How to Review a Software License Agreement: a Clause-by-Clause Checklist (2026)

How do you review a software license agreement? Review a software license agreement by reading it clause by clause and asking, for each one, what you are allowed to do with the software, what it costs you now and later, who is liable when something breaks, and how you get out. A software license agreement (sometimes an end-user licence agreement, EULA, or a SaaS subscription agreement) grants the right to use software on defined terms. The vendor wants to protect its code, cap its risk, and keep you paying; you want enough rights to actually use the software, predictable cost, and protection if it fails or infringes someone's rights. A good review finds the gap between those before you sign. First work out which kind of licence it is, because it changes what matters. A perpetual on-premises licence is a one-time right to run software you host (so maintenance, escrow and audit terms are central). A term or subscription licence, including most SaaS, is a time-limited right (so renewal, price increases, data and exit terms matter most). Many agreements mix the two. This checklist covers both; weight the sections that fit your deal. This article is general guidance, not legal advice. Software agreements engage intellectual-property, data-protection, consumer and sometimes export-control rules that vary by jurisdiction, so have qualified counsel review anything you are about to sign. ## The clause-by-clause checklist ### 1. Licence grant and scope

• Is the licence perpetual or for a term? Exclusive or non-exclusive (almost always non-exclusive)? Transferable?
• What is the licensed metric: named users, concurrent users, devices, cores, capacity, or usage volume? The metric decides what you pay and whether you can grow without a surprise bill.
• Does the grant cover the environments you need: production, test, development, disaster recovery, affiliates? ### 2. Permitted use and restrictions
• Are the restrictions workable? Watch bans on reverse engineering, benchmarking, virtualisation, outsourcing, or letting affiliates and contractors use the software.
• Can you use the software for your actual business purpose, including on behalf of group companies? ### 3. Fees, price increases and payment
• Are fees fixed for the term, and how much can the vendor raise them on renewal? Push for a cap (for example a stated percentage or a published index).
• Are additional-use fees (extra users or capacity) priced in advance, or left to list price later? ### 4. Licence audit and true-up
• Does the vendor have audit rights? Check the notice, frequency and how any shortfall is priced. Aggressive audits that charge the shortfall at full list price plus back-maintenance and penalties are a well-known cost trap.
• Are you given a reasonable period to cure an inadvertent over-deployment before charges apply? ### 5. Maintenance, support and service levels
• What maintenance and support are included, at what response and resolution times? For SaaS, is there a real availability SLA with meaningful service credits?
• Can the vendor change the SLA or discontinue the product unilaterally? ### 6. Warranties
• Is there a warranty that the software performs to its documentation, and for how long? Many agreements disclaim almost everything, so check what, if anything, you are actually promised. ### 7. Intellectual-property infringement indemnity
• Does the vendor indemnify you if the software infringes a third party's intellectual-property rights, including defending the claim and providing a fix, replacement or refund? This is essential and should not be heavily watered down.
• Are the exclusions (your modifications, combinations, continued use after notice) reasonable? ### 8. Limitation of liability
• What is the liability cap, and is it mutual? A cap set at a few months' fees can leave you badly under-protected.
• Which items sit outside the cap (carve-outs): IP indemnity, confidentiality breach, data-protection breach, death or personal injury? A cap that swallows the vendor's own data-breach or IP liability is a red flag. ### 9. Data protection and security (especially SaaS)
• If the vendor processes your personal data, is there a data-processing agreement with proper security, sub-processor and breach-notification terms?
• Where is data hosted, and does that location work for your compliance needs? ### 10. Confidentiality
• Are confidentiality obligations mutual and time-bound, or one-sided and perpetual? ### 11. Term, renewal and termination
• How long is the term, does it auto-renew, and what notice is needed to stop renewal? Auto-renewal with a long notice window plus an uncapped price rise is a classic trap.
• Can you terminate for the vendor's material breach or persistent downtime, and what do you get back? ### 12. Effect of termination, data return and exit
• On exit, will the vendor return or delete your data, in a usable format, within a stated period? For SaaS this is critical.
• Is there a wind-down or transition period so you are not cut off overnight? ### 13. Source-code escrow and open-source
• For business-critical on-premises software, is there a source-code escrow so you can maintain it if the vendor fails?
• Does the software include open-source components under licences that could affect your use or your own code? ### 14. Assignment, change of control and governing law
• Can you assign the licence if your business is sold, or does a change of control trigger loss of the licence or a re-purchase?
• Which law governs and where are disputes heard? ## The red flags to catch before you sign - Uncapped renewal price increases, especially combined with auto-renewal and a long opt-out notice.
• Aggressive audit rights that price any shortfall at full list price with penalties and no cure period.
• A liability cap that excludes the vendor's own IP, data-breach or confidentiality liability, so the protection you most need is missing.
• No, or a heavily diluted, IP infringement indemnity.
• No data return or deletion on exit, or no usable export format, which traps your data with the vendor.
• The vendor's right to change terms, pricing or the SLA unilaterally during the term.
• Licence restrictions that block your real use, such as bans on affiliate, contractor or virtualised use.
• One-sided, perpetual confidentiality that binds only you. ## A note on jurisdiction Software-licensing rules vary by jurisdiction. Consumer-protection law limits what a vendor can disclaim or exclude when selling to consumers, and unfair-contract-term rules in the EU, UK, India (including the Consumer Protection Act, 2019) and elsewhere can strike down the harshest exclusions even in business deals. Data-protection obligations differ: the GDPR and UK GDPR, India's Digital Personal Data Protection Act, 2023, and US state privacy laws each shape the data-processing and security terms you need. Enforceability of liability caps and the treatment of click-wrap acceptance also differ by country. Because of this, treat the liability, data and consumer clauses as jurisdiction-specific, mark anything uncertain to verify, and get local advice rather than assume one approach fits every market. (Last verified October 2026.) ## Where a contract workspace helps Working through this checklist by hand is the slow, careful job that fills a reviewer's afternoon: reading every clause, catching the liability cap that excludes the data breach it should cover, spotting the missing exit and data-return terms, and then remembering the renewal and audit dates once the licence is live. Drafting a software licence, reviewing its indemnity and liability terms, tracking renewals and audit windows, and governing every licence you run can come together in one AI workspace tuned to how your company buys and sells software. Adira takes that one-workspace approach.