In 2026 Oracle moved Java enforcement from soft LMS-style outreach to formal audit notices signed by GLAS and addressed to your C-suite. This guide names who receives the letter, which audit clause it cites, how far back the penalty reaches, and the exact buyer-side sequence to run before you answer.
In 2026 Oracle moved Java enforcement from soft LMS-style outreach to formal audit notices signed by GLAS and addressed to your C-suite. This guide names who receives the letter, which audit clause it cites, how far back the penalty reaches, and the exact buyer-side sequence to run before you answer.
For most of the period after Oracle repriced Java to the employee metric in 2023, Java enforcement arrived as a friendly nudge. A sales representative emailed a procurement contact, referenced a webinar or a security bulletin, and asked whether you had thought about a Java SE Universal Subscription. That was License Management Services (LMS) working the top of the funnel. In 2026 that posture hardened. Tactical Law Group reported in April 2026 that the soft outreach is giving way to formal audit notices issued under Oracle's license management function, now branded Global Licensing and Advisory Services, or GLAS.
The distinction is not cosmetic. A sales email invites a conversation you can decline. A formal GLAS audit notice invokes a contract clause, names a deadline, and creates a documented record that Oracle can point to later if the matter escalates. The buyer-side error we see most often in 2026 is treating the GLAS letter like the old LMS email: replying quickly, replying warmly, and replying with data. Each of those instincts is wrong once the letterhead changes. Understanding the mechanics of the new notice is the difference between a managed negotiation and a claim that opens at seven or eight figures. We cover the mechanics change in depth in GLAS vs LMS: what changed in how Oracle enforces Java, and this pillar ties the whole sequence together.
A sales email invites a conversation you can decline. A formal GLAS audit notice invokes a clause, names a deadline, and builds a record Oracle can use later.
The formal GLAS letters differ from prior outreach in two visible ways. First, per Tactical Law Group's April 2026 reporting, they are typically addressed to a named C-suite executive: the CIO, CFO, or General Counsel. Second, they are signed by an Oracle GLAS representative rather than a salesperson. Both choices are deliberate. Addressing the CFO or GC bypasses the IT asset manager who might quietly reconcile the estate, and puts the matter in front of someone who reads it as legal exposure rather than a procurement task. It also pressures the executive to respond fast, which is exactly the reflex you want to resist.
On the question of who ends up on the list, the dominant targeting signal in 2026 is download history. When anyone in your organization downloads an Oracle JDK build, accepts the license, and (this is the amplifier) signs in to fetch updates from My Oracle Support, that activity is associated with your organization. Oracle Java Licensing reported in April 2026 that years of accumulated download and support records give Oracle a strong basis to believe Oracle Java is present. This is not telemetry from the runtime; it is server-side log data Oracle already holds. If your teams have been pulling Oracle JDK builds and patches for years, Oracle has a file on you before the letter is written. The full targeting picture is in Oracle Java audit triggers: what puts you on the list.
A hard 2026-specific trigger sits on the calendar. Per Azul's April 2026 note, JDK 21 receives free updates under the No Fee Terms and Conditions (NFTC) license until September 2026; subsequent updates fall under the paid OTN license. This mirrors the JDK 17 precedent that already fired: BellSoft reported that build 17.0.12 in July 2024 was the last free JDK 17 update, and everything after requires a subscription for production use. Expect GLAS to time notices to organizations most likely to keep patching JDK 21 past the September 2026 cliff.
The GLAS notice will name a contractual basis for the audit. Which clause it cites depends entirely on your existing relationship with Oracle, and the difference matters for how much room you have to push back. Per Tactical Law Group, the letters cite an audit clause either in the company's existing Oracle Master Agreement (if the company holds other Oracle products) or in the Oracle Technology Network License Agreement that governed the original Java download. They name an audit window, commonly forty-five days, and specify whether GLAS conducts the review directly or through a designated third-party auditor.
Here is the point most buyers miss. The OTN License Agreement audit language is extraordinarily thin. The Oracle Java SE license states only: "Oracle may audit an Entity's use of the Programs." That is the entire audit right. There is no notice period defined, no cooperation obligation spelled out, no data-format requirement, no scope boundary, no cure mechanism. Everything else in the demand (the forty-five day window, the employee-count spreadsheet, the virtualization inventory) is Oracle's process preference, not a contractual obligation you agreed to. If your only nexus is the OTN download, you are not obligated to run Oracle's scripts, complete Oracle's questionnaire, or produce a global headcount on Oracle's timeline.
