Oracle Java audit defense, from the letter to signature. A fixed sequence and one voice.

Once Oracle's Java letter arrives, the sequence is fixed. What changes the outcome is how much of it you finish before you say anything substantive, because the first month sets the ceiling on what you pay.

What should you send Oracle in the first five days after a Java audit letter?

Send a reply that contains process and nothing else, inside five days. Every early concession narrows what the later stages can recover: a headcount mentioned on a call becomes the starting figure, and a console login becomes data Oracle interprets on its own terms. The reply buys time to build your own evidence.

• Acknowledgment. Confirm receipt and the date, and say nothing about your Java use.
• One named contact. Every message to and from Oracle goes through this person.
• Scope and clause in writing. Ask which entities, products and period Oracle considers in scope, and which agreement and section it relies on.
• Your schedule. Propose dates for a written first response, and decline a discovery call as the main channel.
• Left out on purpose. Employee numbers, install counts, tool output, attachments and any view on whether you are licensed.

Which clause gives Oracle the right to audit your Java use?

If you signed Oracle's current master agreement, Schedule P allows an audit "upon 45 days written notice". Your cooperation expressly includes running Oracle data measurement tools and handing over the output, and any shortfall must be remedied within 30 days of written notification. Older agreements use different wording, so read your own.

Many Java letters reach companies whose only Oracle relationship is a download. There the letter may cite no audit clause, and it reads as a sales approach backed by license terms. The written answer tells you which situation you are in, and legal should see it before anyone replies further.

How long does an Oracle Java audit take from notice to signature?

Three to six months from first formal contact to signature is normal. The ceiling is set in the first four weeks, reconciliation runs through roughly day 60, and the account team leads the commercial close over the last eight weeks.

Treat the 45 day notice period, where your agreement has one, as the outer limit for the first two rows. It gives you room to finish discovery before any Oracle measurement starts.

Why does the first month decide the outcome?

The first number Oracle hears becomes the reference point for everything after it. By week four you either hold dated evidence and are negotiating from it, or you are still asking questions while Oracle prices the gap.

How do you build your Java evidence before Oracle sees anything?

Run your own discovery first, between day 6 and day 20, across everything that can carry a Java runtime: servers, desktops, container images, build agents and appliances. Record the runtime name, vendor string, version and install path for each host. Run the roster review in parallel.

Never run Oracle supplied discovery before your own, because it answers more than the question asked and you cannot take the answer back. Expect surprises. Our sweeps routinely found Oracle builds on 15 to 35 percent of hosts the buyer believed ran a free distribution, mostly old desktop installs, copied base images and runtimes bundled inside other software.

How do you tell an Oracle build from a free distribution?

Classify each install by what the runtime reports about itself. The product name in a spreadsheet is a starting point only. "java -version" shows "Java(TM) SE Runtime Environment" for Oracle JDK and JRE builds and "OpenJDK Runtime Environment" for OpenJDK builds.

Watch one trap: Oracle's own OpenJDK builds from jdk.java.net report Oracle Corporation in the java.vendor property yet carry no fee, so the vendor string alone cannot settle those hosts. Our note on telling Oracle JDK from OpenJDK covers the other checks.

Runtimes delivered inside a supplier's appliance fall under that supplier's terms, so push those hosts back to the supplier with the contract reference. Our page on which versions of Java are free has the full version history.

Freeze new Oracle downloads at the same time. Block them at the proxy and switch off desktop JRE auto update, because each new download is fresh dated evidence.

What should you send Oracle, and what should stay inside?

Send conclusions and keep the raw data inside. A dated discovery export scoped to Java runtimes is evidence. A CMDB dump, a login to your agent console or an unbounded HR roster gives Oracle material to reinterpret.

The counter position document is short and deliberately plain, because leading with what you can prove makes Oracle respond to your account of the facts. It covers:

1. Scope: entities, products and period.
2. Method: how and when discovery ran.
3. Findings, by vendor string and version.
4. What is licensable and why, then what is not and why.
5. The number that follows.

If your agreement carries the data measurement tools wording, you cannot simply refuse Oracle's scripts. Agree the host list and output scope in writing, run your own sweep first, and review every output file before it leaves your network. A script run is not an admission of the count.

Who should speak to Oracle during a Java audit?

One named owner speaks for the company, in writing, and everyone else refers to that person. The most expensive sentences in a Java audit are said by people who were never briefed.

• Legal. Speaks to the clause and the scope only.
• Procurement. Enters at the commercial stage and never names a budget.
• HR. Supplies the dated roster to the owner and speaks to no one at Oracle.
• Engineering. Answers the owner, never Oracle.
• The executive who received the letter. Acknowledges and refers.

The riskiest conversation is usually the routine account review, where a friendly Java question gets a friendly answer from an architect who does not know an audit is open. The cheapest control in the whole response is one paragraph sent to every plausible recipient.

The trigger patterns that come before the letter are in our audit triggers analysis, and the enforcement machinery behind it in the GLAS versus LMS review.

Where can you reduce the employee count in an Oracle Java audit claim?

Start with the population, because under the employee metric the count multiplies everything else. Contractor and outsourced populations are the largest recoverable dispute in almost every engagement. Classification of hosts recovers next, and the retroactive period closes the set.

