Oracle's 45-day Java audit notice is a cooperation start date, not a deadline, and the settlement ceiling is usually fixed inside the first 30 days before a single script runs
Most Oracle Java audits close 90 to 180 days after the letter, yet the buyer's maximum exposure is largely decided in weeks one through four, when scope, governing paper, and evidence format get set. Read the 45 days as a minimum notice period you can extend to 90 by contract, then pace disclosure so Oracle's Q4 quota pressure in March through May arrives before your own deadline does. Teams that rush a full data dump inside 45 days routinely accept an employee-metric number 3 to 5 times what a staged, evidence-led response produces.
Prepared by Redress Compliance · August 28, 2026 · Oracle Java advisory. Audit and renewal engagements, 2024 to 2026.
Executive summary
The 45 days is notice, not a submission deadline: the clause reads "upon 45 days written notice, Oracle may audit Your use of the Programs," and it starts the cooperation period rather than ending it.
Nothing in the standard Oracle Master Agreement obliges you to hand over a completed inventory on day 45, and the clock runs from your receipt of the notice, not the date typed on the letter.
Cost is fixed in the first 30 days, before any number is exchanged, because scope, governing paper, and evidence format are all settled there.
Once you concede that the OTN click-through governs, that every installation counts, and that Oracle's script output is the record of truth, the employee-metric multiplier does the rest and the remaining months only argue about discount.
The full arc is 90 to 180 days for most Java audits, and 9 to 12 months where multinational estates, in-flight M&A, or contested feature evidence are involved, so a 45-day panic response buys nothing.
The five stages (letter, data request, usage claim, commercial offer, settlement) each move at 30 to 60 day intervals, which means you have room to pace if you claim it in writing early.
Time pressure runs both ways: the October 2026 JDK 21 licence change and Oracle's Q4 quota window in March through May are the two dates that move price, and the employee metric is non-negotiable while the per-employee rate is.
List runs $15.00 per employee per month at 1 to 999 employees down to $5.25 at 40,000 to 49,999, so a 5,000-employee company running Java on 40 servers faces $630,000 a year, roughly $15,750 per server, unless the rate is negotiated.
What the 45-day clause actually says, and what it does not
Read the clause as it is written, not as the GLAS letter paraphrases it.
The standard Oracle Master Agreement text runs: upon 45 days written notice, Oracle may audit your use of the Programs; you agree to cooperate and provide reasonable assistance; the audit shall not unreasonably interfere with normal business operations.
And payment falls due within 30 days of written notification of fees for excess use.
Four things follow that Oracle's audit team will not volunteer. First, 45 days is a notice period governing when Oracle may begin, not a delivery deadline for your data. Nothing in that sentence obliges you to produce anything on day 45; it obliges Oracle to wait until day 45.
Second, the clause almost never names Oracle's tools, scripts, collection methodology, or data format, so the mechanics of evidence are negotiable ground, not a given. Third, the "no unreasonable interference" wording is a buyer-side protection that supports a paced, business-scheduled response.
Fourth, the 30-day payment trigger only fires after written notification of excess use, which presupposes a finding you have accepted. Do not accept findings you have not tested.
| Stage | Elapsed from receipt | Who controls the pace | Buyer lever |
|---|---|---|---|
| Notice received, receipt acknowledged | Days 1 to 10 (10 business days) | Buyer | Establish receipt date in writing; name a single point of contact |
| Scope and governing-paper negotiation | Weeks 2 to 8 (1 to 2 months) | Shared | Determine whether OMA or OTN click-through applies; cap entities, geographies, and time period |
| Audit execution and data exchange | Weeks 6 to 14 (4 to 8 weeks) | Buyer holds the data | Refuse mandated scripts; deliver staged, self-collected evidence |
| Draft findings and usage claim | Months 3 to 5 | Oracle | Contest per-install and download-log inference before any acceptance |
| Commercial offer and settlement | Months 4 to 6 (90 to 180 days typical) | Shared | Time signature into Oracle's Q4 (March to May) quota window |
Two details in that table decide more money than anything downstream. The clock starts on receipt, not on the date printed on the letter, so log the arrival date, route it through legal, and state the receipt date in your acknowledgement.
