The Oracle Java audit, end to end
An Oracle Java audit is a five stage commercial process, and only the last two stages look like an audit. In 2026 the friendly emails are converting into formal GLAS notices, so the stage you are in decides which moves are still available to you.
Prepared by Redress Compliance · August 6, 2026 · Oracle Java licensing advisory. Based on 40 to 60 Java engagements run or advised 2024 to 2026.
Executive summary
Oracle runs Java enforcement as a pipeline, not an event. By the time the first friendly email reaches your inbox, Oracle has already scored your account against download logs and support records you did not send, and priced an outcome it expects to reach.
The audit label appears only at stage three, when the file moves to GLAS, the audit arm formerly known as LMS.
The number the whole process turns on is your employee count. Since the January 2023 license change, the Java SE Universal Subscription is priced per employee, not per install: every full time and part time employee, plus the contractors, agents, and consultants who support internal operations.
List runs $15.00 per employee per month at 1 to 999 employees down to $5.25 at 40,000 plus, which is why a company with 200 Java installs can open a letter that prices 12,000 people.
The spread between the opening claim and a defended settlement is the widest we see in any Oracle practice.
Across the engagements behind this guide, Oracle opened on the full employee count and settled 5 to 15 times lower once the estate was evidenced rather than assumed, and a verified inventory removed 60 to 90 percent of claimed exposure before the commercial conversation even started.
2026 changes the tempo, not the math. After three years of soft outreach, Oracle is converting unanswered friendly emails into formal audit notices under the master agreement. The window in which the best settlements close, the soft audit window, is shortening.
The guide below maps every stage, the owner on the Oracle side, and the one move at each stage you cannot take back.
What an Oracle Java audit actually looks like
It looks like five stages, and most buyers believe they are having a conversation when they are already three quarters of the way through a process Oracle started without them. Each stage has a different Oracle owner, a different tempo, and exactly one decision that cannot be walked back.
Knowing the stage matters more than knowing the law.
| Stage | What reaches you | Who owns it at Oracle | The move you cannot undo |
|---|---|---|---|
| 1. Signal | Nothing. Your account is being scored against download logs, support records, and territory data. | Licensing analytics | None yet. This is where prevention lives. |
| 2. Soft outreach | A friendly email, a questionnaire, or an offer of a license review. | The account team or the advisory arm | Answering with numbers instead of process. |
| 3. Formal notice | A letter citing the audit clause in your agreement, addressed to a named executive, commonly with 45 days notice. | GLAS, the audit arm | Running Oracle supplied discovery scripts unreviewed. |
| 4. Findings | A compliance summary built on the full employee count and up to three years of back exposure. | GLAS plus the deal desk | Confirming a headcount before your own inventory is done. |
| 5. Settlement | A subscription proposal, priced to close before your fiscal or theirs. | Sales, back in the room | Signing without scoping the employee definition. |
You almost never enter at stage one. By the time an email reaches you, Oracle has already matched security patch downloads to your company's IP ranges and scored the account.
The right response at every stage is the same: inventory before you talk, and know your own number before Oracle proposes one.
Why 2026 is the year the soft approach turns formal
For three years after the January 2023 license change, Java enforcement ran almost entirely on soft outreach: compliance emails, review offers, and escalating account team pressure that rarely produced a formal letter. That pattern is ending.
In 2026 unanswered soft outreach is converting into formal audit notices issued by GLAS, Oracle's rebranded license management function, under the audit clause of the master agreement.
The mechanics matter. A soft audit letter is not a contractual event, and nothing in your agreement compels a response to it. A formal notice is different: it triggers the obligations and timelines written into your audit clause, typically starting with 45 days notice.
But ignoring the soft letter is what most often triggers the formal one, so the choice is never between engaging and not engaging. It is between engaging on your evidence or on Oracle's assumptions.
Which agreement governs also decides your obligations, and the answer is less obvious than it looks: many Java claims rest on the OTN click through terms rather than the master agreement, and the two carry very different audit rights.