An OMA-based audit clause is different. If you hold a signed Oracle Master Agreement (or the older OLSA or OMA variants) for a database or middleware, that document usually contains a real audit clause with defined obligations. But even then, the clause governs the products under that agreement. Oracle will try to stretch an OMA audit right to cover Java that was downloaded under a separate OTN license. That stretch is contestable. The threshold question in every GLAS engagement is: which paper is Oracle actually standing on? We break the two paths apart in which audit clause is Oracle citing: OTN license vs master agreement.
The entire OTN audit right is one sentence: 'Oracle may audit an Entity's use of the Programs.' Everything else in the demand is process preference, not obligation.
The GLAS notice sets an expansive scope. Per Tactical Law Group, it asks for global employee counts, deployments by version, installation inventories, virtualization and cloud environments, and anything Oracle believes relates to its employee-metric calculation. Read that list again with the pricing model in mind and the strategy becomes obvious. Oracle does not need to prove where Java runs. It needs one qualifying install, plus your total headcount, because the Java SE Universal Subscription prices the entire organization regardless of where or whether Java is deployed.
That is why the mixed-estate trap is so damaging. Oracle Java Licensing reported in February 2026 that a handful of forgotten Oracle JDK installs among thousands of free OpenJDK builds still triggers the employee-wide metric in an audit. You do not get charged for the few Oracle installs. You get charged for every employee in the company. The demand for a global installation inventory is therefore a red herring: Oracle wants the headcount, and it wants a single install to anchor the claim. Giving Oracle a clean, complete installation map does not help you; it confirms the anchor and hands over the multiplier at the same time.
The most abusive scope element is the employee-count demand itself. Oracle's contractual definition of Employee is not your payroll. Per the Java SE Universal Subscription Global Price List, the count is defined as all of your full-time, part-time, and temporary employees, plus all of the full-time, part-time, and temporary employees of your agents, contractors, outsourcers, and consultants that support your internal business operations. The list adds, in plain language, that the quantity of licenses required is determined by the number of Employees and not just the actual number of employees that use the Programs. Oracle's own worked example prices a company at 28,000 (23,000 employees plus 5,000 contractors) at $6.75 per month, landing at $2,268,000 per year.
Oracle sells Java SE Universal Subscription on the employee metric alone. Per the Oracle FAQ, list pricing starts at $15 per employee per month, dropping through published tiers to as low as $5.25 for the largest estates. The tier structure runs $15 (1 to 999 employees), $12 (1,000 to 2,999), and $10.50 (3,000 to 9,999), bottoming near $5.25 around 40,000 to 50,000 employees per Jalasoft and Oracle Licensing Experts data from 2025. Crucially, per Java Negotiations in May 2025, Oracle eliminated the old NUP and Processor metrics for Java in 2023, so there is no consumption-based option to fall back on.
| Total employees | Approx. list rate / employee / month | Annual cost (list) |
|---|---|---|
| 1,000 | $12.00 | $144,000 |
| 3,000 | $10.50 | $378,000 |
| 10,000 | $8.25 (blended est.) | $990,000 |
| 18,000 | $8.25 | $1,782,000 |
| 28,000 (23k staff + 5k contractors) | $6.75 | $2,268,000 |
| 50,000 | $5.25 | $3,150,000 |
The cost shock is real. Jalasoft calculated in September 2025 that a mid-sized company with 1,000 total employees now pays $144,000 annually, a 300 to 400 percent increase over the old per-processor economics. But the number Oracle opens with is routinely inflated. Across 2024 and 2025 engagements, Redress Compliance found that the employee count Oracle quoted was on average 18 to 28 percent higher than the count the buyer could defend after a clean headcount audit. Oracle pulls the number from LinkedIn, from public filings, from prior contract data, or from a stale internal figure, and it seldom reflects the buyer's defensible count after removing double-counted contractors, divested units, and non-qualifying entities.
That gap is your single largest lever. A concrete illustration from a Redress Compliance engagement in December 2025: a global engineering firm's audit opened at 18,000 employees on the Universal Subscription metric at $8.25 per employee per month, landing at $1.78M per year. The defensible count, after reconciling the entity structure and contractor definitions, was materially lower. Every employee you remove is worth the annual rate multiplied by the subscription term. On the reduction achievable in aggregate, Oracle Java Licensing reported in April 2026 that its engagements average a 68 percent reduction against the initial claim, driven by overstated headcount and over-reached back periods.
Oracle's opening headcount runs 18 to 28 percent above the defensible number. Every employee you strip out is worth the annual rate times the term.
The forward subscription is only part of the exposure. A GLAS Java claim also reaches backward for unlicensed historical use. Per Jalasoft's September 2025 analysis, Oracle can impose fees covering three years of past unlicensed usage, calculated using current Universal Subscription rates. For a company with 5,000 employees, those back penalties could exceed $1.8 million on top of the go-forward cost. Note the mechanic: Oracle does not price the back period at what Java cost historically. It prices three years of the past at today's employee metric, which inflates the historical exposure to match the current model.