Historically, when notice went unchallenged, Oracle simply attempted to open audits within roughly three days of sending, treating a 45-day protection as a formality.
Teams that assert the notice period get the full window plus whatever negotiated extension the paper supports, and many OMAs already carry 90 days.
The second detail is that the clause creates a cooperation period, not a single due date.
Most Java audits settle 90 to 180 days from the letter, with each stage running at 30 to 60 day intervals, yet the settlement ceiling is largely fixed inside the first four weeks, before a script runs, because scope, governing paper, and evidence format all get set there.
If you plan to renegotiate anything, push the notice period from 45 to 90 days at the next OMA renewal and cap audit frequency at once per year. That is a five-minute ask that buys months later.
In the meantime, run your response through a defined buyer-side GLAS negotiation strategy rather than improvising per email.
Soft letter versus formal notice: which clock you are actually on
Most organizations that believe they are inside a 45-day audit window are not. The GLAS soft outreach email, the friendly "we noticed Java downloads associated with your domain, can we schedule a review of your entitlements" note, is not a contractual event and starts no clock.
It carries no notice period, no cooperation obligation, and no payment trigger, because it is not issued under the audit clause. Nothing in your paper compels a response.
That said, the practical calculus is not whether you must answer, it is what happens when you do not: ignoring soft outreach is the single most common reason a soft inquiry converts into formal notice.
And Oracle's opening position in a soft inquiry is built from download logs and headcount, meaning inference, not your installed estate. Silence leaves that inference unchallenged and lets Oracle build the claim on its own numbers.
So the real choice is engaging on your evidence versus letting Oracle proceed on its assumptions.
Answer inside 10 business days with a short, courteous holding response: confirm receipt, name one point of contact (legal or procurement, never an engineer), state that you take licensing compliance seriously and are reviewing internally.
And ask which agreement Oracle believes governs and what specific downloads it references.
Attach nothing. No inventory spreadsheets, no server lists, no employee counts, no screenshots, no Java version summaries, and no acknowledgement that Oracle Java is deployed anywhere.
Do not answer questions about headcount, because headcount is the employee-metric price multiplier, and do not let a well-meaning platform team reply directly. Preparation before the first GLAS call is where the tone and scope get set for everything that follows.
Defend an Oracle Java audit without overpaying
Oracle now audits Java SE on employee count, not installs, which can multiply the bill several times over. How to defend the notice and exit to OpenJDK.
Get the white paper →Which paper governs decides how much clock you have
Before you argue about how many days you have, establish what instrument Oracle is auditing under. In practice, Java claims split into two very different categories.
The first rests on a signed Oracle Master Agreement or Technology License Agreement, which carries the familiar audit machinery: 45 days written notice, an obligation to cooperate, no unreasonable interference with normal business operations.
And payment within 30 days of written notification of fees for excess use.
The second, and in my experience the more common one on Java, rests on the OTN click-through terms that someone accepted when they downloaded a JDK binary from oracle.com.
Those two documents do not grant Oracle the same rights, and the audit clause Oracle's letter quotes is frequently lifted from paper the customer never signed.
Week one is where you fix this: write to Global Licensing and Advisory Services and ask, in writing, for the specific contract, order document, and effective date under which the audit right is asserted, plus the full contract chain including any amendments.
Do not accept a reference to "your agreement with Oracle." If GLAS cannot produce a signed OMA covering the entities named in the notice, the 45-day clause and the cooperation obligation are assertions, not obligations, and your response posture changes accordingly.
This single request routinely buys three to six weeks of clock without a single request for extension, because Oracle's own contract retrieval is slow, and it forces Oracle to state its theory of the claim before you state your position.
Handle it as a documented request, not a challenge; the tone matters when the same team runs the first GLAS call.
