Broadcom VMware licence audit: what the audit clause covers and what to prepare

What a Broadcom VMware licence audit covers

A Broadcom VMware licence audit, also called a compliance audit, checks whether the VMware software a company runs matches what its contracts allow. Broadcom publishes a Foundation Agreement with a Software Module on docs.broadcom.com, at the address of its end user agreement (version number 05112026, read on 10 October 2026). Section 3.4 of the Software Module states two instruments for this. The customer agrees to provide “verified reports and records reasonably requested by Broadcom” to verify compliance with the authorised use limitation and licence metric in the Transaction Document. Under section 3.4.4, “upon thirty (30) days’ prior written notice”, Broadcom or an independent third party may audit compliance with the agreement and the Transaction Document, remotely or at the customer’s facilities.

The agreement’s definition of a Broadcom offering names the VMware product family alongside CA and Symantec. The reporting and verification obligations “remain in effect during the Term of the Broadcom Offering and for twelve (12) months thereafter”. Where self-verification or an audit finds unlicensed use, section 3.4.4 provides for a written notification from Broadcom and, within 30 days of it, an order for enough licences and support to cover the past or current use beyond the authorised use limitation and licence metric.

Broadcom Foundation Agreement, Software Module section 3.4, version 05112026, on docs.broadcom.com, read on 10 October 2026; our summary of the wording, quoted passages in the text.

Which terms govern a purchase is decided by the customer’s own contract, not by the version published today. Broadcom’s Specific Program Documentation (SPD) for VMware Cloud Foundation, June 2026, refers to “the applicable end user agreement or governing contract”. It says the SPD that applies is the version published on legaldocs.broadcom.com “on the date that Broadcom accepts” the customer’s Transaction Document, which the Foundation Agreement defines as a quote, order form or statement of work; for a release installed later, it names the version published on the day of installation. Contracts accepted earlier, including perpetual licences bought from VMware, may refer to other terms. Whether and how a given clause applies to your contracts is a legal assessment for the company’s legal department.

Compliance reports in VCF 9 and what they record

For VMware Cloud Foundation 9 and later, section 3.4.3 adds a standing duty where the programme document notes it: a “regularly-scheduled verified report detailing Customer’s installed base and license compliance”, generated by the software and either transmitted by it or uploaded by the customer. The clause also names vDefend 9 and Avi Load Balancer 32 and later. The VCF SPD of June 2026 sets the schedule at 180 days from the date the licence is registered and every 180 days thereafter.

If no timely, unaltered Compliance Report arrives, the same SPD says management plane features will be degraded or blocked and support entitlements suspended, “including access to Updates or Upgrades”. On 9.x, Broadcom therefore receives a report of the installed base at least every 180 days. Keep a dated copy of each report; where the report and licence dates appear in VCF Operations is in our guide to checking VMware licence expiry. Estates on 8.x or earlier send no such report, so a request for records there starts from the inventory the company holds.

VMware audit letters in 2025, as the press reported them

The trade press reported two kinds of letter in 2025. ITdaily reported on 9 May 2025 that holders of perpetual licences without active support had received letters from Broadcom stating that using updates, patches or extensions after the maintenance contract has expired is a breach of contract, and calling for such software to be removed. According to the report, “Only zero-day patches are still allowed”, and the letters mentioned that Broadcom can conduct audits.

SDxCentral reported on 27 June 2025 that former VMware customers were receiving audit letters. Its example was a software provider in the Netherlands which, by a letter dated 20 June, had been selected for a formal audit of its use of VMware software and support services. According to SDxCentral, an auditing firm would review “the company’s VMware deployment and entitlements”, the review could include fieldwork or remote testing, and the letter suggested meetings with staff from accounting, licensing and IT. We found no Broadcom document that describes the audit procedure beyond the clauses above.

Broadcom’s KB 314603 describes which patches remain available after support ends. It gives “all perpetual license customers, including those that have expired support contracts” access to patches for critical security alerts with a CVSS score of 9.0 or higher, on vSphere 8.x. What else an expired perpetual licence still allows is covered in our article on VMware support after Broadcom.

Audit items and the evidence for each

The clauses and the press reports point to evidence on what is deployed, what the company is entitled to and what was installed when. Each item below has a source inside the company or in Broadcom’s portal.

Broadcom KB 345263, 313548, 145804, 316595 and 314603; Foundation Agreement, Software Module 3.4; VCF SPD (June 2026); SDxCentral, 27 June 2025.

