Govern Oracle Java in 2026 without an open ended bill
Oracle prices Java SE only on total employee count, so a 14,000 employee estate sits at a $1.39M annual list bill in 2026 from a few hundred real installs. Treat the subscription as a time boxed bridge, not a steady state, and you can hold three year spend near $1.07M instead of $4.16M.
Prepared by Redress Compliance · June 2026 · Representative 14,000 employee Oracle Java estate scenario (benchmark scenario, not a quote)
Executive Summary
Since 2023 Oracle has sold Java SE only on the Universal Subscription, priced per employee per month. The metric counts your entire workforce, not the machines that run Oracle JDK. List rates in 2026 run from $15.00 per employee per month at the smallest band to $5.25 above 40,000 employees.
A 14,000 employee enterprise sits in the 10,000 to 19,999 band at $8.25 per employee per month. That is $1,386,000 a year at list, even when only a few hundred servers run Oracle Java. Doing nothing for three years costs roughly $4.16M before any back support claim.
Java is the rare Oracle line where a clean exit exists. Free OpenJDK builds from Eclipse Temurin, Amazon Corretto, Microsoft, and Azul are binary compatible. Across roughly 30 to 45 Oracle Java reviews Fredrik Filipsson handled in 2024 to 2025, a time boxed subscription paired with a migration plan cut the run rate far below the opening number.
This playbook covers how the employee metric works, the OpenJDK alternatives and their support models, the audit telemetry to disable, the embedded Java traps inside third party software, and a 3 year plan that contains spend without losing capability.
How does Oracle Java Universal Subscription pricing actually work?
Oracle charges for Java SE on a single metric: your total employee count. The 2023 model replaced the old per processor and named user plus subscriptions. There is no per install option left to buy. The count includes full time and part time staff, contractors, temporary workers, and agents, whether or not they ever touch Java.
The rate falls in bands as headcount rises, but the per employee charge still applies to every head. So a large enterprise running Oracle Java on 1% of its machines pays for 100% of its people.
The 2026 list bands
| Employee band | List rate /emp/mo | Annual /employee |
|---|---|---|
| 1 to 999 | $15.00 | $180.00 |
| 1,000 to 2,999 | $12.00 | $144.00 |
| 3,000 to 9,999 | $10.50 | $126.00 |
| 10,000 to 19,999 | $8.25 | $99.00 |
| 20,000 to 29,999 | $6.75 | $81.00 |
| 30,000 to 39,999 | $5.70 | $68.40 |
| 40,000 to 49,999 | $5.25 | $63.00 |
Source: Oracle Java SE Universal Subscription Global Price List, USD, current 2026 list bands. Above 50,000 employees the rate is negotiated.
The legacy subscription one way door
If you still hold a pre 2023 per processor or named user plus Java subscription, you cannot grow it. Oracle will let those agreements lapse but not expand. At renewal the only product on the price list is the employee metric, so any increase forces the move. Plan the exit before that renewal, not at it.
What are the OpenJDK alternatives to Oracle Java?
The Java language and the OpenJDK runtime are free and open source. The fee buys Oracle's branded build and its support, not the platform. Four production grade OpenJDK distributions are binary compatible with Oracle JDK, so most estates can swap the runtime with no code change.
| Distribution | Backed by | Runtime cost | Commercial support |
|---|---|---|---|
| Eclipse Temurin | Eclipse Adoptium | Free | Community, plus paid options via members |
| Amazon Corretto | AWS | Free | Included for AWS workloads, no separate SLA |
| Microsoft Build of OpenJDK | Microsoft | Free | Supported for Microsoft and Azure customers |
| Azul Zulu and Platform Core | Azul | Zulu free, Platform Core paid | Full commercial SLA, priced per core or per JVM |
Long term support releases (Java 8, 11, 17, 21) are available across all four. Match the LTS version your applications certify against.
What does support actually cost after the swap?
The decision is rarely Oracle versus free. It is Oracle's per employee bill versus a per estate support contract from a vendor like Azul, plus the option of running Temurin with no contract on lower risk workloads. The comparison below uses the same 14,000 employee estate with around 580 Oracle JDK installs.
| Sourcing option | Basis | Annual cost |
|---|---|---|
| Oracle Java Universal Subscription | 14,000 employees at $8.25 list | $1,386,000 |
| Oracle negotiated | Benchmark, about 35% off list | $900,000 |
| Azul Platform Core | Benchmark, around 580 JVMs supported | $210,000 |
| Eclipse Temurin | Runtime only, no support contract | $0 |
Benchmark ranges: Redress Compliance advisory engagement file, 2024 to 2025. Azul figure is a representative estate, not a quote.
