The First GLAS Call on Java: What to Say and What to Withhold

The opening conversation with Oracle GLAS is designed to extract data and set an anchor, not to help you. This is the script that keeps you in control of scope, timeline, and headcount before a single number is exchanged.

The first GLAS contact on Java rarely announces itself as an audit. It arrives as a courtesy: a licensing specialist reaching out to help you understand your Java position, perhaps confirm a few deployment details, maybe walk through subscription options. In 25 years of sitting across the table from this vendor, I have learned that the friendly framing is a phase, not a favor. What you say on that first call, and more importantly what you decline to say, determines whether the eventual claim anchors at defensible reality or at Oracle's inflated ceiling.

This is a script, not a summary. It tells you exactly what to confirm, what to deflect, and what to withhold entirely. It assumes you have received a soft outreach email or a call request and have not yet handed over a single data point. If you have already responded, read our guidance on the first 30 days after an Oracle audit letter and reset your posture immediately.

Know Who Is Actually on the Call

GLAS (Global Licensing and Advisory Services) is Oracle's audit division, formerly branded LMS. The rebrand is not cosmetic. Where LMS outreach often felt advisory, the 2026 GLAS posture is harder, and the soft outreach is increasingly a prelude to a formal audit notice issued under the license management function. If you want the operational detail on what shifted, our analysis of GLAS versus LMS enforcement lays it out.

The team structure matters to your tone. GLAS operates with local, customer-facing auditors handling the relationship and a central technical audit team based in Romania performing the analysis. The person on your first call is usually the local relationship layer: pleasant, patient, and specifically incentivized to get you talking. They are not the decision-maker on the number, and they are not your advocate. Treat the call as discovery being conducted against you, because that is what it is.

Understand the phase you are in. The soft outreach period typically runs 30 to 90 days before a formal notice, and three to six months from formal notice to signature is normal. Critically, the ceiling on the eventual settlement is usually set within the first four weeks after formal notice, before discovery even completes. That means the anchoring game starts on this very first call. Every fact you volunteer feeds the number.

The person on your first GLAS call is not the decision-maker and is not your advocate. Their job is to get you talking. Yours is to control what leaves the room.

Assume Oracle Already Has Some Data

GLAS opens these conversations from a position of partial knowledge, and they will imply they know more than they do. Oracle sources Java leads from three main triggers: Java Auto Update telemetry, where the update server records your corporate domain on every check-in; download history, where Oracle holds a record of Java SE binaries pulled from your domain; and sales referrals, where Java sales passes declined-renewal prospects to the audit team. Oracle can see the email address or account (often tied to your domain) and the IP address behind a download.

Note the tension here. Oracle's public "About Java Usage Metrics" material states it does not collect personally identifiable information or associate online behavior with identity, yet the practical download and telemetry picture says otherwise. Do not accept Oracle's framing of what its data proves. A download record is not proof of production deployment, and downloading Java does not automatically create a financial obligation. For the technical detail on what actually transmits, see our breakdown of Java telemetry and what Oracle already knows.

The tactical implication: do not confirm or deny specific deployments on the first call. If the auditor says "we see you downloaded JDK 8 across several domains," your answer is not to explain or correct. Your answer is that you will review internally and respond in writing through the appropriate channel. You never improve your position by narrating your estate off the top of your head.

The Numbers You Are Defending Before You Say a Word

Oracle's Java SE Universal Subscription is priced on a per-employee metric, and the employee count is the entire game. The metric is not tied to usage. The licensed quantity must at minimum equal your total employee count as of the order's effective date, regardless of how many people actually touch Java. Oracle's own definition of "employee" reaches full-time, part-time, and temporary staff plus agents, contractors, and consultants.

Here is the published list-price ladder. Know it cold before the call, because Oracle will anchor against your gross headcount at the applicable tier.

Oracle's own example is instructive: 28,000 total employees (23,000 staff plus 5,000 contractors) at $6.75 per month equals $2,268,000 per year. A mid-sized company with 1,000 total employees now pays roughly $144,000 annually, which for many is a 300 to 400 percent increase over the legacy processor-based Java model. The point of quoting these figures on the first call is that the auditor is doing this arithmetic in their head using your gross headcount. Your job is to make sure the gross number is never the number that enters the negotiation.

The employee count is the entire game. Whether contractors count and which legal entities are in scope is the single most negotiable part of any Java settlement.

The First-Call Script: What to Say

Keep the call short, courteous, and low on content. Your objectives are three: confirm nothing substantive, request a scope meeting, and get everything into writing. Use these positions:

• Acknowledge receipt only. "Thank you for reaching out. We take our licensing obligations seriously and will engage properly." That is a professional posture, not an admission.
• Ask what specifically prompted the contact. Let them describe their data. You are gathering intelligence, not offering it. If they cite a download or telemetry record, note it and move on without confirmation.
• Request that all further communication and any specific data requests come in writing. This slows the compressing clock and creates a paper trail you control.
• Ask for the scope and legal basis before any data changes hands. Which entities, which product versions, which time period, and under which contractual clause? A vague scope is a scope you can narrow.
• State that you will designate a single point of contact and route all responses through that person. Never let multiple internal people field auditor questions independently.

The first move in any Oracle Java engagement is to stop the data flow: acknowledge, request a scope meeting, and provide nothing until scope is agreed. This is not obstruction, it is standard buyer-side discipline. Our full buyer-side GLAS negotiation strategy builds on exactly this opening posture.