Two related points. Where you do hold a signed OMA, read the notice period rather than assuming 45 days; some customers negotiated 90, and Oracle's letter will not remind you. And if you hold legacy Java SE Advanced or Java SE Suite perpetual licences, catalogue them immediately.
They function as audit cover for the installations they were bought for and as migration runway while you move to OpenJDK, but they earn no credit against Universal Subscription pricing. Treat them as a defence asset, never as a discount claim.
The clock is not the constraint. Sequence is.
The 45 days is the least interesting number in the letter. What determines your exposure is the order in which facts enter the record, because Oracle's Java claim is not built by finding more Java.
It is built by getting you to agree, early and in writing, to a scope definition, and then applying the Employee metric to whatever you conceded. Once scope is settled, the price is arithmetic.
Oracle's own global price list does the sum for you: a company with 28,000 total employees, 23,000 staff plus 5,000 agents, contractors and consultants, at $6.75 per employee per month, pays 28,000 x $6.75 x 12 = $2,268,000 a year. Nothing in that calculation is a negotiation.
The negotiation happened, and was lost, when someone agreed that all 28,000 were in scope.
That is the structural trap.
Under the Employee metric, quantity is determined by headcount, not by users, installations, or actual Java consumption, and the definition explicitly reaches full-time, part-time and temporary employees plus those of agents, contractors.
Outsourcers and consultants supporting internal business operations.
So a single admission about a single JDK on a single server does not produce a server-sized bill. It produces a headcount-sized bill. Every technical fact you disclose is a lever with a multiplier attached, and the multiplier is your HR system.
Oracle's process is engineered so the expensive concessions arrive dressed as housekeeping. Which script format will you use. Which legal entities are in scope. Do contractors count. Will you confirm total headcount as of the order effective date so we can size the quote.
These read as administrative cooperation. They are the entire commercial outcome. By the time the usage claim lands, 60 to 90 days in, the number has already been set; the meeting where you think you are negotiating is a meeting about which quarter you sign in.
Staged disclosure inverts this by refusing to let the procedural questions run ahead of the substantive ones.
You answer scope questions last, entity by entity, against evidence you have verified, and you never confirm a headcount figure before you have confirmed which entities are legitimately in scope.
The asymmetry in the calendar favours you, provided you do not collapse it. Oracle's leverage is highest at the start, when GLAS holds the only theory of your estate and you hold none.
It decays across the arc, and it decays fastest as the calendar approaches Oracle's Q4 in March through May, when the same account team that opened as an auditor needs a signed order more than it needs a defensible finding.
Your leverage moves the other way: it grows every week that you accumulate verified inventory, remove Oracle binaries, and build a documented OpenJDK migration path. That is the mechanism behind using a credible OpenJDK exit as a pricing lever. Most audits close 90 to 180 days from the letter.
Stretching your arc from 90 toward 180 is not delay for its own sake; it moves the settlement conversation into a window where Oracle's quota pressure and your migration evidence peak simultaneously.
Which leaves one deadline you must actively defend against contamination. From the October 2026 Critical Patch Update, JDK 21 updates move from NFTC to the Java SE OTN licence, and Oracle has been explicit in pointing affected organisations at the Universal Subscription. That is a support decision.
It asks whether you want Oracle-supplied patches for a specific runtime after a specific date, and it has perfectly good answers that involve no Oracle contract at all. It is not a compliance deadline, it says nothing about past use, and it does not price a settlement.
Oracle's sales motion will nonetheless try to fuse the two, so that a patching question becomes the reason you sign a headcount-wide subscription in a hurry.
Keep them separate in your own project plan, with different owners and different decision dates. The audit is a legal and evidentiary matter resolved on your timetable. October 2026 is a runtime roadmap item resolved by engineering.
The moment those two dates merge in a steering committee slide, you have handed Oracle the one thing the 45-day clause never gave it: a deadline that costs you money.
The tell that you have lost sequence control is not a large number in the usage claim. It is a small, reasonable-sounding email in week three confirming your total employee count "for sizing purposes." Headcount is the multiplier, not an input to be shared freely.
