Full narration of the briefing. Click a section heading to jump the player to that moment.
Three years of friendly Java outreach from Oracle have given way to formal audit notices from GLAS, Oracle's renamed license management function. The letters go to named executives, cite the audit clause in an Oracle Master Agreement or the OTN license accepted at download, set a window of around forty five days, and ask for global employee counts. The recipients are not random. They are the organizations that did not buy when asked, picked from three years of telemetry.
I am Claire, Tom is with me, and this briefing is the three instruments Oracle is using this year and the sequence that keeps control of all three.
Treat the letter, the renewal and the tool as three versions of one request. The GLAS letter is a formal audit under the OMA or the OTN license, with a negotiable scope and process rights. The renewal letter is quieter: Universal Subscription renewals in 2026 carry an employee count refresh that resets the quantity to current headcount, and in several cases the cap of one audit per thirty six months has been removed. And Java Management Service is offered free on Oracle Cloud under terms that let Oracle use the data for license management.
Run as offered, it is a self audit with the exceptions removed.
Understand what the audit is actually doing. Since January 2023 the Universal Subscription is priced on every employee and contractor, whether or not they use Java. So the audit is not counting Java. It is looking for a single Oracle JDK in production that is not covered by the NFTC, a third party application's embedded license, or a restricted use right under another Oracle product.
Once one installation is established, everything after it is arithmetic: headcount, contractors, affiliates, back dated to first download. JMS does not see embedded or restricted use rights at all. An audit response that fails to assert them concedes the trigger.
The forcing event is this month. JDK twenty one's free window closes in September 2026, and from the October Critical Patch Update every JDK twenty one security update is licensed under OTN, which permits development and personal use and not production. An organization that patches production JDK twenty one in October without a subscription has created the compliance event Oracle is looking for, and dated it. JDK twenty five stays free under the NFTC until September 2028.
The migration path is real: OpenJDK twenty one is free for production, and most enterprises complete the move in ninety to one hundred eighty days. Oracle's calendar is designed to arrive before that project finishes.
Put it on an eight thousand employee organization. Two legacy application servers on JDK eleven establish commercial use. Six build servers on JDK twenty one patched after the October update add a second, dated trigger. Apply the employee metric at ten dollars fifty per employee per month: just over one million dollars a year, back dated three years at list, three million.
The same estate after a defended review: the JDK eleven servers covered by an embedded license and a WebLogic restricted use grant, the build servers migrated to Temurin before the October patch with dated evidence. No established use, or a narrow subscription with no back dating.
The response is a sequence. Route everything to one owner: GLAS letters, renewal letters, JMS invitations and any Java email go to whoever owns the Oracle relationship, with counsel copied. Infrastructure does not reply, and nobody runs JMS. Inventory under privilege: every Java runtime, Oracle and non Oracle, by version, vendor, host and application, with your own tooling, in a form counsel controls.
Establish the governing license for every Oracle installation: BCL for pre 2019 Java eight, OTN for updates since, NFTC inside its windows, restricted use, or embedded under a third party agreement. Then finish the migration and date it: move production JDK twenty one to OpenJDK before the October patch, keep the change records, and disable update check ins so the telemetry stops.
The move from this briefing. If a GLAS letter has arrived, assert its terms: scope to named entities and environments, require confidentiality and a draft report you can respond to. Redline the renewal: strike the audit cap removal and reinstate the thirty six month limit, replace the headcount refresh with a fixed quantity and a defined true up. All of it is refused if not asked.
Do not run JMS on Oracle's terms. On Java audits, if a client follows our advice and still pays retroactive fees, we refund our fee; in more than one hundred engagements, none has had to. The full research note is free to download under this video, at redresscompliance dot com slash newsletter slash september.
Redress Compliance works on contingency: our fee is 25 percent of what we save you. Nothing saved, nothing paid. Independent, buyer side only, never vendor funded. Want Redress to contact you? Reach out and we respond the same day.
Talk to a Oracle negotiator