What to Withhold, and Why It Matters

The following items should never be volunteered on a first call. Each one, once said, hardens into a fact Oracle uses to anchor the claim:

• Total headcount. This is the single most valuable number to Oracle and the most damaging to disclose casually. The definition of "employee," which entities it reaches and how contractors are counted, is one of the most negotiable parts of any settlement. Never confirm a number you have not defended with HR and finance evidence.
• Specific deployment counts or server inventories. "We have Java on about 400 machines" is a gift. Say nothing about scale until you have run your own estate review.
• Which Java versions you run. Version matters enormously because of the free-use windows. Do not hand Oracle a version map before you have checked which deployments may need no license at all.
• Admissions of unlicensed production use. Never say "we know we should have subscribed" or "we have been running this without a license." That single sentence can convert a negotiable retroactive claim into a conceded liability.
• Internal timelines, budget cycles, or renewal dates. Anything that signals urgency or spend capacity strengthens Oracle's leverage.

Withholding is not lying and it is not stonewalling. It is refusing to conduct discovery on Oracle's behalf before you have done your own. The defended number, documented with HR and finance evidence on the contractor split, is what should enter the negotiation, not the gross headcount you might blurt on a call.

The Free-Use Windows That May Cut the Claim to Zero

Before you concede any liability, check whether your Java use even requires a license. Since Java 17 in September 2021, Oracle has released new versions under the No-Fee Terms and Conditions (NFTC) license, which permits free commercial use including production. The current dates matter:

The trap is the version boundary. JDK 17 releases from 17.0.0 through 17.0.12 sit under NFTC, but future 17 updates do not. JDK 21 updates are free through September 2026, then shift to OTN from the October 2026 Critical Patch Update. This is why you must never confirm your version map to an auditor before checking it yourself: a chunk of your estate may carry no license obligation at all.

There is also a clean escape route. A subscription can be avoided entirely if all Oracle JDK deployments are removed and replaced with an OpenJDK distribution. If even one application keeps an unlicensed Oracle JDK in production, a subscription is required, but a credible migration plan is genuine leverage. Used well, a credible OpenJDK exit lowers your Oracle Java number materially.

The Anchoring Game and the Retroactive Bluff

Oracle calculates maximum exposure specifically to anchor the negotiation at the highest possible figure. Initial retroactive claims can range from $500,000 to over $20 million depending on company size, and by 2026 Gartner projects at least 20 percent of Java-using organizations will face an Oracle audit. Here is the critical fact for your posture: retroactive fees are almost always negotiable and frequently have no contractual basis. Do not treat the opening number as a debt. Treat it as an anchor to be challenged with verified data.

Understand also that a Java call rarely stays a Java call. A Java question becomes a broader estate review, and a script request becomes leverage for a commercial reset across your entire Oracle relationship. Keeping the scope narrow on the first call is not paranoia, it is the difference between a contained Java conversation and a full-estate audit. When the retroactive number lands, our guidance on pushing back on the retroactive back-fee demand gives you the counter-arguments.

Where the Deal Actually Lands

Once you have controlled the first call and defended your count, the negotiable range is real. In our engagement experience, discount bands of 15 to 30 percent are routine on the subscription itself. Trading scope for term commitment lands better still: a three-year forward commit at a 28 to 42 percent discount frequently beats a one-year subscription at list. And you should always cap renewal uplift, typically negotiating the 4 to 6 percent band down or fixing it, so year-two and year-three do not erase the discount you won.

None of those levers are available if you have already anchored the deal against yourself on the first call. Discipline early is what preserves leverage later. For the full picture of what moves the number, see the levers that move Oracle Java off list price.

What to Do Now

If a GLAS contact has landed, do these five things before your next conversation: acknowledge receipt without confirming any data; designate a single internal point of contact; request scope, legal basis, and all future requests in writing; run your own estate review including a version map against the NFTC and OTN boundaries; and document your true headcount with HR and finance so contractors are defended, not conceded. Then, and only then, engage on numbers. For a wider procurement view of the metric and the escape route, our 20 critical Oracle Java procurement insights is the companion read.

Related advisory: the full topic guide.

Frequently asked questions

Do I have to take the first GLAS call at all?

You are not obligated to have an unscheduled call. It is often better to acknowledge the outreach in writing and request that specific data requests and scope come to you in writing first. This slows the compressing timeline and prevents you from being drawn into unscripted disclosure. If you do take the call, keep it short and confirm nothing substantive.

Is Oracle's soft outreach the same as a formal audit?

Not yet, but treat it the same way. The soft outreach phase typically runs 30 to 90 days and precedes a formal notice, but the settlement ceiling is usually set within the first four weeks after that notice. Anything you volunteer during the friendly phase feeds the number, so apply full audit discipline from the first contact.

Should I tell GLAS my total employee count?

No. The employee count is the entire basis of the per-employee subscription metric and the single most valuable number to Oracle. Whether contractors count and which entities are in scope is one of the most negotiable parts of any settlement. Never confirm a headcount you have not defended with HR and finance evidence.

Does Oracle already know what Java I have deployed?

Oracle has partial data from download history, Auto Update telemetry tied to your domain, and sales referrals. But a download record is not proof of production deployment, and downloading Java creates no automatic obligation. Do not confirm or correct their picture on a first call; run your own estate review first.

Can I owe nothing even if I run Oracle Java?

Possibly. Java 17 through 17.0.12, JDK 21 updates through September 2026, and JDK 25 through September 2028 are covered by the free NFTC license, including production. And you can avoid a subscription entirely by replacing all Oracle JDK with OpenJDK. Check your version map before conceding any liability.

Are Oracle's retroactive back-fee claims enforceable?

Often not as presented. Initial retroactive claims range from $500,000 to over $20 million but are almost always negotiable and frequently have no contractual basis. Treat the opening figure as an anchor to be challenged with verified data, not as a settled debt.