Contents
Key takeawaysWhat changed in 2023The version scheduleWhy the evidence is olderThe three positionsCount and contractor scopeWhat we have seenWhat to do nextFAQIn January 2023 Oracle moved Java pricing from deployment to total employees. The more urgent exposure is the version schedule: JDK 21 leaves the no fee terms in September 2026, and an automated patch job can cross that line unapproved.
- The metric changed the tax base. Since January 23, 2023, the Java SE Universal Subscription is priced on total employees, so you pay for the whole payroll even if a few teams run Java.
- Dates create exposure on their own. JDK 17 left the no fee terms in October 2024 and JDK 21 leaves them in September 2026, so pin every pipeline before the next update is fetched.
- Audit evidence starts in 2019. The paywall arrived with Oracle JDK 8u211 in April 2019, and the download logs Oracle cites usually predate the employee metric by years.
- Oracle's count is usually high. Rebuild the headcount from payroll and supplier records at a stated measurement date instead of accepting a figure taken from public filings.
- Contractor scope is the first argument. Only supplier staff who support internal business operations count, and the narrower reading usually holds when statements of work and team lists back it.
- Old contracts are worth keeping. Pre 2023 perpetual and named user rights stay valid for what they cover, so fence them and keep new Java demand off them.
- Discounts have a ceiling. Past roughly 40 percent, price movement comes from the counted population, the term length or a credible migration plan.
What changed in Oracle Java licensing in January 2023?
On January 23, 2023, Oracle replaced the legacy Java SE Subscription and Java SE Desktop Subscription with the Java SE Universal Subscription. The old per processor and per named user pricing gave way to a single metric: the total number of employees in the licensed organization.
It looked like a repackaging. In practice it changed the tax base. The price now follows your payroll, so you cannot license only the teams or servers that run Java. A company with 6,000 staff and a dozen Java applications pays on all 6,000.
| Date | What Oracle changed | What it means for you |
|---|---|---|
| April 16, 2019 | Oracle JDK 8u211 and later updates move to the OTN license, which does not cover general production use | Anyone who kept patching Java 8 past this build needed a paid subscription from then on |
| January 23, 2023 | Java SE Universal Subscription replaces the processor and named user metrics with total employees | New purchases, and renewals that cannot stay on legacy terms, are priced on headcount |
| October 2024 | Oracle JDK 17 updates from 17.0.13 onward ship under OTN instead of the No Fee Terms and Conditions (NFTC) | Patched JDK 17 in production now needs a subscription |
| September 2026 | Last JDK 21 update under NFTC; Oracle plans the October 20, 2026 update as the first under OTN | Automated patching of JDK 21 creates a licensing requirement from that release on |
| September 2028 | Planned end of NFTC updates for JDK 25 | Upgrading to JDK 25 buys two more years of free updates, then the same decision returns |
Oracle's own FAQ says pricing starts at $15 per employee per month, with published tiers going as low as $5.25 and lower still above 50,000 employees. Because the rate falls in bands, the employee count decides both the quantity and the band you land in. We explain the definition in our employee metric guide.
Why was 2023 not the start of your exposure?
The metric change was the second event. The paywall arrived in April 2019 with Oracle JDK 8u211, four years before the employee metric existed. Any organization that kept patching Java 8 through that build was already exposed under the processor and named user rules.
It also means a clean inventory today does not settle an audit. Oracle's claim can reach back to builds that were downloaded, and later removed, years ago.
How an EBS Estate Drifts Out of Compliance
Why does the Java version schedule matter more than the metric?
The schedule creates exposure without anyone deciding anything. Oracle JDK 17 left the no fee terms in October 2024, and JDK 21 leaves them in September 2026. A patch job that pulls the next JDK 21 build after that date turns an unlicensed environment into a licensable one, with no purchase order and no approval.
Oracle has also started shipping monthly Critical Security Patch Updates between its quarterly releases, the first on August 18, 2026. More releases means your patch automation will be offered new Oracle builds more often, and every offer is a chance to cross the line.
Which update paths cross the line without a purchase order?