How do you defend a Java audit and which telemetry should you disable?
An Oracle Java review rarely starts as a formal audit. It starts as a friendly email from Oracle's Java sales team citing downloads tied to your domain. The data behind that email comes from telemetry most enterprises leave on by accident.
The signals Oracle reads
- Download records: Oracle logs paid Java SE downloads from oracle.com against the corporate accounts and email domains that fetched them.
- Java Usage Tracker: the JDK can write a usage log through the usagetracker.properties file that Oracle can request during a review.
- Auto update pings: the Oracle JRE checks for updates against oracle.com, which confirms live Oracle builds on your network.
- Support tickets: My Oracle Support cases that reference Oracle JDK versions place the build inside your estate on the record.
The first number you confirm anchors the whole conversation. Confirm headcount and install scope on your terms, in writing, after you have mapped the estate, not in the opening call.
Where does embedded Java in third party software become an audit trap?
Plenty of commercial applications ship a Java runtime inside their installer. The contract nuance matters. Java that an ISV bundles and supports under Oracle's restricted use or third party terms does not pull you into the employee metric. The trap is the separate install you add yourself.
The two patterns that trigger a bill
- Self installed Oracle JDK: if you download and install Oracle JDK to run a vendor app, rather than using the runtime the vendor ships, you owe the subscription.
- Version drift: patching an embedded Oracle runtime with a fresh oracle.com download converts a covered install into a billable one.
| Scenario | Who licenses Java | Counts toward employee metric |
|---|---|---|
| Vendor ships and supports its own JRE | The vendor | No |
| You install Oracle JDK to run that app | You | Yes |
| You replace the runtime with OpenJDK | No fee | No |
Confirm each vendor's Java entitlement in writing. The exemption only holds while the ISV ships and supports the runtime it bundles.
Where the common advice on Oracle Java is wrong
The standard reseller pitch is to true up to the employee count and negotiate a discount. We disagree. Paying per head for a few hundred installs is the most expensive way to run a free platform. In most of the Oracle Java reviews Fredrik Filipsson handled in 2024 to 2025, the right move was to buy a short subscription as cover while migrating off Oracle JDK, then let it lapse. The buyer side move is to treat the subscription as a bridge with an end date, never a renewing line.
You are not buying Java. You are renting a bill that scales with your headcount. The exit is an engineering project, not a negotiation.
What does a 3 year Java containment plan look like?
Containment is a sequence, not a single negotiation. Year one buys time and caps exposure. Year two moves the bulk of the estate to OpenJDK. Year three leaves a small supported core and lets the Oracle subscription lapse.
Cap and map
Buy a one year subscription as cover, freeze the headcount basis, and complete a verified install map. Disable the audit telemetry.
Migrate the bulk
Move non critical and standard workloads to Temurin or Corretto. Stand up Azul support for the regulated and high risk core.
Exit and lapse
Complete the migration, retire the last self installed Oracle JDK builds, and let the Oracle subscription expire. Keep Azul on critical JVMs only.
| Path | Year 1 | Year 2 | Year 3 | 3 year total |
|---|---|---|---|---|
| Status quo at list | $1,386,000 | $1,386,000 | $1,386,000 | $4,158,000 |
| Containment plan | $720,000 | $260,000 | $90,000 | $1,070,000 |
| Difference | $666,000 | $1,126,000 | $1,296,000 | $3,088,000 |
Benchmark ranges: Redress Compliance advisory engagement file, 2024 to 2025. Figures are a representative estate, not a quote.
Recommendation
Stop treating the Universal Subscription as a permanent line and run it as a funded exit. The metric will never reward you for low install counts, so the only durable saving comes from leaving Oracle JDK behind on a plan you control.
- Buy time, then leave: use a one year subscription as audit cover while a verified install map and an OpenJDK migration run in parallel.
- Right size the support: place commercial support only on the regulated and high risk core, and run Temurin or Corretto with no contract everywhere else.
We are glad to tie a meaningful part of the fee to delivered value.