The commercial shape of the claim is standard by now. Oracle prices the full employee count on the Java SE Universal Subscription, then adds back exposure, commonly framed as up to three years of subscription fees for the period of unlicensed use.
On a 5,000 employee company that construction alone can open north of $2.5M: $630K per year going forward plus a multiple of that in claimed arrears. The back claim is also the most negotiable line in the whole file, and in defended settlements it is routinely reduced or waived entirely.
The employee metric, and the number Oracle will propose
The Java SE Universal Subscription counts people, not processors and not installs. The definition reaches every full time and part time employee, every temporary worker, and the contractors, agents, and consultants who support your internal business operations.
It does not matter how many of them ever touch Java. One qualifying install can price the entire headcount.
| Employee band | List price per employee per month | Annual cost at band midpoint |
|---|---|---|
| 1 to 999 | $15.00 | $90K at 500 employees |
| 1,000 to 2,999 | $12.00 | $288K at 2,000 |
| 3,000 to 9,999 | $10.50 | $756K at 6,000 |
| 10,000 to 19,999 | $8.25 | $1.49M at 15,000 |
| 20,000 to 29,999 | $6.75 | $2.03M at 25,000 |
| 30,000 to 39,999 | $5.70 | $2.39M at 35,000 |
| 40,000 plus | $5.25 | $2.52M at 40,000, larger counts by negotiation |
Two things follow from the table. First, the subscription is a seven figure line for most enterprises, which is why the current price analysis belongs in front of your CFO before any Oracle call, not after.
Second, the count itself is negotiable terrain: which entities are in scope, how contractors are counted, and whether a divested or acquired unit belongs in the number are all questions Oracle's opening letter answers in Oracle's favor and a defended settlement answers on evidence.
The Oracle Java Audit Defense playbook, 2026 edition
The full defense sequence: the response templates for each stage, the inventory method that removes 60 to 90 percent of claimed exposure, and the settlement structures that close 5 to 15 times below the opening claim.
Get the white paper →The soft audit window, where the best settlements close
Most settlements that close at favorable buyer side terms originate in the soft audit window, not in the formal audit. The reason is structural: at stage two the file still belongs to people measured on revenue and relationship, the claim has not been formalized, and no contractual clock is running.
Once GLAS signs the notice, the file is owned by people measured on findings.
The window rewards preparation and punishes improvisation. Three moves in this phase are truly irreversible, and all three feel helpful in the moment:
- Confirming a headcount on a call. The number you mention becomes the floor of every later conversation. Give process, not numbers: we are reviewing our estate and will respond through a defined channel.
- Running Oracle supplied discovery. The Oracle audit scripts collect more than Java, and their output is Oracle's evidence, not yours. Run your own tooling first, on your own timeline.
- Self reporting through a portal. A portal submission is a signed admission with none of the protections a negotiated settlement carries. Nothing obliges you to use it.
Everything else, including a soft letter you have already answered badly, can be renegotiated. What cannot be recovered is time: the engagements that close fastest and lowest are the ones where the buyer arrives at the first substantive call with a verified inventory and a priced alternative.
Our audit defense guide covers the response sequence step by step, and the triggers analysis explains what put you on the list in the first place.
The formal audit, when GLAS takes the file
The formal notice cites the audit clause of a named agreement, is addressed to a named executive, and typically gives 45 days before fieldwork. From here the process runs on the contract: data requests, discovery, a findings report, and a resolution deadline.
Three to six months from formal notice to signature is the normal range in the engagements we support, and the ceiling is usually set inside the first four weeks, before any script has run.
The findings report deserves more skepticism than most buyers give it. It is built from discovery output plus assumptions: that every install is commercial use, that every employee is in scope, and that the arrears period runs to the maximum.
Each assumption is contestable, and the reclassification work is where most of the exposure disappears:
- Third party redistributions. Java shipped inside another vendor's product is commonly licensed by that vendor, not by you.
