Every internal Java headcount reconstruction is a $1,188,000 exposure calculation, so it belongs under privilege before anyone opens a spreadsheet
Oracle's Employee metric prices a 12,000-person enterprise at $1,188,000 a year at list whether it runs four JDK installs or four thousand, which means the internal document that counts your employees, contractors and outsourcers is a damages worksheet, not an IT asset report. In 2026 Oracle's Global Licensing and Advisory Services function is converting soft outreach into formal notices carrying 45-day clocks, and it has been reported declining to sell subscriptions until customers first disclose usage and employee-count data. Whether your first draft count sits in an unprivileged email thread or in a counsel-directed workstream decides how much of your own analysis Oracle gets to quote back at you.
Prepared by Redress Compliance · August 31, 2026 · Oracle Java advisory. Audit-defense and privilege-structuring engagements, 2023 to 2026.
Executive summary
The Employee metric turns a headcount spreadsheet into a $1,188,000 damages estimate, and most enterprises build that spreadsheet in Outlook.
Oracle's published rate card runs from $15.00 per employee per month at the bottom band down to $5.25 at volume, and Oracle's own worked example prices 28,000 counted persons (23,000 employees plus 5,000 agents, contractors and consultants) at $2,268,000 a year.
So the first person who drafts a contractor count has authored the plaintiff's exhibit.
The October 2026 license cliff is generating a wave of internal assessments that nobody scoped as legal work.
Oracle has stated that JDK 21 updates beginning with the October 2026 Critical Patch Update move from the NFTC to the OTN license, and the same date applies to GraalVM for JDK 21.
So every estate scan run in the next two quarters is being written into email threads that a formal audit notice can reach.
Enforcement changed character in 2026, which is the fact that removes the discretion from privilege planning.
Commentary reports that three years of soft compliance emails are giving way to formal notices from the rebranded Global Licensing and Advisory Services function, typically opening a 45-day clock.
And that Oracle has in some cases declined to sell subscriptions unless the customer first discloses detailed usage and employee-count information.
Privilege is not automatic and it is not retroactive, so the sequencing decision is worth more than the analysis itself.
An engagement letter dated after the audit notice does not protect a March spreadsheet titled "Java exposure worst case", and in our engagements the single most damaging document is almost never a scan output.
It is a two-line internal email speculating about non-compliance that was written eight months before anyone thought about counsel.
How privilege actually attaches to a Java assessment, and where it fails
Privilege protects legal advice, not facts. Nothing you do with counsel makes the number of Oracle JDK installs on your estate disappear, and nothing shields the headcount your HR system already holds.
What privilege can protect is the analysis: the exposure math, the interpretation of Oracle's Employee definition, the judgment call on whether a business unit is exposed, and the settlement strategy built on top of those.
In 25 years of these negotiations I have watched more damage done by unprivileged commentary about facts than by the facts themselves. Attachment requires four conditions, and all four fail routinely.
First, the scope must be counsel-directed, meaning counsel defines the questions the assessment answers. Second, the engagement letter must be dated before the work starts, because a retroactive letter reads as cleanup.
Third, communications must be addressed to counsel for the purpose of obtaining advice, not to a distribution list with counsel copied. Fourth, distribution must be controlled and marked.
Attorney-client privilege covers the advice channel; work product covers materials prepared in anticipation of litigation or a formal dispute, which in the Oracle context reasonably begins when a Global Licensing and Advisory Services audit notice with its 45-day clock lands.
In-house counsel on the CC line does not convert an IT report into a legal one, and a "Privileged and Confidential" header on a spreadsheet built by a SAM analyst for a SAM purpose is decoration.
| Artifact | Discoverable as fact? | Should own it | Correct routing |
|---|---|---|---|
| Raw discovery scan output | Yes, entirely | IT operations | Retain in tooling, no narrative attached |
| Install inventory (host, version, path) | Yes, entirely | SAM lead, validated | Factual record, see install inventory standards |
| Download history reconstruction | Yes, Oracle may already hold its own copy | SAM lead | Facts only, dates and artifacts, no inference about who acted or why |
| HR employee, contractor, outsourcer count | Yes, underlying data | HR, under counsel-defined scope | Counsel specifies which populations are counted and why |
| Exposure calculation with a total | Analysis, protectable if built for counsel | Outside counsel or advisor under counsel | Never circulated outside the privileged group |
| Remediation plan with dates | Plan is protectable, the removals it triggers are facts | Counsel-directed workstream | Log the removals factually, keep the strategy separate |
| Board or audit committee summary | Highest risk if unprivileged | General counsel | One privileged version, no drafts in shared folders |
The table describes discovery. Discovery is almost never how Oracle gets your worst documents. In practice the damaging spreadsheet is handed over voluntarily, inside a data response, by a SAM team trying to be cooperative and complete under a 45-day deadline.
