Java licensing review. On your terms, not theirs.

Nobody is asking you anything today. That is precisely why this is the cheapest moment you will ever get to establish what your Java position actually is, and to change it without a deadline somebody else has set.

A review done properly does not end in a number. It ends in a file: a charter, a method note, a coverage statement, two registers, a headcount workpaper, and a conclusion the sponsor can sign.

Read the source material yourself before you rely on any of this. Five documents settle almost every review question: the OpenJDK project for what is not Oracle at all, Oracle's no fee terms, its Technology Network licence, its Java SE licensing questions page, and its Universal Subscription page for the metric and the rates.

When should you run a Java licensing review?

Run it at a moment you choose, not a moment Oracle chooses. Three windows give you the time and the freedom to act on what you find. Outside those windows, the review still helps, but your options narrow.

The three windows

The charter, written before anyone touches a tool

A review without a charter drifts into an inventory exercise and dies there. The charter is one page and it fixes six things.

• The question. One sentence, written in the language of the person who will read the answer. Not "how much Java do we have".
• The sponsor. A named executive who will sign the conclusion, which concentrates the mind on what the conclusion can support.
• Scope in and out. Legal entities, geographies, and the populations you will and will not reach. Naming the exclusions is what makes the rest credible.
• The as of date. One date the whole review speaks to. Mixed dates are the fastest way to lose an argument about a number.
• The privilege position. If the answer might be unwelcome, run it under counsel from the start. You cannot retrofit protection onto a document already circulated.
• The circulation list. Who sees drafts. A draft with a wrong number in it has a long and unhelpful life once it reaches a wide distribution.

Who does the work

Three functions, one of which is usually missing. Asset management reaches the machines, procurement holds the ordering documents, and legal reads the terms. Reviews run by asset management alone produce a count and no position.

What actually counts as Oracle Java in a review?

Only builds produced by Oracle, obtained under terms that require a subscription, and used in a way those terms do not permit for free. Everything else is noise, and most estates carry far more noise than signal.

The five categories every runtime falls into

Sort in that order. Categories one to four are cheap to prove and they shrink the last category dramatically, which is where every commercial conversation eventually lands.

The build number is the licensing fact, not the version

Terms changed several times between 2019 and 2023, and the terms that attach to a runtime are the ones that applied when it was obtained. A build number is therefore evidence, and a version family is not.

Record the full build string for every Oracle runtime and the date it entered the estate. A review that records only major versions has thrown away the one field that decides which licence applies. The chronology behind those changes is set out in the Oracle Java SE employee licensing paper.

The coverage statement nobody writes

State what proportion of each population you actually reached, and how you know. This single paragraph is what separates a review from an anecdote.

• By population, not overall. Ninety percent of servers and 40 percent of endpoints is a very different result from 78 percent overall.
• Name the unreachable. Air gapped systems, plant equipment, machines belonging to people on long leave, and anything a supplier controls.
• Say how you know. A coverage figure derived from the same tool that did the discovery is circular. Reconcile against a second source, usually the asset register or the payroll device list.

White Paper · Oracle Java

Oracle Java SE Employee Licensing

What Oracle Java SE actually costs per employee in 2026. Read it free.

Read the white paper

How do you build an employee count you can defend?

You build it as a workpaper with a source, a test and a note for every line. The count is not a payroll extract. It is a reasoned position that has to survive somebody arguing with each line individually.

What Oracle's definition actually reaches

Oracle's employee definition for the Universal Subscription is deliberately broad. Read the current wording on Oracle's own page rather than relying on any summary, because it is the single term that decides your bill.

In substance it covers your full time, part time and temporary staff, and also the full time, part time and temporary staff of your agents, contractors, outsourcers and consultants who support your internal business operations. It is not limited to people who use Java, and outsourced staff are not automatically outside it.

The workpaper, line by line

What the published rates actually do to that number

Oracle publishes seven employee tiers. The rate for your tier applies to your entire count, not only to the employees above the threshold, and support is included in the price rather than added to it.

The tier cliff, and why 999 is the worst place to sit

Because the rate applies to the whole count, the annual bill falls every time you cross a tier boundary upwards. This is arithmetic, not opinion, and it is straightforward to check against the published rates.

Two practical consequences. If your defensible count lands just under a boundary, check whether a broader and equally defensible reading actually costs less. And never let a supplier tell you that a growing headcount automatically means a growing Java bill.

How do you rate and rank what the review finds?

You put every asset into one of five evidence classes and you drive one of those classes to zero. Ranking by dollar value first is the common mistake, because it hides the class that actually decides your position.

The five evidence classes

Unknown is the only class that matters at sign off. A review closing with 300 confirmed findings and zero unknowns is a strong position. One closing with 30 confirmed findings and 2,000 unknowns is not a position at all.

Turning classes into a range

Report a range, with the two or three assumptions that move it, rather than a single figure. State the low case, the high case, and exactly which decision separates them.

• The low case. Confirmed findings only, with covered and excluded assets fully proved and every probable resolved in your favour.
• The high case. Every probable resolved against you, every unknown assumed to be an uncovered Oracle build, and the broadest reading of the employee definition.
• The swing factors. Usually three: the outsourced staff line, the treatment of one large application supplier, and the assets you could not reach.