Confirm entities in scope first, in writing, one at a time, and supply headcount only for entities whose in-scope status you have already conceded on evidence.
The second tell is calendar contamination. If your internal Java programme has one deadline covering both the audit response and the October 2026 JDK 21 licence change, you have converted a support decision you control into a compliance deadline Oracle controls.
Split the workstreams before the first GLAS call, and never let the patching date appear in audit correspondence.
Staged disclosure: what to release, in what order, and against what
Every release of data is a purchase. You are buying something specific from Oracle with it, and if you cannot name what you are buying, do not send the file.
In 25 years of working these audits, the single most expensive buyer behavior is the unconditional data dump: a full estate inventory, all JDK vendors mixed together, feature usage undifferentiated, delivered inside the 45 days because someone read the letter as a deadline.
That package sets the ceiling. Sequence it instead.
Release One is entity and scope definition only: which legal entities are in scope, which contracting paper governs (OMA versus OTN click-through, which matters enormously, see how the three-year lookback number is actually built), and a named single point of contact on each side.
You exchange that for written confirmation of scope, in Oracle's words, before anything technical moves.
Release Two is Java version and edition inventory for in-scope entities only, exchanged against written agreement that non-Oracle JDKs (Amazon Corretto, Eclipse Temurin, Azul, Red Hat builds) are outside the audit. Release Three is deployment topology.
Release Four, feature usage evidence, is last and is often never needed. Refuse blanket script deployment: the audit clause grants an audit right, it rarely mandates Oracle's collection tooling, so offer your own SAM-tool export in an agreed format. Also fix your modelling boundary early.
The Employee metric carries a 50,000-processor installation ceiling exclusive of desktops and laptops, and Oracle will quietly count past it if you never establish where your estate sits relative to that line.
| Release stage | What you send | What you get in writing before sending |
|---|---|---|
| 1. Entity and scope | In-scope legal entities, governing agreement, named contacts | Confirmed scope statement and audit contact from Oracle |
| 2. Version and edition | Oracle JDK versions and editions only, in-scope entities | Non-Oracle JDKs confirmed out of scope |
| 3. Topology | Server counts, environments, processor installation counts | Agreement that desktops and laptops sit outside the 50,000-processor ceiling |
| 4. Feature usage | Commercial feature evidence, only where contested | Written statement of the specific claim the evidence tests |
Evidence base: how these audits actually run
Most Java audits close in this window, with the five stages running at 30 to 60 day intervals.
Scope, governing paper, and evidence format are all decided before a single collection script executes.
The shape repeats across engagements from 2024 into 2026 with unusual consistency.
Formal notice lands, then one to two months of negotiation over audit specifics (scope, method, format), then four to eight weeks of execution, then a report, then roughly a four-week compliance purchase period during which Oracle expects a signed order.
Multinational estates, in-flight M&A, or genuinely contested feature evidence stretch this to nine or twelve months, which is usually to the buyer's advantage rather than Oracle's.
The pricing pressure Oracle brings is not random either: the Q4 quota window running March through May is when per-employee price moves, and readiness that arrives before that window converts directly into discount, as covered in the levers that move Oracle Java off list price.
On the version cliff, treat JDK 17 as the template. Its NFTC terms expired in September 2024, with 17.0.12 in July 2024 the last free update, and JDK 21 follows the identical pattern from the October 2026 Critical Patch Update. What ends is entitlement to free updates.
Nothing ends your right to keep running the release you already deployed, and Oracle's letters routinely blur that distinction.
Two outcomes in our own casework anchor the point that the ceiling is set early rather than argued down late: a global manufacturer facing a $4M claim closed at zero cost, and a global retailer that also closed at zero. Neither result came from negotiating harder in month five.
Both came from controlling scope, paper, and evidence format in weeks one through four.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
Your first five moves
- Acknowledge inside 10 business days, with zero data attached. Legal or procurement sends a short written receipt confirming the notice date and naming a single point of contact, because the 45 days runs from receipt and every uncontrolled technical conversation before that letter goes out becomes evidence you cannot retract.