The compounding gets worse with support arrears. A worked scenario from Atonement Licensing in September 2025 shows an 18,000-employee bank found to have used Java since 2022 facing a claim of roughly $15 million for past unlicensed use: approximately $5M per year for three years, plus 22 percent per year in support arrears. Redress Compliance noted in March 2026 that Oracle often seeks support arrears on the alleged shortfall, sometimes for years, and that this compounding charge can exceed the license cost itself. It is a primary negotiation target precisely because it is the softest part of the claim: there is no meaningful contractual basis for charging support on a subscription you never held.
Practically, the back-penalty number is a starting position designed to make the forward subscription look reasonable by comparison. Oracle rarely intends to collect it in full. The buyer-side move is to contest the reach (when did use actually begin, and can Oracle prove it), contest the rate (why current rates on historical periods), and strip out support arrears entirely. The mechanics of the retroactive window, and where it breaks down, are covered in how far back can Oracle reach: the three-year penalty window.
A newer 2026 tactic deserves its own warning. Oracle has been declining to sell Java subscriptions to certain customers unless those customers first disclose detailed usage and employee-count information. Per Tactical Law Group, some companies that tried to buy their way into compliance were told, in effect, that compliance is not available without first producing the data that typically comes out of an audit. This closes the old escape hatch. In prior years, a nervous buyer could quietly purchase a subscription and move on. Now the purchase request itself becomes the audit intake.
The implication is stark. Reaching out to Oracle sales to buy Java, before you have run your own internal reconciliation, can trigger the exact data disclosure you were trying to avoid. Any proactive purchase conversation must be preceded by your own defensible headcount and a controlled position on what you will and will not disclose. Do not initiate a buy motion until your internal audit is complete and your data perimeter is set. Run the internal work first, as described in conducting internal Oracle license audits.
When the notice arrives with its forty-five day window, the clock feels like an emergency. It is not. The window is Oracle's process preference under a one-sentence OTN clause, not a court-ordered deadline. Your first move is to slow the tempo, not to comply. The following sequence is what we run on GLAS Java notices, and it is expanded day by day in the 45-day Oracle Java audit window: a day-by-day response plan.
Acknowledge receipt in a single sentence, route all further contact through one named person (ideally counsel or a licensing advisor), and instruct every other employee to send Oracle communications to that person unanswered. Do not reply to the substance. Do not confirm any employee number. Do not agree to a call date yet. The most expensive mistakes happen in the first forty-eight hours, when a well-meaning IT manager runs Oracle's script or a procurement lead confirms a headcount on a friendly call.
Ask Oracle, in writing, to identify the specific agreement and clause under which it is auditing. If Oracle cites the OTN license, note internally that the audit right is the single sentence quoted above and that none of the process demands are contractual. If Oracle cites an OMA, pull the actual clause and check whether it covers Java at all. This step alone reframes the negotiation from "how fast can we comply" to "what are you actually entitled to."
In parallel and never shared with Oracle, inventory every Java install across the estate. Separate Oracle JDK (paid or OTN-restricted) from OpenJDK and other free distributions. Identify the OTN traps: BellSoft and Oracle Java Licensing both flag that Oracle JDK 11 downloads freely but forbids free production use, and a fleet of OTN-licensed JDK 11 in production is one of the most frequent large-claim triggers. Expect a discovery gap: shadow installs that neither IT nor Oracle has fully mapped, covered in finding Oracle Java before Oracle does. The goal is to know your true exposure before Oracle does, so you negotiate from knowledge, not fear.
Reconcile your true employee count under Oracle's contractual definition, then challenge it. Remove double-counted contractors, divested entities, and non-qualifying populations. Given that Oracle's opening figure runs 18 to 28 percent high, this is your largest single dollar lever. Document the reconciliation so it survives scrutiny.
Decide what, if anything, you will share, and on what terms. Do not run Oracle's scripts. Do not hand over a global installation map. If you disclose a headcount, disclose your defensible number with your reconciliation, not Oracle's inflated one. Then negotiate toward a forward subscription with the back penalty and support arrears stripped. Redress Compliance data from December 2025 shows most Oracle Java audits settle within 90 to 180 days of the opening letter, and settlements typically take the form of a forward subscription rather than a back fee. The forty-five day window is the opening move, not the finish line.
Oracle will often suggest you deploy its Java Management Service (JMS) to "help" you understand your usage, or invite you to self-report. Both are audit instruments dressed as convenience. JMS reports install and usage data directly to Oracle, converting your own environment into Oracle's evidence base. Self-reporting hands Oracle a confession you were never obligated to write. Under a one-sentence OTN audit clause, you are not required to instrument your estate for Oracle's benefit. We explain why in should you use Oracle's JMS tool to self-report Java usage. The parallel question of what Oracle can already see from download and support logs (versus runtime telemetry) is covered in does Oracle Java phone home.