Oracle's script friendly "latest" download URLs stop working once a release leaves NFTC, so some builds will fail loudly. The larger risk sits in the paths that keep working, and in the engineer who fixes a failed build by logging in and fetching the OTN release.
- Build pipelines. CI jobs that request "the current JDK 21" from Oracle, or that use a Java setup step configured for the Oracle distribution without an exact update number.
- Container images. Dockerfiles whose base image uses a floating tag, rebuilt on a schedule.
- Internal artifact repositories. Artifactory or Nexus mirrors where someone has uploaded an OTN build that other teams now consume.
- Endpoint patching. Third party patch catalogs in your endpoint management tool, and the Java 8 auto updater on desktops, which offered 8u211 and later like any other update.
How do you check what your pipelines and package managers fetch?
Start this month, because the licensable event is a download and pipelines run on a timer. The same download records are what Oracle cites in an audit, as our Java audit guide explains, so the check serves both purposes.
- Search the build code. Grep Dockerfiles, CI definitions, Ansible or Puppet roles and install scripts for Oracle download URLs, Oracle base images and Oracle package names.
- Pin the runtime. Replace every "latest" tag or major version reference with an exact update number or a non Oracle build. A floating reference is a standing instruction to cross the next version boundary.
- Read the version strings. Run
java -versionon a sample of servers. Oracle JDK reports "Java(TM) SE Runtime Environment", while OpenJDK builds report "OpenJDK Runtime Environment". - Include developer workstations. Oracle's download log evidence is domain wide and does not distinguish a build server from a laptop.
- Record what you find. Keep dated evidence of each pin and each removal, since you may need it in a later audit. See our guide to CI and developer workstation cleanup.
What happens to JDK 21 servers after September 2026?
Builds you already run under NFTC stay under NFTC. What ends is free access to new security fixes for JDK 21. You then have four choices, and each has a cost.
- Stay on the last NFTC build. Free, but unpatched from the October 2026 release onward. Most security teams will not accept that for long.
- Upgrade to JDK 25. Free updates are planned until September 2028, at the price of regression testing every application now and again in two years.
- Move to a non Oracle OpenJDK build. Removes the Oracle question for that workload. The options are compared in our alternative Java options guide.
- Subscribe. Pay on total employees, which is where the count and scope work below decides the price.
More detail on the JDK 21 cutoff sits in our note on JDK 21 updates ending in 2026.
Oracle Java SE Employee Licensing Brief
The employee metric, the contractor qualifier and the JDK version schedule, with the steps to take before your renewal.
Get the white paper →Why is the audit evidence older than the argument about the metric?
Most Java disputes open on the 2023 employee metric, and that is usually the wrong place to start. The most common trigger in our engagements is download log evidence tied to the corporate domain, and those logs often reach back well before 2023.
A defense built only around the current employee definition answers a question Oracle has not asked. It argues about how many people to count, while Oracle's claim is about which builds were taken and when. How that evidence is assembled is covered in our piece on download log evidence.
In what order should you respond?
We work in this order, because each step changes what the next one is about.
- Download history first. List which Oracle builds were fetched, on which dates, by which accounts, and where each one is installed today.
- Your own employee count second. Rebuild it from payroll and supplier records at a stated measurement date. Do not accept a figure Oracle assembled from public filings.
- Contractor scope third. Contest it with the supplier contracts and team records described below.
- Rate last. The discount conversation only means something once the population is settled.
Establish the download history first. It decides whether you are negotiating the size of a subscription or whether one was ever required.
Which Oracle Java position are you in after 2023?
Three kinds of customer came out of the 2023 change, and the first step differs for each. Work out which one describes you before you talk to Oracle.
| Position | What you hold | First step |
|---|---|---|
| Still on a legacy contract | Pre 2023 perpetual or named user rights, valid for what they cover | Protect it. It survives but cannot grow, so control what gets added |
| Converted to the Universal Subscription | An employee count you may not have set | Rebuild the count from payroll and supplier records, then contest scope |
| Never licensed at all | Download history and exposure on specific versions | Decide whether to migrate or license before the download log conversation opens |
Do pre 2023 Java contracts still work?
