Software Asset Management for mid-size firms: build a license inventory & legalization roadmap before an audit (2026)

Quick answer

If your mid-size firm has no SAM yet, start with one action: inventory every piece of software running on every machine and reconcile it against the invoices/licenses you hold. The gap between "what is installed" and "what you are licensed for" is your legal risk. SAM turns that one-off inventory into a continuous operating habit, so when inspectors arrive you can produce a license register matching reality in minutes — instead of panic-uninstalling.

The cost of legalization is almost always lower than the combined risk of penalties under Nghị định 341/2025/NĐ-CP, business disruption, and reputational damage.

*Disclaimer: This article is for information only and is NOT legal advice. Legal document names are kept in Vietnamese (original). Legal citations were checked against original texts at time of writing (see sources) but law can change. Consult an IP lawyer and authorized software vendors before deciding.*

1. What SAM is and why mid-size firms need it

Software Asset Management (SAM) is the set of processes and tools by which an organization knows exactly how many licenses it owns, uses, and lacks — each tied to an invoice or contract. For mid-size firms (roughly 50–300 devices), the typical risk is not deliberate piracy but loss of control: shadow installs, over-deployment, expired trials kept alive by cracks, and licenses tied to departed employees.

Software is protected as a literary work under Điều 22, Luật Sở hữu trí tuệ 50/2005/QH11 (amended by 07/2022/QH15). A lawful user may make one backup copy but may not transfer it to others.

2. Legal framework & penalties

The core copyright framework relevant to software in Vietnam is summarized in the table below (checked against original texts).

• Nghị định 341/2025/NĐ-CP (issued 26 Dec 2025, effective 15 Feb 2026) replaces Nghị định 131/2013/NĐ-CP. Maximum administrative fine in the field of copyright/related rights: VND 250 million for individuals and VND 500 million for organizations.
• Unauthorized reproduction of a work (including computer programs) is fined VND 5,000,000 – 50,000,000 (Chapter II), depending on illicit profit / damage / value of infringing goods.
• Article 45(3) & (5b) of the Competition Law 2018 (Luật Cạnh tranh 23/2018/QH14) — clause 3 prohibits providing dishonest information about other enterprises, and clause 5b prohibits comparing goods/services without being able to substantiate the claim — so compliance messaging must never disparage or falsely compare competitors/vendors.

3. The 5-step SAM process

Step 1 — Discovery. Scan all devices; build the "what is installed" list.

Step 2 — Reconciliation. Gather invoices/contracts/vendor portals; build the "what you are licensed for" list; compute the compliance gap.

Step 3 — Triage. Classify each gap: under-licensed (legal risk), over-licensed (waste), trial/crack (highest priority).

Step 4 — Remediation. Buy genuine licenses, or move to a lawful alternative (subscription or properly-licensed open source) where it fits the need; retire surplus.

Step 5 — Governance. IT-only installs, quarterly re-discovery, one internal owner per license. This is what separates SAM from a one-off audit: it sustains compliance.

4. Minimum license-inventory fields

A "license register" (spreadsheet or dedicated tool) for a mid-size firm should include at least the fields below.

5. Legalize proactively vs wait for an audit

This is the CFO question: *"Buy licenses now, or wait until fined?"* Table 3 gives no absolute figures (license prices and case facts vary and must not be fabricated) — only the cost components for a qualitative comparison.

Proactive SAM (Option A) almost always has a lower expected total cost: it eliminates the penalty branch (up to VND 500 million for organizations under NĐ 341/2025), business disruption, and incident-driven legal fees. Compute absolute figures from your own real license quotes — never from fabricated numbers.

6. First 24 hours of an inspection

If you have done SAM, the inspection is mostly about presenting your records rather than panicking.

• Stay calm and cooperate; ask for the inspection decision. Do not delete software (may be seen as destroying evidence).
• Produce your license register (if you have done SAM). This is where Step 5 pays off.
• Contact an IP lawyer immediately; route all statements through a designated point of contact.
• Do not make accusatory statements about vendors or competitors — recall Article 45(3) & (5b) of the Competition Law (clause 3 bars dishonest information; clause 5b bars unsubstantiated comparison).

7. FAQ

1. How does SAM differ from a "one-off software audit"? An audit is a snapshot at a point in time. SAM is a continuous process that keeps that state compliant (periodic scans, install policy, license owners). An audit is a step inside SAM (Discovery + Reconciliation).

2. Must a mid-size firm buy an expensive SAM tool? No. Many start with a spreadsheet containing the checklist fields above, plus the inventory tools built into device management. A dedicated tool is only needed once device/license counts outgrow a spreadsheet.

3. Is an expired trial left on a machine punishable? If the software still runs via a crack after the trial expired, that can be unauthorized reproduction/use — within the scope of NĐ 341/2025. Safest: uninstall or buy a proper license.

4. Is open-source software (OSS) "compliance-free"? No. OSS still has a license (MIT, GPL, Apache…) with its own conditions. "Open source" does not mean "anything goes" — you must still comply with the license terms. SAM should track OSS too.

5. When does the VND 500 million fine apply? That is the maximum cap for organizations in the copyright/related-rights field under NĐ 341/2025. The actual amount per act (e.g. reproduction: 5–50 million) is decided by the competent authority per the facts; the specific figure should not be inferred.

6. Will Dzo work with the inspection team on my behalf? This article is informational. Working with authorities requires an IP lawyer. Dzo helps on the technical side (building the license register, inventory, advising on lawful software solutions) and does not replace legal counsel.

*This article is for reference only and does not replace legal advice. Please check original texts (cov.gov.vn, thuvienphapluat.vn) or consult a lawyer before deciding.*