In terms of structure, the response should first address the legality, then the risks, followed by alternatives. Keeping it straightforward but empathetic is key. The user might be in a situation where they need the software for a project or learning, so offering support in finding a legitimate way to access it is important.