Oracle asks for install data and headcount data; someone attaches the workbook that already has the exposure total in cell G40, plus the tab labelled "probable gaps." No subpoena, no court, no privilege fight, just a well-meaning attachment.
The practical control is therefore not legal doctrine but a response gate: one named person, working to counsel-approved scope, decides what leaves the building, and every outbound artifact is purpose-built for the response rather than lifted from the internal working set.
The five documents that price your own settlement for Oracle
Five artifacts do the pricing work for Oracle's negotiator. Each one converts a range into a number Oracle can anchor on, and each has a safer form that carries the same information to the people who actually need it.
One: the exposure spreadsheet with a total. A single cell reading $1,188,000, the list cost of a 12,000-employee subscription at Oracle's published rate card, becomes Oracle's opening position and your ceiling in one move. It also concedes the metric.
The alternative form is a counsel-directed scenario model expressing outcomes as ranges under stated assumptions, with the metric itself treated as a contested question rather than a given.
Two: the contractor and outsourcer headcount reconstruction. Oracle's own worked example inflates 23,000 employees to 28,000 by adding 5,000 agents, contractors and consultants, producing $2,268,000 a year at $6.75 per month.
Your internal reconstruction, if it applies Oracle's definition uncritically, hands Oracle a number your own HR function has certified.
The alternative is a counsel-scoped population analysis that separates each cohort, records which contract terms and which staffing arrangements actually meet "support your internal business operations," and never publishes a single consolidated figure.
Three: the email speculating that a unit is "probably non-compliant." Speculation about compliance status by someone with no license expertise reads to Oracle as an admission and to a court as a party statement.
Replace it with a factual question routed to counsel: "Confirm licensing position for the 340 installs listed at rows 12 to 351."
Four: the remediation plan with a completion date after the audit notice. A plan dated after receipt of a notice tells Oracle exactly which installs you believe are unlicensed, and dated removals after the notice invite the argument that pre-notice use was unlicensed.
Keep the strategy privileged and log the physical removals to the standard in removal and decommission logging, factually and contemporaneously.
Five: the capacity-planning deck counting processors. The Employee metric caps installs at 50,000 processors excluding desktops and laptops. A deck showing you near or above that line proves a second exposure Oracle would otherwise have to discover.
Move processor counts into the privileged workstream and out of general infrastructure decks.
The common thread is that all five documents were written for internal decision-making by people who assumed the audience was internal. None of them were drafted with the knowledge that Oracle's licensing function would read them line by line.
Assume the second audience exists from the first keystroke, and the drafting problem largely solves itself.
Defend an Oracle Java audit without overpaying
Oracle now audits Java SE on employee count, not installs, which can multiply the bill several times over. How to defend the notice and exit to OpenJDK.
Get the white paper →Why the Employee metric makes legal hygiene worth more here than in any other Oracle audit
In a database audit, the facts constrain the number.
If Oracle finds Diagnostics Pack usage on eight processors, the claim is eight processors, and the argument is about whether those eight were licensed, whether the option was enabled by default, and whether the discount on the remediation is 40% or 70%.
The deployment data and the price are welded together. Java under the Employee metric severs that weld entirely.
Oracle's Global Price List defines Employee as all full-time, part-time and temporary employees plus the full-time, part-time and temporary employees of your agents, contractors, outsourcers and consultants supporting internal business operations.
And states plainly that the licensed quantity is determined by the number of Employees, not just those who use the Programs.
A 12,000-person enterprise sits at $1,188,000 a year at list whether it runs four Oracle JDK installs or four thousand. The deployment facts are not the number. They are the trigger for the number.
That leaves three real variables in any Java dispute: the Employee definition (specifically how far the contractor and outsourcer tail extends), the count date, and whether Oracle can point to a single unlicensed install. The first two are contract interpretation. The third is binary.