Inventory of versions, builds and cores

For an estate of 10 to 60 hosts, the inventory is one row per host. Broadcom’s KB 345263 gives two ways to read an ESXi build number: select the host in the Hosts and Clusters view of the vSphere Client, where the summary line includes the build, or run vmware -v in the ESXi Shell. For vCenter Server, the Summary tab shows the build under Version Information, and vpxd -v prints it on the appliance. KB 316595 lists ESXi and ESX builds with their version, release name and release date, so each host’s build can be matched to the date Broadcom or VMware published it.

Cores and vSAN capacity come from the PowerCLI module in Broadcom’s KB 313548, which lists sockets, cores per socket, core licences and vSAN TiB for each host connected to a vCenter. Our step-by-step guide to the Broadcom core count script covers one run per vCenter and the checks that catch a wrong count; the rules behind the figures are in our guide to VMware licensing after Broadcom. Run it on every vCenter, including those of the DR site and the test clusters, then compare its host list with the hardware inventory. Standalone hosts, lab hosts and hosts in a backup site that never joined a vCenter do not appear in the output; for those, KB 313548 points to the manual count.

Record per host: site, vCenter, cluster, CPU model, sockets, cores per socket, ESXi version and build, the date that build was installed, and the Site ID whose entitlement covers the host. Keep the CSV files with the date of each run.

Our VMware optimisation service includes a full inventory of the estate: versions, subscriptions and actual resource usage. Describe your hosts, vCenters and Site IDs in the form below.

Entitlement records in the Broadcom Support Portal

Broadcom’s KB 145804 describes where entitlements are read. Log in to the Broadcom Support Portal, open My Dashboard, then My Entitlements in the left menu, and search by product name, Site ID or keyword. The Entitlement Details tab opens the License page, which shows Contract Status, Start Date and End Date together with downloads, licence keys and cases. We found no export option in KB 145804, so save a dated copy of each Site ID’s page for the file.

Match each host row in the inventory to one Site ID, and each Site ID to the contract documents behind it: the quote, the order form or purchase order, and the invoice. How Site IDs affect the pooling of subscriptions at renewal is in our VMware renewal quote checklist. For perpetual licences bought from VMware, keep the original order documents and licence keys in the same file; older purchase records sit with procurement.

This reconciliation can show three kinds of gap: a host with no entitlement behind it, an entitlement with no host, and a support end date earlier than the release date of the newest build installed under that Site ID. List each gap with the facts that explain it.

Patch history after support ended

For perpetual licences whose support contract has ended, the letters reported in 2025 concerned updates installed after that date, so the comparison is the support end date against later builds. Take the end date per Site ID from the portal. For each host on that Site ID, look up in KB 316595 the release date of its current build and of every build installed since that end date. Every build released or installed after the end date goes on a list with its release date, the date it was installed, the change record that installed it and whether it was a patch for a critical advisory under KB 314603, which covers vSphere 8.x. Change records from your maintenance windows are the evidence for installation dates.

Who answers and how to prepare the evidence

An audit request concerns IT, procurement, finance and the legal department at once. The preparation below assumes the company decides who speaks for it before the first meeting.

1. Record the date the letter or e-mail arrived and the notice period it states, and pass it to the legal department, procurement and the head of IT on the same day.
2. Name one coordinator who receives requests and sends answers, with a deputy, and keep a dated copy of everything sent.
3. Take the inventory: run the host and build inventory and the KB 313548 module on every vCenter, and date the output.
4. Save the entitlements per Site ID from the Broadcom Support Portal and match each host to one Site ID.
5. Build the patch timeline for every host on a perpetual licence whose support has ended.
6. Collect the contract documents for each Site ID and for each perpetual licence.
7. List the gaps with their facts; the legal department decides on the content and form of the response.

As a worked example, take an estate of 36 hosts on two sites with three vCenters: production, DR and test. Production and DR run under two Site IDs with current subscriptions, and the test cluster of six hosts runs perpetual vSphere 7 licences whose support has ended. The evidence pack holds 36 host rows, three dated script runs, two saved entitlement pages plus the perpetual licence records, and a patch timeline for the six test hosts.

Our engineering partner Vixen.UNO works in your environment under your access controls, with an NDA before technical detail. Write to us with the number of hosts, vCenters and sites you need in the inventory.

What we do

Eurokommerz supplies VMware / Broadcom licensing together with our engineering partner Vixen.UNO under one European contract. In VMware optimisation, the Vixen.UNO team makes a full inventory of the estate, its versions, subscriptions and actual resource usage, matches editions and subscriptions to the workloads within Broadcom’s current licensing logic, and sets out an action plan ahead of renewal and end of support, with dates. That inventory covers the versions and subscriptions this article asks you to record. The first call is free of charge; the technical assessment is paid, with its price fixed before work begins, and our infrastructure audit covers the estate beyond VMware.

FAQ