Oracle's Master Agreement gives you 45 days to respond to a formal Java audit notice, and how you spend those days sets the settlement range. This plan maps the window from named-executive receipt through data scoping to the response deadline, and tells you exactly what to do in each phase.
Oracle's Master Agreement gives you 45 days to respond to a formal Java audit notice, and how you spend those days sets the settlement range. This plan maps the window from named-executive receipt through data scoping to the response deadline, and tells you exactly what to do in each phase.
Oracle's standard audit clause is short and specific: "Upon 45 days written notice, Oracle may audit Your use of the Programs to ensure Your use of the Programs is in compliance with the terms of the applicable order and the Master Agreement. Any such audit shall not unreasonably interfere with Your normal business operations." That single sentence is the entire basis for the pressure you are about to feel. Note what it says. It grants Oracle 45 days of notice before an audit begins. It does not grant Oracle the right to a completed data submission inside 45 days, and it does not grant Oracle control over your measurement methodology.
In practice, we read the 45 days as your window to acknowledge, scope, and control, not as a deadline to hand over the Data Collection Script output. In roughly 40 engagements closed across 2024 and 2025, the buyers who lost the most money treated the 45 days as a countdown to compliance. The buyers who preserved leverage treated it as a countdown to preparation. The distinction is worth several hundred thousand dollars in a mid-market claim and several million in a large enterprise one.
Separately, there is a second clock most executives miss. If the audit identifies non-compliance, Oracle's clause requires you to "remedy such non-compliance within 30 days of written notice," which may include payment of fees for additional licenses. That 30-day remediation clock is a different animal from the 45-day notice window, and it only starts after findings are issued. Do not conflate them. Confusing the two is how buyers end up believing they have 45 days total when they actually have a notice window followed by a negotiation, followed by a much later remediation demand. For the full letter-to-close arc that sits around this window, see the Oracle Java audit response playbook.
The 45 days is your window to control the process. It is not Oracle's deadline for your surrender.
The formal audit letters arriving in 2026 look meaningfully different from the soft outreach emails that preceded them. They are typically addressed to a named C-suite executive, usually the CIO, CFO, or General Counsel, and signed by an Oracle GLAS representative rather than a salesperson. This is deliberate. Oracle routes the letter to someone senior enough to feel personally accountable and junior enough in licensing knowledge to react emotionally. The soft-audit era, where Oracle's Java team sent casual usage inquiries you could ignore, is giving way to formal notices issued under GLAS, the function formerly branded LMS. If you are unsure which stage you are at, read our breakdown of what changed in how Oracle enforces Java.
Your first move in the first five days is containment, not engagement. Oracle's GLAS team routinely calls within days of the letter to schedule an introductory meeting, creating implicit pressure to engage immediately. Do not confuse urgency with obligation. Acknowledge receipt in writing, confirm you are reviewing the request with legal and licensing advisers, and explicitly invoke your 45-day window. Do not accept a call, a demo, or a proposed methodology in this phase.
That last point is the single most expensive mistake we see. Most client attorneys treat the date of the audit notice letter as the effective date for reporting usage. Trying to "clean things up" after the notice date can cause legal problems and, critically, cannot rewrite what the measurement will show. The Data Collection Script captures historical usage footprints, including the first and last dates a feature was used, so a rushed uninstall on day 3 is both risky and pointless.
This is the phase where you build your own picture of reality before Oracle imposes theirs. Oracle's default position is to over-state your exposure on two axes at once: employee headcount and installation footprint. Across roughly 35 to 45 Java engagements we closed in 2024 and 2025, the employee count Oracle quoted was on average 18 to 28 percent higher than the count the buyer could defend after a clean headcount audit. You cannot dispute a number you have not measured yourself.
Run your own discovery independently of Oracle's tooling. The goal is a defensible inventory of where Oracle Java is actually installed, which builds are Oracle's versus OpenJDK, and which deployments fall under the free No-Fee Terms and Conditions (NFTC). Expect a gap between what you think you have and what you actually have. In our experience the discovery gap runs 15 to 35 percent; we cover that in detail in finding Oracle Java before Oracle does.
Now you engage Oracle, on your terms. The central risk of the entire audit lives here. Organisations that immediately agree to Oracle's proposed Data Collection Script methodology and timeline have, in effect, handed Oracle control of the process. The DCS captures historical usage data, which means any remediation that takes place after the measurement snapshot is too late to affect Oracle's findings. The snapshot date is the fulcrum of the whole audit, and it is negotiable in ways Oracle will not volunteer.
You are not contractually required to run Oracle's scripts. The license agreement does not compel you to install or deploy Oracle's tooling if you can gather the required information completely and accurately yourself. Most companies default to the scripts because they lack the internal tooling to produce equivalent data, but that is a resourcing choice, not a legal obligation. Where you have credible independent discovery data, present it and negotiate the DCS scope down. If Oracle pushes their Java Management Service as the self-report route, understand the trap first: see whether you should use Oracle's JMS tool to self-report.
| Scoping item | Oracle's opening position | Defensible buyer position |
|---|---|---|
| Employee count | Total headcount plus all contractors with system access, often pulled from LinkedIn or annual reports | Verified payroll count plus only contractors supporting internal business operations |
| Measurement tool | Oracle Data Collection Script, run broadly, on Oracle's timeline | Your own inventory data where complete and accurate; DCS scoped narrowly if used |
| Snapshot date | As late as possible, capturing maximum historical usage | Fixed and agreed, with clarity on what historical window it captures |
| Installation scope | Every device and environment, including virtualization and cloud | Oracle-branded JDK only, excluding OpenJDK and NFTC-eligible use |
Contractor counting is the single largest dispute we handle. Oracle's default treats every contractor with system access as an employee. We have defended a narrower definition in roughly four out of five engagements. Given that Java is priced on the employee metric at a published $15 per employee per month at the entry tier, dropping down to $10.50 or lower at volume, every disputed body in the count carries a direct annual dollar cost multiplied across a three-year subscription.