Oracle counts all your full time, part time and temporary employees, plus those of agents, contractors, outsourcers and consultants that support your internal business operations, whether or not they use Java. List pricing runs from $15 per employee per month down to $5.25 in the published bands.

Population: which contractors belong in the count?

Oracle's first figure is often a headline number from your annual report or a public profile, with contractors added on top. Write down the reason for each exclusion when you pull the roster, with the date attached. These disputes recover most:

• Double counting. Contractors who appear in HR records and again in a supplier's headcount.
• Suppliers outside internal operations. Staff delivering a finished service from their own premises. This is arguable, so support it with the supplier contract.
• Leavers and divested entities. People and subsidiaries gone before the count date. See our note on divestitures and acquisitions.
• Peak counts. A seasonal peak used as the standing figure, which is why the count date belongs in writing.

Our guide to contractors in the Java employee count sets out the arguments by category.

Classification and period: which hosts, and since when?

Decide each host by vendor string, with a dated export behind every line. Free distributions come out of the claim, and supplier appliances go to the supplier. Then ask how far any retroactive element reaches and on what evidence. Make Oracle show that evidence, and never offer to prove your own history for it.

A worked example: taking a claim apart line by line

Say Oracle claims 7,800 employees: 5,200 on your HR roster plus 2,600 contractors. That sits in the 3,000 to 9,999 band at $10.50 per employee per month, or $126 a year, and the letter prices three years of back subscription at list.

The reconciled figure is $1,682,100 lower, a cut of about 57 percent, before commercial talks begin. Most of it came from the period, which is why install dates matter as much as install counts. Run your own figures through the Java calculator, and see the Java pricing analysis and the OpenJDK comparison for the price and migration sides.

What will Oracle say during a Java audit, and how should you answer?

Most standard lines aim to move you off the written channel or onto Oracle's data. Prepare the reply before the call.

• "This is an informal review of your Java usage." Ask in writing whether it is made under an agreement, and which clause.
• "Run our script and we can close this quickly." Your own review is underway, and dated findings follow on your schedule.
• "Your annual report shows this many employees." The count follows the contract definition, and your written position will state the roster date and each exclusion.
• "Back subscription for the full period is standard." Ask for the evidence that dates first licensable use.
• "This price is only available if you sign by quarter end." You will sign when the reconciliation is complete. Oracle's quarter ends, and its fiscal year end on May 31, are targets for the account team, and your timetable should not bend to them.

How do Oracle Java audits settle, and what should the agreement say?

The account team leads the close, and the finding is only the opening price. Decide the settlement shape yourself before the number on the table decides it:

• Full subscription. Java SE Universal Subscription across the defined count, with the retroactive element folded into the term.
• Narrow subscription over an evidenced core. Where your contracts allow it. Oracle allows legacy Java SE Subscription customers renew to the extent the existing order permits, subject to confirming that current use matches the counts in that order.
• Funded exit. A short term sized to your migration plan, with no renewal obligation.

Attach the close to your Oracle renewal calendar, because settling Java inside a larger renewal usually buys more than settling it alone. The term, the escalator cap and the right to reduce the count are together worth more than the headline discount.

Contract wording to ask for

• A start date you can evidence. A backdated term is a retroactive claim under another name.
• A cap on the annual escalator. A fixed percentage, stated in the order, for every year of the term.
• A right to reduce the count. When the workforce falls, the fee falls at the next anniversary.
• A fixed count definition. Roster date, entities and excluded contractor categories, written into the order.
• A release of past use. Confirmation that the audited period is closed.

See Java contract language on headcount caps and price holds and uplift caps for sample wording.

Is a migration plan worth costing if you intend to stay on Oracle?

The usual advice says an OpenJDK threat only works if you mean it, so buyers planning to stay skip the work. We disagree. A costed migration plan moved the final number in about three of four cases, including where the buyer never meant to execute it, because Oracle prices against your alternative.

Keep the plan short: Oracle builds by application, the replacement distribution, test effort, third party support implications and a realistic date. Our migration decision guide shows how to cost it.

What have we seen in recent Oracle Java audit responses?

Across roughly 30 to 40 live Oracle Java audit and questionnaire responses I ran or advised in 2024 and 2025, the outcome tracked the discipline of the first month far more closely than company size.

• Early numbers stuck. Engagements that leaked a number early argued down from it for the rest of the process, without exception.
• Scoped exports closed faster. Oracle had less to reinterpret.
• Evidence cut the claim. A count that stood up plus an isolated Oracle footprint removed 30 to 60 percent of the claim.

Evidence built before Oracle sees anything is worth more than any argument made after it.

The wider audit approach sits in our Oracle audit response guide and the Java audit guide, which covers the stages before a formal notice.

What to do next

1. Within five days. Send the process only reply: one contact, scope and clause requested in writing, no numbers, no access, no call.
2. The same week. Send the one paragraph briefing and freeze new Oracle downloads.
3. Days 6 to 20. Run your own discovery before anything of Oracle's, recording vendor string and version per host.
4. In parallel. Pull the dated roster and write down each exclusion with its reason, contractors first.
5. By week four. Send the counter position document and nothing beyond it.
6. Before the close. Cost a migration plan whether or not you will run it, and choose the settlement shape. Our Oracle practice runs the sequence with you.

Frequently asked questions