A patch pipeline can license your estate without anyone raising a purchase order
On 23 January 2023 Oracle replaced the Java SE Subscription with a single metric tied to total employee count. It looked like a repackaging and it was a change of tax base: the price now scales with the payroll rather than with the estate. But the more urgent exposure for most organisations is not the metric at all. It is the version schedule, and it moves on dates rather than on decisions.
Prepared by Redress Compliance · August 10, 2026 · Oracle advisory. Based on 35 to 45 Oracle Java engagements, 2024 to 2025.
Executive summary
The free window closes on a schedule, and an automated patch pipeline can walk through it unattended. Oracle JDK 17 left the no fee terms in October 2024 and JDK 21 leaves them in September 2026.
A patching process that pulls the next build after that date converts an estate from unlicensed to licensable with no purchase order, no approval, and nobody in procurement aware it happened.
Check what your build pipelines and package managers are configured to fetch, and check it before next month rather than after.
The metric change was the second event, not the first, which is why the audit evidence predates the argument. The paywall arrived in April 2019 at a specific Oracle JDK 8 build, so estates that missed that one were already exposed years before 2023.
The most common audit trigger is download log evidence against the corporate domain, and those logs usually predate the metric everyone is now arguing about. A defence built entirely around the 2023 employee definition answers the wrong question.
The quoted employee count ran 18 to 28 percent above what buyers could defend, and contractor scope is worth contesting. Contractor scope was the single largest dispute in our engagements, and the narrower reading held in roughly four out of five.
That is a strong enough success rate to make it the first argument rather than a fallback, provided you can produce the statements of work and named team lists that settle which supplier staff support internal operations.
Rate discounts run 22 to 41 percent, and anything beyond that comes from scope, term, and a credible exit. That band is worth knowing precisely because it tells you when to stop negotiating price.
Past roughly 40 percent the conversation has to change instrument: reduce the counted population, shorten the term, or make an alternative runtime real.
Migrations completed in nine to fourteen months in our file, with developer tooling discipline rather than the runtime itself as the actual blocker.
Three estates came out of 2023, and the first move differs for each
| Position | What you hold | First move |
|---|---|---|
| Still on a legacy contract | Pre 2023 perpetual or named user rights, valid for what they cover | Protect it. It survives but cannot grow, so control what gets added |
| Converted to the subscription | An employee count you may not have set | Rebuild the count from payroll and supplier records, then contest scope |
| Never licensed at all | Download history and a version exposure | Decide migrate or license before the download log conversation opens |
Old contracts survive and cannot expand, which makes them an asset with a boundary rather than a problem.
A pre 2023 perpetual or named user agreement remains valid for exactly what it covers, so the risk in that estate is not the contract, it is growth: any new deployment outside its scope pulls the organisation into the current metric for the whole population rather than for the increment.
That inverts the usual instinct. The right posture is not to consolidate everything onto one modern agreement for tidiness, it is to fence the legacy estate, document precisely what it covers, and keep new demand off it and away from anything that would trigger conversion.
The employee metric itself is decoded in the employee metric guide.
The exposure that arrives without a decision
- Audit your build pipelines and package managers for what they actually fetch, because the licensable event is a download rather than a purchase, and pipelines run on schedules rather than on approvals.
- Pin the runtime explicitly rather than tracking a latest tag, since a floating reference is a standing instruction to cross whatever version boundary arrives next.
- Note the dates: JDK 17 left the no fee terms in October 2024 and JDK 21 leaves in September 2026, so the window that has protected many estates is closing imminently.
- Check developer workstations as well as servers, because the download log evidence Oracle uses is domain wide and does not distinguish a build server from a laptop.
- Treat the download record as the audit surface, since it is the most common trigger and it usually predates the 2023 metric change by years. The audit posture sits in the Java audit guide.
The Oracle Java SE employee licensing brief
The metric decoded, the qualifier that limits supplier populations, the version schedule, and the buyer side moves before renewal.
Get the white paper →Why the evidence is older than the argument
Most Java conversations open on the 2023 metric, and that is usually the wrong place to start defending.
The paywall arrived in April 2019 at a specific Oracle JDK 8 build, four years before the employee metric existed, so an estate that kept patching through that boundary was already exposed under the previous rules.
The most common trigger in our engagements is download log evidence against the corporate domain, and those logs frequently reach back well beyond 2023.
A defence constructed entirely around the current employee definition therefore answers a question the vendor has not asked: it argues about how many people should be counted, while the underlying claim is about which builds were taken and when. That has a practical consequence for sequencing.
Establish the download history first, because it determines whether you are arguing about the size of a subscription or about whether one was ever required.
Then rebuild the employee count from payroll and supplier records rather than accepting a figure assembled from public filings, since the quoted count ran 18 to 28 percent high across our file.