- Establish which paper governs, in writing, before you discuss scope. Ask Oracle to identify the specific agreement and clause the audit right rests on (OMA versus OTN click-through), since Java claims built on OTN terms carry materially weaker audit rights than an OMA, and this question alone typically buys two to four weeks while GLAS assembles its entitlement position.
- Propose a written audit plan with dated stages, and do it first. Your plan sets the sequence: entitlement review, then a defined data set, then a claim you can test, with stage gates 30 days apart. The contract obliges cooperation, not Oracle's scripts or tooling, so the party that tables the plan first sets the evidence format, and that is where the ceiling actually gets fixed, as the buyer-side GLAS negotiation strategy sets out.
- Freeze downloads on day one and stand up an OpenJDK migration with dated evidence. IT operations blocks oracle.com JDK downloads, inventories what is actually installed, and produces a signed remediation plan with named systems and target dates. In our engagements, a documented exit is the single strongest lever on price, which is why a credible OpenJDK exit works only when it is evidenced rather than asserted.
- Target the notice period and audit frequency at your next renewal, not during this audit. Procurement should carry two amendments into the next Oracle transaction: notice extended from 45 to 90 days, and audit frequency capped at once per twelve months. Neither costs Oracle revenue, both are routinely conceded when bundled into a signature, and together they double your preparation runway the next time a letter lands.
Frequently asked questions
Does the 45-day Oracle Java audit notice mean I must submit data within 45 days?
No. The clause states Oracle may audit upon 45 days written notice, which fixes the earliest date Oracle may begin, not a submission deadline for you. The cooperation obligation that follows has no fixed duration in standard terms, and most audits run 90 to 180 days from letter to signature.
Treat day 45 as the start of a negotiated data-exchange plan, not the day a full inventory is due.
When does the 45-day clock actually start?
On receipt of the formal notice, not the date printed on the letter. Log the receipt date, the delivery method, and the recipient, because Oracle letters are frequently dated well before they arrive.
If the notice went to an unrelated mailbox or a former employee, say so in writing and reset the count from the date a responsible officer received it.
Can I get an extension to the 45-day window?
Extensions are usually available on request when framed around a defined deliverable and a written audit plan rather than as delay. Many customers have negotiated 90 days into the master agreement, and the notice period is a term procurement should target at renewal.
Also ask for a cap of no more than one audit per year in the same amendment.
What is the difference between a soft audit letter and a formal audit notice?
A soft letter, usually from Oracle GLAS or a sales team, is not a contractual event and starts no clock, so nothing compels a response. A formal notice triggers the obligations and timelines in the audit clause.
The practical risk is that silence on soft outreach is the most common trigger for formal notice, so engage on your own evidence rather than letting Oracle build a claim from download logs.
Do I have to run Oracle's scripts or data collection tools?
Usually not. The audit clause grants an audit right but rarely mandates specific tools, scripts, or a collection methodology. You can offer output from your own SAM tooling in an agreed format, scoped to the entities and estate actually in dispute.
Get the format and scope agreed in writing before any collection begins, because unscoped script output becomes the record of truth.
How does the October 2026 JDK 21 change affect the negotiation timeline?
From the October 2026 Critical Patch Update, JDK 21 updates move from NFTC to the Java SE OTN licence, the same licence covering Java 8, 11, and 17. What ends is Oracle's provision of free updates, not your right to keep running builds you already have.
Do not let a support date become your negotiation deadline; if you need a deadline, use Oracle's Q4 quota window of March through May instead.
Can I negotiate the employee metric itself?
No. Oracle will not move off the Employee definition, which counts all full-time, part-time, and temporary staff plus those of agents, contractors, outsourcers, and consultants supporting internal operations, at minimum equal to headcount on the order effective date.
What is negotiable is the per-employee rate, the term, and the scope of what triggers the subscription at all. List runs $15.00 down to $5.25 across the published bands, and the ladder steps rather than slopes, so band position is worth six figures.