Yes, for exactly what they cover. A pre 2023 perpetual or named user agreement stays valid, but you cannot expand it. Oracle's FAQ says legacy subscribers may renew to the extent their existing order permits, subject to confirming that current usage matches the licensed counts.
The risk is growth. A new deployment outside the contract's scope can pull the organization onto the employee metric for the whole population instead of the increment. Our note on legacy perpetual and named user rights covers the renewal checks.
Should you consolidate a legacy Java contract into one modern agreement?
A common recommendation is to fold old Java agreements into the Universal Subscription so everything sits on one contract. We advise against it. Once you convert, a license sized to a few hundred processors or users becomes a bill sized to every employee, and Oracle no longer sells new licenses on the old metrics.
The better course is to fence the legacy rights. Document precisely which servers and users they cover, keep new Java demand on non Oracle builds, and avoid any deployment that would force conversion.
How much do the employee count and contractor scope change the price?
In most of our negotiations, the count and contractor scope moved the price more than the discount did. Every employee removed from the count comes off the price at the full rate, before any discount applies. The hypothetical example below shows the effect.
Say Oracle quotes 9,000 employees, taken from your annual report. Your payroll at the measurement date shows 7,300, and your statements of work show 400 supplier staff who support internal operations. We use an illustrative rate of $10.50 per employee per month, inside Oracle's published $15 to $5.25 range.
| Step | Employees counted | Annual cost at $10.50 |
|---|---|---|
| Oracle's quoted count | 9,000 | $1,134,000 |
| Your payroll plus in scope supplier staff | 7,700 | $970,200 |
| Saving from the count alone | 1,300 | $163,800 |
| Same 30 percent discount on each count | 9,000 vs 7,700 | $793,800 vs $679,140 |
The corrected count is worth about 14 percent of the quote before the rate is discussed. On a three year term, the gap between the two discounted figures is $343,980. Matching $679,140 on Oracle's count would need a 40 percent discount, at the top of what we see Oracle concede.
How do you contest contractor scope?
The metric counts your own full time, part time and temporary staff. It also counts staff of agents, contractors, outsourcers and consultants, but only those who support your internal business operations. That qualifier is where the dispute sits, and it is decided on documents. Our guide to contractors and consultants in the employee count goes through the categories.
- Statements of work. Show what each supplier delivers and for whom.
- Service descriptions. Show whether a supplier's people support your internal operations or deliver a service to your customers.
- Named team lists. Identify the individuals who support internal operations, so the rest can be excluded by name.
- A stated measurement date. Fix the date the count applies to, so seasonal hiring or a later acquisition does not creep in.
- Payroll and HR extracts. Tie your own headcount to the licensed legal entities at that date.
What will the Oracle account team say, and how should you answer?
| What Oracle says | What to say back |
|---|---|
| "Our count comes from your published annual report." | That is a consolidated figure at a different date. Here is our payroll count at the measurement date, with supplier records. Reconcile against it line by line. |
| "All contractors count." | Only supplier staff who support our internal business operations count. These statements of work and team lists show which ones do. |
| "You downloaded Oracle JDK after April 2019, so back fees apply." | Show us which builds, on which dates, and from which accounts. We will reconcile each one against installs, removals and permitted development use. |
| "This is the best discount available this quarter." | Then we will discuss the counted population, the term, and our migration plan. |
| "Sign three years to protect the price." | We will sign a term that matches our runtime plan, with a price hold and a right to reduce. |
Which contract terms should you ask for?
- A written count definition and measurement date. Stops the number from being reopened at renewal on a different basis.
- A named exclusion list for supplier populations. Records the contractor scope you won, so the next account team cannot relitigate it.
- A release of prior use claims. Closes the download history up to the signature date.
- A renewal price hold and a reduction right. Protects you if headcount falls or workloads leave Oracle Java during the term.
- Preserved legacy rights. A schedule confirming what any pre 2023 agreement still covers, if you hold one.