- Free use terms. Oracle JDK 17 and later under the NFTC terms, development only use under OTN, and OpenJDK builds carry no subscription obligation.
- Removable leftovers. Old JDKs on decommissioned servers and forgotten developer installs count in discovery and vanish under remediation.
What we saw across Java engagements, 2024 to 2026
Across the 40 to 60 Oracle Java licensing engagements Fredrik Filipsson ran or advised between 2024 and 2026, of which roughly 30 to 40 involved a live Oracle approach, the sequence was more standardized than in any other Oracle practice. Three patterns held across nearly every file:
Oracle opened on the full employee count and settled 5 to 15 times lower once the estate was evidenced rather than assumed.
A verified inventory removed most claimed exposure by reclassifying installs as third party builds, free use terms, or removable leftovers.
The third pattern was about alternatives. Buyers who had priced an OpenJDK migration before the first Oracle call closed faster and lower than buyers who only argued about the count, because the subscription was suddenly competing with a costed exit instead of with nothing.
In one retail engagement the combination of a clean inventory and a credible migration path closed a global Java audit at zero cost.
The same record shows where buyers lose. Every engagement that settled near Oracle's opening number shared at least one of the three irreversible moves from section four, made before advisors were involved. The process is forgiving of almost everything except volunteered numbers.
Your first five moves
Whatever stage the letter says you are in, the defense sequence starts the same way. These five moves, in this order, protect every later option:
- Acknowledge process, concede nothing. Respond to any letter within its window through a single named channel. No numbers, no headcounts, no install counts, on any call.
- Run your own inventory first. Discover every Java install with your own tooling: version, vendor build, use, and the license terms that actually apply to each. This is the evidence everything else stands on.
- Reclassify before you count. Strip third party redistributions, free use terms, and removable installs out of the estate. This is where 60 to 90 percent of the claimed exposure goes.
- Price the exit. Cost an OpenJDK migration for the estate that remains, even if you never execute it. A priced alternative changes the negotiation more than any legal argument. Our Java licensing pillar covers the migration decision in depth.
- Scope the deal, not just the price. If a subscription is the outcome, negotiate the employee definition, the entity scope, the term, and a written waiver of back claims, not just the rate. The defense service runs this sequence with you, on your side of the table.
Frequently asked questions
What triggers an Oracle Java audit?
Download and patch activity matched to your company is the most common signal: security patch downloads under the OTN terms after April 2019 map your IP ranges to commercial use. Support renewals, expired legacy Java SE agreements, and M&A activity are the other frequent triggers.
By the time outreach arrives, the account has usually been scored for months.
Do we have to respond to a soft audit letter?
Contractually, no. A soft letter is not an audit demand and nothing compels a response.
Practically, ignoring it is the most common trigger for a formal audit notice under the master agreement, so the right move is to respond with process while running your own inventory, not to go silent and not to volunteer numbers.
What does the Java SE Universal Subscription cost?
List runs from $15.00 per employee per month for companies of 1 to 999 employees down to $5.25 at 40,000 plus, and the metric counts all employees plus supporting contractors, not just Java users. A 6,000 employee company prices around $756K per year at list before negotiation.
How is the employee count defined?
Broadly. Every full time and part time employee, every temporary worker, and every contractor, agent, or consultant supporting internal business operations counts, whether or not they use Java.
The scope of that definition, which entities it reaches and how contractors are counted, is one of the most negotiable parts of any settlement.
How long does an Oracle Java audit take?
Three to six months from formal notice to signature is the normal range in the engagements we support. The soft outreach phase before it can run 30 to 90 days, and the ceiling on the eventual settlement is usually set within the first four weeks after the formal notice, before discovery completes.
Can we still move to OpenJDK after the letter arrives?
Yes, and pricing that move is one of the strongest levers you have even mid audit.
The audit covers past use, so a migration does not erase claimed arrears, but a credible costed exit changes what Oracle can charge for the future, and in our engagements it consistently produced faster and lower settlements.