Then contest contractor scope, which was the largest single dispute and where the narrower reading held in four cases out of five, provided the statements of work and named team lists exist to support it.
Only after all three does the rate conversation mean anything, and it has a ceiling: discounts ran 22 to 41 percent, and past that the movement comes from reducing the counted population, shortening the term, or making an alternative runtime credible.
Migrations completed in nine to fourteen months, with developer tooling discipline rather than the runtime as the real constraint, which is a manageable programme rather than a threat that cannot be executed. The migration route sits in the alternative Java options guide.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
What we saw across Oracle Java engagements, 2024 to 2025
Across roughly 35 to 45 Oracle Java engagements run between 2024 and 2025, the employee count Oracle quoted ran well ahead of what a buyer could defend, and the arguments that actually moved it were not about price:
Engagements where the narrower reading of which supplier staff count prevailed, on statements of work and named team lists.
Time to complete an alternative runtime migration, with developer tooling discipline rather than the runtime itself as the blocker.
Three patterns recurred: the quoted employee count running 18 to 28 percent higher than the count buyers could defend after a clean head count review, contractor scope emerging as the single largest dispute with the narrower reading holding in roughly four out of five engagements.
And migrations completing in nine to fourteen months.
The buyer side move is to sequence it properly: establish the download history, rebuild the count from your own records, contest contractor scope with documentary evidence, and only then discuss rate, remembering that the band runs 22 to 41 percent and everything past it comes from scope, term.
Or a credible exit.
The wider library sits in the Java practice.
Your first five moves
- Audit what your build pipelines and package managers fetch, this month, because JDK 21 leaves the no fee terms in September 2026 and a floating reference will cross that boundary unattended.
- Establish your download history before anything else, since it decides whether you are arguing about the size of a subscription or about whether one was ever required, and it usually predates 2023.
- Rebuild the employee count from payroll and supplier records, not from an assembled figure, because the quoted count ran 18 to 28 percent above the defensible one in our file.
- Contest contractor scope with statements of work and named team lists, as the narrower reading held in four engagements out of five and it is the largest single dispute.
- Fence any legacy contract you still hold, documenting exactly what it covers and keeping new demand off it, because it survives but cannot grow. The Java practice runs the position with you.
Frequently asked questions
What exactly changed in January 2023?
The billing metric, and only the billing metric. Oracle replaced per processor and per named user pricing for Java SE with a single subscription counted on total employees of the licensed entity.
The price now scales with the payroll rather than with the deployment, so a company cannot license only the subset of employees who actually use Java.
Why does the version schedule matter more than the metric?
Because it creates exposure without a decision. Oracle JDK 17 left the no fee terms in October 2024 and JDK 21 leaves in September 2026.
An automated patch pipeline that pulls the next build after that date converts an estate from unlicensed to licensable with no purchase order and nobody approving anything, which is why pinning the runtime matters now.
Was 2023 the start of the exposure?
No, it was the second event. The paywall arrived in April 2019 at a specific Oracle JDK 8 build, so estates that kept patching through that boundary were already exposed four years before the employee metric existed.
The download log evidence that triggers most audits frequently predates 2023 entirely.
Do pre 2023 contracts still work?
Yes, for exactly what they cover. Pre 2023 perpetual and named user agreements remain valid and cannot be expanded, which makes them an asset with a boundary.
The risk is growth: new deployment outside their scope pulls the organisation onto the current metric for the whole population rather than for the increment.
How much is the quoted employee count usually inflated?
By 18 to 28 percent against what buyers could defend after a clean head count review.
The figure typically comes from public sources rather than from anything the customer supplied, so producing your own count from payroll and supplier records at a stated measurement date is the first substantive move available.
Is contractor scope worth fighting?
Yes. It was the single largest dispute in our engagements and the narrower reading held in roughly four out of five, which is a strong enough rate to make it the opening argument rather than a fallback.
It requires documentary support: statements of work, service descriptions, and named team lists establishing who supports internal operations.
How much discount is available on the rate?
Between 22 and 41 percent. That band is useful mainly because it tells you when to stop: beyond roughly 40 percent the movement comes from reducing the counted population, shortening the term, or making an alternative runtime credible, rather than from continuing to argue about the percentage.
How long does a migration off Oracle Java take?
Nine to fourteen months in our file, with developer tooling discipline rather than the runtime itself as the real blocker.
That makes it a manageable programme rather than a threat nobody could execute, which is precisely what gives it weight as a negotiating position when the rate conversation has reached its ceiling.
How an EBS Estate Drifts Out of Compliance
Session 5 of the Oracle EBS Licensing Series. An EBS estate rarely goes out of compliance by buying too little. It drifts in place, with no purchase order and no decision: helpdesk granted responsibilities, self service populations sliding into professional grade, database options enabled by default, and the restricted use boundary crossed by ordinary reporting work.