This is not a handful of test cases. Gartner predicts that by 2026, one in five organizations using Java will be audited by Oracle, leading to unbudgeted noncompliance fees (per Block64, October 2025, citing Gartner). Combine that audit probability with an employee metric that prices the whole company off a single install, a three-year retroactive reach at current rates, and a formal GLAS notice engineered to land on the CFO's desk, and the design intent is clear. Oracle monetized Java by converting a free runtime into an enterprise-wide subscription, then built an enforcement machine to collect on it.
The counterweight is that the claims are consistently over-reached and consistently negotiable. Between the 18 to 28 percent headcount inflation, the contestable back period, the unsupported support arrears, and the reported 68 percent average reduction against opening claims, the gap between the letter and the settlement is enormous. That gap is entirely a function of preparation. Buyers who reconcile their own data and control disclosure land near the bottom of the range. Buyers who reply fast, run Oracle's scripts, and confirm Oracle's headcount land near the top.
Every GLAS Java audit ends in one of three places: a forward subscription priced on your defensible headcount, a smaller subscription after you remediate down to the minimum footprint, or a full migration off the Oracle JDK. The migration path matters even mid-audit, because a credible plan to replace Oracle JDK with OpenJDK (Adoptium, Corretto, Zulu, or others) removes Oracle's leverage over the forward years. You still have to resolve the historical claim, but you cap the recurring exposure at zero. The economics of the metric, the audit trap, and the OpenJDK exit are laid out in Oracle Java licensing 2026: per employee cost and audit risk, and the broader defense sequence is in the Oracle Java audit 2026 defense playbook.
If a GLAS notice is on your desk now, do three things today. First, contain communications through one named person and stop all substantive replies. Second, force Oracle to name the clause it is auditing under (OTN or OMA) in writing. Third, start your own internal inventory and headcount reconciliation before you disclose anything or contact Oracle sales. The forty-five day window is not a deadline you must meet; it is a tempo Oracle wants you to accept. Reset it.
LMS outreach was soft: a salesperson emailing procurement about a Java subscription, easy to decline. A GLAS notice in 2026 is a formal audit letter signed by a GLAS representative, addressed to a named C-suite executive (CIO, CFO, or General Counsel), citing a specific audit clause and a deadline. The formality creates a documented record Oracle can escalate, so the correct response is slower and more controlled, not faster and friendlier.
It depends on your relationship. If you only downloaded Java, Oracle cites the Oracle Technology Network (OTN) License Agreement, whose audit right is a single sentence: 'Oracle may audit an Entity's use of the Programs.' If you hold an Oracle Master Agreement for other products, Oracle may cite that clause and try to stretch it to cover Java. Always force Oracle to state the specific agreement and clause in writing before you respond substantively.
Oracle typically reaches three years back for past unlicensed use, priced at current Universal Subscription rates rather than historical ones. It often adds support arrears of roughly 22 percent per year on the alleged shortfall, which can exceed the license cost. Both the reach and the support arrears are heavily contestable and are primary negotiation targets; the back penalty is usually an opening position, not a figure Oracle expects to collect in full.
No. Java Management Service reports install and usage data directly to Oracle, converting your environment into Oracle's evidence base, and self-reporting hands Oracle a confession you were never contractually obligated to write. Under the one-sentence OTN audit clause you are not required to instrument your estate for Oracle. Run your own internal discovery privately instead, and control what you disclose.
Usually inflated. Across 2024 and 2025 engagements, Oracle's opening headcount ran on average 18 to 28 percent higher than the count buyers could defend after a clean reconciliation. Oracle pulls figures from LinkedIn, filings, or stale contract data, and it double-counts contractors and includes divested or non-qualifying entities. Because the metric prices the whole company, correcting the count is the single largest dollar lever in the negotiation.
Not cleanly anymore. In 2026 Oracle has declined to sell Java subscriptions to some customers unless they first disclose detailed usage and employee-count data, meaning the purchase request itself becomes the audit intake. Never initiate a buy conversation before completing your internal reconciliation and setting your disclosure position, or you may trigger the exact data collection you were trying to avoid.
Oracle now audits Java SE on employee count, not installs, which can multiply the bill several times over. How to defend the notice and exit to OpenJDK.
Gated with a work email on the download page. No sales follow up you did not ask for.
Get the White Paper →
500+ enterprise clients. 11 vendor practices. Industry recognized. One conversation can change what you pay for the next three years.
One buyer side briefing a week. Renewal signals, audit moves, and the levers that work. No vendor spin.
