If you are using a third-party CAN controller chip, then they will have paid the licensing fee. The original patents related to the way the controller worked, so the vendor requires a license in order to sell a controller chip without infringing the patents.
However, the original CAN 2.0 specification was published in 1991, so the patents (sorry I can't find a list of them) would have expired by now. This means that even if you wanted to implement your own controller in software/hardware you wouldn't have to pay any licensing fee, provided you didn't call it 'CAN' or use any of Bosch's other trademarks. Note that this is essentially what Atmel did with the 'Two-Wire-Interface' - otherwise known as I2C(TM) - when Philip's I2C patents expired.
It appears that Bosch has significantly reduced the licensing fees in light of this which is why I imagine vendors continue to use the official 'CAN' brand. Also note that CAN FD enhancements are covered by later patents which I believe are still in effect.