What have we seen in recent Oracle Java negotiations?
Across roughly 35 to 45 Oracle Java engagements we ran in 2024 and 2025, the employee count Oracle quoted ran 18 to 28 percent above what the customer could support after a clean headcount review. The arguments that changed the outcome were rarely about price.
- Contractor scope was the largest single dispute. The narrower reading held in roughly four out of five engagements, where the customer could document which supplier staff did what.
- Rate discounts ran 22 to 41 percent. That band tells you when to stop. Past roughly 40 percent, further movement came from a smaller counted population, a shorter term or a credible alternative runtime.
- Migrations took 9 to 14 months. Developer tooling discipline, more than the runtime itself, set the pace.
Why does migration timing matter in the negotiation?
A migration measured in months, with a plan and named owners, is a manageable program. That is what gives it weight when the rate discussion has reached its ceiling, because Oracle's account team can see you are able to leave.
The runtime swap itself is rarely the hard part. The delays come from IDE bundled JDKs, build tool toolchains, container base images and laptops that reinstall Oracle JDK after cleanup. Our migration timeline guide breaks the work into phases, and the Java knowledge hub collects the rest of our Java research.
What to do next
- This week. Find every pipeline, image and package source that fetches Oracle JDK 21, and pin it, before the October 20, 2026 update arrives under OTN.
- Within a month. Reconstruct your download history back to April 2019, account by account, before Oracle presents its own version.
- Before any Oracle call. Rebuild the employee count from payroll and supplier records at a stated measurement date.
- In the first negotiation round. Contest contractor scope, supplier by supplier, with the documents listed above.
- If you hold a legacy contract. Fence it: document what it covers and keep new Java demand off it.
- Before you sign a term. Decide between JDK 25, a non Oracle build or a subscription, and size the term to that plan.
Has Oracle contacted you about Java? Talk to us before you reply. Our Oracle Java audit defense is led by former Oracle insiders and runs on a fixed fee.
Frequently asked questions
What exactly changed in Oracle Java licensing in January 2023?
Only the billing metric. Per processor and per named user pricing for Java SE gave way to one subscription counted on the total employees of the licensed entity. The license terms for running Oracle JDK builds did not change that day; those changed in 2019 and change again at each NFTC cutoff.
Why does the Java version schedule matter more than the employee metric?
The metric only prices a decision you make. The schedule creates a licensing requirement when a patch job fetches the first Oracle JDK 21 update released under OTN, expected October 20, 2026. That can happen on a Tuesday night with no approval, which is why pinning versions comes before any renewal talk.
Was 2023 the start of Oracle Java exposure?
No. It was the second event. Oracle JDK 8 updates released from April 16, 2019 onward carry the OTN license, so organizations that kept patching Java 8 were exposed four years earlier. Download records from that period are usually what an audit letter quotes.
Do pre 2023 Oracle Java contracts still work?
Yes, within their original scope and quantities. You can renew where the existing order allows it, but Oracle will check that usage matches the licensed counts first. Run your own inventory before that renewal, so you find and remove any growth before Oracle does.
How much is Oracle's quoted employee count usually inflated?
In our 2024 and 2025 engagements it ran 18 to 28 percent above the count customers could support after a clean headcount review. The usual causes are a group figure from an annual report, the wrong date, and every contractor included by default.
Is contractor scope worth fighting in an Oracle Java negotiation?
Yes. It was the largest single dispute we saw, and the narrower reading held in about four out of five cases. Start collecting statements of work and named team lists before Oracle asks, since assembling them under an audit deadline is where most customers lose the argument.
How much discount does Oracle give on the Java SE Universal Subscription?
We saw rate discounts of 22 to 41 percent. Treat the upper end as a signal to change the subject: once Oracle stops moving on price, a smaller counted population, a shorter term or a migration plan with dates achieves more.
How long does a migration off Oracle Java take?
Nine to fourteen months in our experience, for a full move to a non Oracle OpenJDK build. The runtime swap is quick; finding and controlling every place developers and build tools pull a JDK from takes most of the time.