Under the terms as written, one production JBoss node running an OTN-licensed JDK 17 update, one developer laptop with an October 2026 JDK 21 CPU applied, one embedded Oracle JRE inside a third-party appliance nobody inventoried, produces the same estate-wide price as a thousand of them.
There is no proportionality mechanism. There is no partial exposure.
The consequence for evidence handling is severe and it is not intuitive. Because the dispute reduces to one yes-or-no evidentiary question, Oracle does not need forensic access to your estate. It needs one admission.
The cheapest, fastest, most credible source of that admission is your own internal assessment, written by your own engineers, in your own words, using your own naming conventions.
Nothing Oracle's scripts produce carries the same weight as a line in your Confluence page reading "approx. 340 hosts still on Oracle JDK 17.0.13, remediation Q3." That single sentence answers the only question that matters and answers it against you.
This inverts the instinct that serves you well everywhere else. In most audit-defense work, thorough internal discovery is virtuous: the more you know before Oracle does, the better you negotiate.
Here, thoroughness performed outside privilege produces a document whose existence costs $1,188,000, because the document establishes the trigger and the trigger establishes the whole-estate price.
The discipline of making the inventory audit-defensible rather than merely complete matters precisely because the completeness has a price attached.
I have watched buy-side teams spend six weeks building an immaculate estate map, circulate it to forty people on an unrestricted distribution list, and then discover during negotiation that Oracle's account team is quoting their own slide numbers back at them. The map was correct.
That was the problem.
The strategic case for privilege here has nothing to do with concealing wrongdoing. It has to do with preserving your right to reach a different conclusion later. A March assessment and a September assessment differ by whatever you removed, replaced, or reclassified in between.
In this metric that difference is not incremental, it is the difference between owing $1,188,000 and owing nothing.
If the March draft sat in an ordinary email thread, it is a fixed, quotable, dated statement by the company about its own compliance posture, and the September position looks like a retreat under pressure rather than the result of an eight-month remediation program.
If the March draft was produced at counsel's direction as part of a legal risk assessment, it is a working hypothesis that counsel refined, and the only externally meaningful statement is the one you choose to make.
That is the whole game: not hiding the facts, but retaining the ability to change your own answer as the facts change underneath it.
Legal hold: when it starts, what it freezes, and what it does not require you to hand over
The most common self-inflicted wound I see is teams collapsing two separate obligations into one. The duty to preserve and the duty to produce are different duties, arising at different moments, with different scopes.
Preservation attaches when litigation or a formal dispute is reasonably anticipated. Production, in a commercial licensing dispute, is governed by the audit clause in your Oracle Master Agreement or OTN terms and, later, by discovery rules if the matter escalates.
Nothing in a preservation obligation requires you to volunteer a single record to Oracle.
Yet I routinely see general counsel issue a hold notice and, in the same week, watch IT ship the underlying scan output to the Oracle account manager because the hold made everyone feel they should be transparent. That sequence hands Oracle the trigger evidence for free.
On timing: 2026 reporting indicates soft outreach is giving way to formal notices issued under Global Licensing and Advisory Services, and that Oracle has in some cases declined to sell subscriptions until customers first disclose usage and employee-count data.
A soft email is not a contractual audit event, but it can absolutely establish reasonable anticipation of a dispute. Treat the first vendor contact as the presumptive trigger and have counsel document the assessment, rather than arguing about it two years later.
What freezes: scan and discovery output, download and My Oracle Support access records, HR and contingent-workforce headcount extracts, procurement records for third-party JDK distributions, and above all removal and decommission evidence.
Routine 30 or 90 day log rotation is where spoliation risk actually lives, because the rotation is automated and nobody remembers to suspend it.
Removal evidence is the one category where over-preservation is unambiguously in your favor, and logging removals so Oracle cannot reopen them is worth more than any other preservation step you take.
The asymmetry is the point. Preserving deployment evidence protects you from a spoliation argument but creates material Oracle would like to see. Preserving removal evidence protects you from spoliation and simultaneously builds the affirmative case that the trigger install no longer exists.
Those two categories should be governed by different retention instincts: keep the removal logs forever, keep the deployment scans exactly as long as the hold requires and no longer.
The practical instruction to your CIO is one sentence: preserve everything, disclose nothing without counsel review, and never let the hold notice be read internally as an invitation to be helpful.