The snapshot date is the fulcrum of the audit. Negotiate it before you run a single script.
By now you should have your own numbers and a scoped measurement plan. Use these days to model the exposure Oracle will likely claim, and to build the counter-position. The Java SE Universal Subscription is sold per employee, where "Employee" is defined to include all full-time, part-time, and temporary staff plus the equivalent staff of your agents, contractors, outsourcers, and consultants who support your internal business operations. Crucially, the count is determined by total employees, not by the number who actually use Java. That definition is the entire battleground.
Model the backdated exposure too. Oracle can impose fees covering three years of past unlicensed usage, calculated at current subscription rates. For a company with 5,000 employees, that back-penalty component alone can exceed $1.8 million before any go-forward subscription. The mechanics of that reach-back are worth understanding in full; we cover the limits and defenses in the three-year penalty window.
| Cost component | How Oracle calculates it | Buyer counter-lever |
|---|---|---|
| Go-forward subscription | Total employee count times tier rate times 12 | Reduce the headcount and the contractor sweep |
| Three-year back penalty | Three years of past use at current rates | Challenge the period, document NFTC and OpenJDK coverage |
| Support uplift | 22% support fee escalating 8% annually on backdated licenses | Structure as a clean subscription, not a legacy license plus support |
Support compounding is the unseen cost most buyers miss. Backdated licenses can carry 22 percent support fees that escalate at eight percent annually, so the shape of the deal matters as much as the headline number. A subscription structure avoids that legacy support trap entirely. Meanwhile, note that meaningful volume discounts have effectively disappeared on Java subscriptions since 2025, so your leverage is not in the rate card. It is in the count, the period, and the OpenJDK alternative that lets you walk away. For the wider procurement context, see our 20 critical procurement insights on Oracle Java SE.
The end of the 45 days is not the end of the audit. It is the point at which your considered, evidence-backed response is due, and it marks the transition from audit posture to negotiation. Do not let the calendar spook you into an early capitulation. If your discovery and scoping work needs more time to be accurate, request an extension in writing with a specific reason; Oracle's clause obliges them not to unreasonably interfere with normal business operations, and a reasonable extension request is consistent with that.
When you respond, respond with your data, your headcount, and your scoped view of installations. Do not simply confirm Oracle's numbers. The median discount from Oracle's first quote to a three-year signature has sat between 22 and 41 percent depending on tier in our recent engagements, and our overall reductions against the initial claim average around 68 percent when the count, the period, and the deployment scope are all contested properly. That reduction does not come from asking politely. It comes from having built the evidence during days 6 through 40. For the mechanics of the close itself, work through the Oracle Java audit response playbook and, if the formal notice framing is new to you, the pillar on how GLAS formal notices work and how to respond.
Reductions of 60% and more come from evidence built in the window, not from goodwill at the deadline.
If a named-executive GLAS letter has landed, the clock is running. Acknowledge receipt, invoke the 45 days, freeze communications through one channel, and start your own discovery this week. Do not run Oracle's scripts, do not accept a snapshot date, and do not remediate anything until you have measured and modeled the exposure yourself. The window is short but sufficient. Use it to build the count and the scope you can defend, then hand a hardened position to negotiation. Buyers who do this consistently pay a fraction of the opening claim; buyers who treat the 45 days as a deadline to comply pay close to it.
White Paper · Advisory
The Software Audit Defense Playbook
Turn an audit notice into a controlled negotiation: control scope, build your ELP, and compress the opening claim toward ~30%. Read it free.
No. The 45 days is Oracle's notice period before an audit begins, not a deadline to complete a data submission. You must acknowledge the notice and begin cooperating in good faith, but you can and should negotiate the measurement methodology, the snapshot date, and reasonable timing extensions during and beyond that window.
No, they are two separate clocks. The 45 days is written notice before the audit. The 30-day remediation obligation only begins after Oracle issues formal findings of non-compliance, and it requires you to remedy within 30 days of that written notice. Confusing the two leads buyers to rush unnecessarily.
No. Most attorneys treat the date of the audit notice letter as the effective reporting date, so cleaning up afterward can create legal problems. It also does not help, because Oracle's Data Collection Script captures historical usage including the first and last dates a feature was used. Preserve the environment and challenge the count instead.
Not strictly. The license agreement does not require you to install Oracle's scripts if you can gather the required information completely and accurately yourself. Many companies use the scripts only because they lack equivalent internal tooling. Where you have credible independent discovery data, you can present that and negotiate the DCS scope down.
Substantially. Java is priced per employee, and Oracle's definition sweeps in contractors, temporary staff, and outsourcers who support internal operations. In our engagements, Oracle's quoted count ran 18 to 28 percent higher than the defensible count, and contractors were the single largest dispute. Every disputed body carries a direct annual cost across a three-year subscription.
In recent engagements, the median discount from Oracle's first quote to a three-year signature ran 22 to 41 percent, and overall reductions against the initial claim have averaged around 68 percent when the count, the reach-back period, and the deployment scope are all contested with evidence. The reduction is built during the window, not negotiated at the deadline.
The five day, thirty day, and ninety day buyer side framework for responding to an Oracle LMS audit notice, with the contract levers that hold.
Gated with a work email on the download page. No sales follow up you did not ask for.
Get the White Paper →
500+ enterprise clients. 11 vendor practices. Industry recognized. One conversation can change what you pay for the next three years.
One buyer side briefing a week. Renewal signals, audit moves, and the levers that work. No vendor spin.
