When IT leaders talk about supply chain risk, the conversation usually turns to hardware: delayed laptop shipments, chip shortages, components stuck at a port. Software gets less attention because it arrives instantly. Yet licences follow the same logic as physical goods. They have suppliers, lead times, renewal dates, compliance requirements and a real cost when something goes wrong.

The most common failure is not dramatic. A batch of new machines arrives on time, but the operating system licences were never ordered, or were ordered for the wrong edition. Staff start work on devices that show activation warnings, or IT spends a week chasing keys while projects wait. In smaller companies, the problem often surfaces during an audit, when nobody can match installed copies to purchase records.

Treating licences as inventory solves much of this. That means keeping a register that lists each product, edition, quantity, purchase source, assigned device or user and renewal date where relevant. It sounds basic, yet many organisations still rely on a mix of invoices in inboxes and keys saved in spreadsheets that only one administrator can find.

Sourcing deserves the same scrutiny applied to hardware vendors. Large enterprises typically buy through volume agreements and authorised resellers. Small businesses and freelancers have more options, including retail boxes, OEM licences bundled with devices and digital marketplaces that resell keys. Price is only one factor. Buyers should check that the edition matches their needs, that activation is supported in their region, and that the seller offers a clear path if a key fails.

Operating systems are a good example. The end of free security updates for Windows 10 in October 2025 pushed many small offices to move to Windows 11 on existing hardware or new machines. Some went through their device supplier, while others compared offers such as Windows keys on ggsel and other marketplaces before buying licences in small batches. Whatever the source, recording each key against a specific machine is what keeps the next audit simple.

Timing matters as well. Subscription software renews automatically, which is convenient until a price change or a seat count error goes unnoticed for a year. Perpetual licences do not renew, but they can quietly become unsupported. A quarterly review that looks at both types, and flags anything nearing end of support, prevents most surprises.

Understanding licence types is part of the job. A retail licence is usually tied to a person or organisation and can often be moved to a new machine when the old one is retired. An OEM licence is normally tied to the first device it was activated on and ends its life with that hardware. Volume licences come with their own terms, management portals and minimum quantities. Mixing these without a record of which is which is how companies end up buying the same software twice, or discovering during a hardware refresh that half their keys cannot be transferred.

Proof of purchase deserves the same care as the keys themselves. Auditors and software publishers generally want to see invoices, order confirmations or licence certificates, not just a working installation. Storing these documents in one shared location, linked to the entries in the licence register, turns an audit from a stressful search through old emails into a routine export. It also helps when a key stops working and the seller or publisher asks for evidence of the original transaction.

Software-as-a-service has added a new layer of complexity. Subscriptions for design tools, project management platforms, AI assistants and communication apps are often bought by individual teams on company cards. Each purchase is small, so it rarely reaches the procurement team. Over a year, the result can be dozens of overlapping tools, unused seats and accounts that belong to people who left months ago. A quarterly review of card statements, matched against the licence register, catches most of this sprawl.

Joiners, movers and leavers processes are where supply chain thinking pays off most directly. When a new employee starts, the IT team should know which licences are needed for that role and whether spare ones exist. When someone changes department, their software needs often change too. When someone leaves, their licences should be reclaimed and reassigned, not left attached to a disabled account. Building these steps into HR workflows keeps the register accurate without constant manual checks.

Supplier risk applies to software just as it does to physical components. A reseller that disappears, changes terms or sells keys that are later revoked can leave a business with machines that suddenly show activation errors. Checking reviews, buyer protection options, refund policies and how long a seller has been operating reduces that risk. For larger purchases, splitting orders across more than one approved supplier avoids depending on a single source.

Security teams have their own interest in this register. Unlicensed or unsupported software is a common entry point for attacks, because it often misses updates. A clear list of what is installed, which version and who owns it makes patching faster and helps identify machines that need attention when a new vulnerability is announced.

Decommissioning is the step that often gets missed. When old computers are recycled or sold, the licences attached to them need to be recorded as retired, or released for reuse where the licence terms allow it. Data on the drives must be wiped properly as well, which is a separate but related part of the same process.

Budgeting completes the picture. Software costs used to be a mostly predictable capital expense. Today they are a mix of one-off purchases and recurring subscriptions, often in different currencies. Forecasting renewals a year ahead, and comparing them with actual usage, gives finance teams fewer surprises and gives IT a stronger case when negotiating prices.

The organisations that handle this well rarely have elaborate tools. They have a named owner for software assets, a single register, a short list of approved suppliers and a habit of checking licences as part of every hardware rollout. That is supply chain management applied to something that happens to arrive by email instead of by truck.