When an audit right is invoked without notice: what to do first
When a counterparty invokes an audit right without advance notice, the first task is not to argue whether the right exists. The first task is to control scope and evidence. Check what the contract actually requires as notice, confirm the auditor's authority in writing, limit access to the scope stated in the letter, and record every step before anyone arrives on site.
Where the right comes from
An audit clause is a contractual creature, not a public-law right. Its authority runs from the contract text alone. No statute grants a supplier or a customer the power to inspect the other side's premises or records without one.
Where the contract concerns licensed software, the underlying protection of the program itself sits with Directive 2009/24/EC. That Directive frames what counts as a permitted copy and what does not — a boundary the audit clause is meant to police, not to extend. An audit letter that reaches beyond licensed copies, into unrelated systems, is reaching beyond the reason the clause exists.
If the audit follows from a counterparty's own supply-chain security duty, the trigger is often that party's own obligation under Directive (EU) 2022/2555 (NIS2). In that case, the scope tends to track their compliance duty, not the wording of your contract. If the audited system includes a high-risk AI component, conformity records kept under Regulation (EU) 2024/1689 (AI Act) may already answer the question the audit is trying to ask, without opening the rest of the estate.
What changes once the letter lands
An audit letter without notice does two things at once. It starts a clock defined by the contract, not by the letter's own tone. And it puts every document you produce afterwards into the record the other side will use, if the dispute escalates. Both effects run from the moment the letter is read, not from the moment you respond.
| Clause element | What it usually covers | Check before you respond |
|---|---|---|
| Notice period | How much warning the other side must give before a visit | Compare the letter's timing against the clause, not against habit |
| Scope | Systems, sites or records open to inspection | Confirm the letter does not reach beyond what is named |
| Auditor identity | Who may conduct the audit — staff, or a named third party | Ask for written confirmation of the auditor's authority |
| Cost allocation | Who pays for the audit, and under what conditions | Note any trigger that shifts cost onto you |
| Findings process | How results are recorded and disputed | Do not sign an acknowledgment on the day |
What to do, in order
- Legal counsel pulls the audit clause and any referenced schedule the same day the letter arrives.
- The contract owner confirms, in writing, the notice period actually agreed — not the notice period the letter assumes.
- The IT lead freezes the systems named in the letter to a read-only export, so nothing changes after the request lands.
- The compliance officer restricts the auditor's access to the scope named in the letter, not to the wider estate.
- Nobody signs an acknowledgment of findings on the day of the visit, whatever the auditor requests.
- Counsel replies in writing within the deadline the contract sets, confirming scope, timing and the point of contact.
If you are named in a report generated during the audit itself, If you are named in a report a separate set of rights under data protection law can apply, distinct from the audit clause.
Who decides, and how
Scope disagreements are usually resolved between the parties first, by exchange of letters referencing the clause itself. If that fails, the forum is whatever the contract names for disputes — arbitration, or the courts named in the governing-law clause. No external deadline runs unless the contract sets one; the audit clause is the whole timetable, and reading it correctly is the decision that matters most in the first week.
Two or three scenarios
If the letter cites a security incident on the counterparty's side, the audit is likely driven by their own reporting duty rather than by anything you did. Scope should track that duty, and you can ask for it in writing before granting access.
If the contract already shows other gaps — no defined audit scope, no cost allocation, no findings process — the letter is often the second symptom of a wider renegotiation, not an isolated event. The same file that shows no audit boundary sometimes also shows When the contract has no upgrade path step by, and the two are worth reading together rather than in isolation.
If the audit letter arrives shortly after a renewal notice, treat the two as connected until proven otherwise. A counterparty preparing to renegotiate terms sometimes uses an audit to build leverage before the renewal conversation starts.
What this page does not decide
This page does not test whether the entity sending the audit letter is who it claims to be, or whether the documents produced during the audit are authentic. Those are separate questions, answered by separate work: Counterparty in Spain and its limits in practice sets out what can and cannot be established about a counterparty, and Document in Spain and the evidence sets out the same for a document produced during a dispute. Neither replaces reading the audit clause itself.
Related situation: When the renewal price doubles and the deadline covers what to do when the same relationship turns adversarial over price rather than access.
Verified
Checked: this page is current as of the review date recorded in the site's methodology log. Sources referenced: Directive 2009/24/EC (source: EUR-Lex, CELEX 32009L0024), Directive (EU) 2022/2555 (NIS2) (source: European Commission, Digital Strategy), Regulation (EU) 2024/1689 (AI Act) (source: EUR-Lex, in force from 2 August 2026).
FAQ
What is the first step when an audit right is invoked without notice?
Read the clause before you read the letter. Confirm the notice period, the scope and the auditor's identity against the contract text, then freeze the systems named to a read-only export.
Which deadline is already running?
Whatever deadline the contract's audit clause sets for a response. No external statutory clock applies unless the contract itself refers to one; the clause is the whole timetable.
Who decides, and on what evidence?
The parties first, by written exchange referencing the clause. If unresolved, the forum named in the contract's dispute-resolution terms, on the record built from the audit itself and the written responses each side sent.