, tác phẩm mỹ thuật, chương trình máy tính" — the copying exceptions do not apply to computer programs. In other words, the "self-copying one copy for personal study or research, non-commercial" exception cannot be invoked for software.

Computer programs are protected as literary works whether expressed in source code or object code (Điều 22). The same article sets the limits of backup rights: an organization or individual with a LAWFUL right to use a copy of a computer program may make one backup copy to replace it if it is deleted, damaged or unusable, "nhưng không được chuyển giao cho tổ chức, cá nhân khác" (but may not transfer it to another organization or individual). The right belongs only to a lawful user, is limited to one copy, and is non-transferable.

The law also defines what a licence legally is: transferring the right to use copyright means the owner "cho phép tổ chức, cá nhân khác sử dụng có thời hạn" one, several or all of the rights (khoản 1 Điều 47) — a time-limited permission over specified rights. Anything outside that scope is use without a right, and Điều 28 lists infringement to include "Xâm phạm quyền tài sản quy định tại Điều 20" (khoản 2), where Điều 20 covers the right of direct or indirect reproduction of all or part of a work by any means or form.

On administrative penalties, the Copyright Office of Vietnam states that Nghị định 341/2025/NĐ-CP was issued on 26/12/2025 and takes effect on 15/02/2026, replacing the earlier rules in Nghị định 131/2013/NĐ-CP (as amended by 28/2017/NĐ-CP and 129/2021/NĐ-CP), and sets the maximum fine in the copyright and related rights field at VND 250,000,000 for individuals and VND 500,000,000 for organizations. Table 3 maps common freeware situations to the corresponding legal basis.

4. A 7-step checklist for auditing "free" software in your licence inventory

These seven steps bring the "free" tier of software — usually missing from the licence inventory because there is no invoice — back under control. Work in order; each step must end in a recorded line of data, not a verbal answer:

• Step 1 — List every product with NO invoice. Scan installed applications on workstations and servers, and filter out anything absent from the procurement ledger. That is exactly where invisible freeware and free tiers live.
• Step 2 — Open the vendor's OFFICIAL terms page for each one. Not a blog post, not a forum, not memory: open the vendor's own licence/EULA page and record the URL plus the date you read it.
• Step 3 — Answer the four questions. Who may use it? For what purpose? At what scale (devices/headcount/revenue)? Which version and in which time window? Write the answers into the licence inventory.
• Step 4 — Compare size thresholds against your REAL numbers. For Docker Desktop, compare current headcount and annual revenue against "fewer than 250 employees AND less than $10 million in annual revenue" — the condition is AND, not OR.
• Step 5 — Flag every "non-commercial" product as COMPLIANCE DEBT. Anything in the non-commercial freeware group ("Freeware for non-commercial use", or a security vendor's Free edition) must end one of two ways: removed, or replaced with the paid commercial/business edition.
• Step 6 — Track versions, not just product names. For products that change licence between releases (Oracle JDK is the textbook case: NFTC for JDK 21+, OTN for JDK 17 releases after 09/2024, JDK 11 and JDK 8), record the exact build number running in your inventory.
• Step 7 — Close the file and schedule a re-check. Save a PDF/screenshot of the terms page with the read date, assign an owner per product, and schedule periodic reviews — EULAs and free-tier thresholds can change without notice.

Frequently asked questions

1. If software is free, can a company just use it? No. "Free" is a price; the right to use lives in the licence. Some software is free for everyone including commercial organizations (7-Zip, Oracle JDK 21+ under the NFTC), but some is free only for individuals/non-commercial use (IrfanView, Avast Free) or only below a size threshold (Docker Desktop).

2. At what size does Docker Desktop stop being free? Per Docker's licence page, the free tier covers small businesses with fewer than 250 employees AND less than $10 million in annual revenue, plus personal use, education and non-commercial open source projects. Professional use in larger organizations, government entities, or commercial use beyond the free tier limits requires a paid subscription.

3. Is Avast Free or AVG Free acceptable on office machines? The Avast EULA classes those Free editions as a "Consumer Solution", licensed only to a natural person or members of their household for personal, noncommercial purposes, and expressly not licensed to any business, company, government entity, NGO, other not-for-profit entity, or educational institution. Company use requires the business product line.

4. Is Java/JDK still free for businesses? It depends on the release. Per Oracle's official FAQ: Oracle JDK 21 and later use the NFTC — free for all users, even commercial and production use; while Oracle JDK 17 releases after 09/2024 (17.0.13 and later), Oracle JDK 11, Oracle JDK 8 and Oracle JRE 8 with Java Web Start use the OTN Licence, which permits only personal use, development, testing, prototyping, demonstrating and some other limited uses. Oracle OpenJDK builds are released under GPLv2+CPE.

5. We only use it internally and do not sell software — are we exempt? No. Khoản 3 Điều 25 of the consolidated Intellectual Property Law states the copying exceptions do not apply to computer programs. Software simply has no "copy for personal/internal use" exception the way some other categories of works do.

6. What is the risk if out-of-scope use is discovered? Contractually, it is a EULA breach (the Avast EULA states that use other than as expressly authorized "constitutes a material breach of this agreement and may violate applicable copyright laws"). Under Vietnamese law, infringing economic rights can be sanctioned administratively under Nghị định 341/2025/NĐ-CP, with caps of VND 250 million (individuals) / VND 500 million (organizations), plus remedial measures.

*This article is for reference and does not replace legal or licensing advice. Vendor terms can change — read the current EULA that applies to the build you install, and check the original legal texts (Công báo, cov.gov.vn) before deciding.*

Conclusion

Free software is the largest blind spot in most Vietnamese companies' licence inventories: no invoice means no ledger entry, no ledger entry means no review, and by the time somebody asks, nobody knows which of the four groups in Table 1 the installed build belongs to. The fix is not complicated: list what has no invoice, open the official terms page, answer the four questions (who — what purpose — what scale — which version), then decide to remove or to buy the commercial edition. All of it is reading and record-keeping, not engineering.

Free is a price, not a right: the right to run software in a business lives in the EULA, not in the Download button.