Where the common advice on a Java licensing review is wrong

The common advice is to run a discovery tool across the estate and count the Java installations. We disagree, because a count is not a position and it never survives contact with a vendor. The number that matters is not how many runtimes exist, it is how many you cannot explain, and explaining one requires provenance, an entitlement search and a coverage statement that a stranger could reproduce. Worse, an unqualified total produced early tends to escape into circulation, get quoted back to you by the vendor, and become the anchor you spend the next six months arguing against. Produce workpapers first and a number last, or you have simply written your own opening bid.

What does a defensible review actually produce?

Seven documents and one conclusion. If the review ends with a slide instead of a file, it will not survive the first serious question, and the first serious question always arrives eventually.

The seven documents

1. The charter. The question, the sponsor, the scope, the as of date, the privilege position and the circulation list.
2. The method note. How each population was reached, in enough detail that a third party could repeat it and get the same answer.
3. The coverage statement. Proportion reached per population, the reconciliation source, and a named list of what was not reached.
4. The entitlement register. Every Oracle order touching Java, including grants hidden inside orders for other Oracle products.
5. The findings register. Every asset, its class, its provenance evidence and its owner.
6. The employee workpaper. Six lines, six sources, and a written note on each disputed line.
7. The conclusion. One page. A range, the assumptions that move it, and the three decisions the sponsor now has to make.

Sign off and refresh

• Sign it, with a date. An unsigned review is a draft forever, and drafts get quoted without their caveats.
• Refresh annually, and immediately on any corporate event that changes the entity list or the headcount materially.
• Keep the registers live. The entitlement and findings registers should be maintained by asset management, not rebuilt from scratch next year.
• Store it where it outlives the tooling. Discovery platforms get replaced every few years. The file should not depend on one.

What the review feeds into next

The conclusion drives one of three decisions: remediate, buy, or do nothing and monitor. Each has its own programme, and the review is what tells you which one you are actually choosing.

Size the buy case against your own numbers with the Oracle Java licence calculator. If the answer needs a negotiation rather than a spreadsheet, our Oracle advisory practice runs the commercial side without reselling anything.

What should a buyer do next?

1. Write the charter this week. One page, six fields, a named sponsor who will sign the conclusion.
2. Fix the as of date first, and make every source, from payroll to discovery, speak to that same date.
3. Decide the privilege position before any drafting starts. It costs nothing now and cannot be added later.
4. Search entitlements before you search machines. Every right you already hold shrinks the work on the deployment side.
5. Capture provenance, not versions. The builder and the build number, for every Oracle runtime you find.
6. Publish the coverage statement, per population, with the reconciliation source named.
7. Drive the unknown class to zero before anyone starts debating the size of the number.
8. Close with a range and three decisions, then put the refresh date in the sponsor's calendar.

Frequently asked questions

Who should sponsor a Java licensing review?

An executive who can act on the answer, which in practice means the chief information officer or the chief financial officer. Sponsorship matters because the conclusion has to be signed, and a signature forces the discipline of only claiming what the workpapers support. A review sponsored at manager level tends to end as an unsigned deck.

How much time should we allow for the work?

Six to ten weeks for a large estate, and three to four for a focused one. Entitlement work and the employee workpaper run in parallel with discovery, so the critical path is usually the populations that are hardest to reach rather than the analysis. Reviews that overrun almost always do so because the charter was never written.

Should the review be run under legal privilege?

If there is a realistic chance the answer is uncomfortable, yes, and the decision has to be taken before drafting starts. Instructing counsel at the outset and routing the work through them is straightforward. Attempting to apply protection to a document that has already circulated internally does not work.

Does a review have to reach every machine?

No, but it has to say which machines it did not reach and why. A stated gap is a manageable weakness and an unstated one is a credibility problem. Name the unreachable populations, explain the barrier, and record what compensating evidence you obtained instead, such as a written statement from the equipment manufacturer.

Do outsourced staff count towards the employee metric?

Often yes, which surprises most buyers. Oracle's definition reaches staff of agents, contractors, outsourcers and consultants who support your internal business operations, so the test is what the people do rather than who employs them. Read the current wording on Oracle's own page and document your reasoning line by line.

Is support charged on top of the per employee price?

No. Support is included within the Java SE Universal Subscription fee, so there is no separate support percentage to add. If a quote or a model shows a support line stacked on top of a per employee rate, that model is wrong and it will overstate your exposure by a wide margin.

What if the review finds we already own more than we thought?

That happens in roughly a third of the reviews we run, usually through Java rights embedded in orders for other Oracle products. Those grants are typically restricted to operating the parent product, so the value lies in mapping them precisely to machines rather than claiming them broadly. Get the mapping into the entitlement register with the ordering document attached.

How often should the review be refreshed?

Annually as a baseline, and immediately after any event that changes the legal entity list or the headcount materially. Between refreshes the entitlement and findings registers should be maintained rather than rebuilt. A review recreated from nothing every year costs several times what a maintained register costs.