Drafting rules: what to write down, what to phrase differently, what never goes in email
The drafting standard is simple and it is unforgiving: facts live in one document, legal characterization lives in another, and the second one never leaves counsel's control.
Every file produced inside a counsel-directed workstream carries a header, first line, not a footer: "Privileged and Confidential. Attorney-Client Communication. Prepared at the direction of [Name], [Title], in anticipation of litigation." Date it, version it, and name the requesting attorney.
A header alone does not create privilege, but its absence makes the claim close to unarguable when Oracle's counsel challenges the log eighteen months later.
Inside unprivileged documents, four words do most of the damage: exposure, non-compliant, liability, and worst case. An engineer writing "worst case exposure is $1.19M" has authored Oracle's opening demand in eight words.
The discipline is to strip conclusions and replace them with questions directed to counsel. Not "these 340 installs are unlicensed" but "counsel has asked us to confirm whether these 340 installs fall within the NFTC grant; the underlying build data is attached." The first is an admission.
The second is a request for legal advice, and it is the request that pulls the attached data under the umbrella.
The same rule governs numbers: never estimate a dollar figure outside a counsel-directed workstream, because Oracle's Employee metric means any headcount tally you produce is arithmetic away from a settlement number.
Keep the raw install and version data in a clean technical record, structured the way an audit-defensible install inventory should be, and keep the interpretation somewhere else.
Distribution is where most privilege claims actually die. Privilege survives narrow, need-to-know circulation among counsel, the named workstream leads, and the two or three engineers doing the collection.
It does not survive a forty-person distribution list, a shared SharePoint folder with open inheritance, an internal wiki page, or a Slack channel with 200 members.
In our engagement experience, the single most common cause of failure is not bad drafting, it is a well-drafted memo forwarded once to a broad DL by someone being helpful. Lock permissions before the first draft exists, not after.
What the 2026 record shows about how Oracle uses customer documents
At the applicable band, the Employee metric prices this estate identically whether it runs four JDK installs or four thousand (Oracle price list arithmetic).
2026 commentary reports soft outreach converting into formal audit notices under Oracle's rebranded GLAS function, carrying fixed response windows.
Sourcing honesty matters here.
Oracle's Global Price List, the Java SE Universal Subscription FAQ, and the Oracle Java blog are primary and authoritative: the Employee definition covering agents, contractors, outsourcers and consultants, the $15.00 to $5.25 per month bands, the 50,000 processor ceiling.
And the October 2026 CPU move of JDK 21 to OTN all come from Oracle's own documents.
Settlement percentages published by advisory firms, including ours, are self-reported engagement data, not audited figures, and should be read as directional. What follows is pattern observation from Java engagements between 2023 and 2026, stated as market experience rather than statistics.
Four patterns recur. Oracle cites customer-supplied download history back against the customer, which is why the reconstruction of download history belongs under privilege before anyone queries the account portal.
Reported instances of Oracle declining to sell a subscription until usage and employee-count data is disclosed should be treated by counsel as a data-collection structure wearing a sales badge, not as procurement.
The LMS-to-GLAS rebrand brought formal notices with fixed clocks, which shortens the window in which you can retrofit privilege. And most consistently: the customer's own pre-audit spreadsheet became the opening number.
Build the underlying record properly, following the discipline set out in the Java evidence file standards, and build it under instruction.
The two figures above are the same figure viewed from opposite ends. The $1,188,000 is what your headcount reconstruction is worth to Oracle if it reaches their desk. The 45 days is how long you have to decide whether it does.
Once a formal notice lands, you cannot retroactively privilege a spreadsheet that has been sitting in an open folder since March.
The reading is that Oracle rarely needs to prove your exposure; it needs you to prove it, in writing, first. That is a documentary strategy, and the only counter is documentary discipline applied before the notice arrives.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
Your first five moves
- Issue a counsel-directed engagement letter before anyone counts another employee, dated, scoped in writing, naming the legal question (exposure under Oracle's Employee definition, which sweeps in agents, contractors, outsourcers and consultants) so the resulting workpapers are created for legal advice rather than retrofitted into it.
- Run a document sweep for existing unprivileged exposure estimates, including the Teams messages, budget slides and procurement emails where someone already wrote "roughly $1.2M if Oracle finds this," and decide with counsel item by item which are retained, which are corrected by a privileged superseding analysis, and which are simply wrong and should be replaced rather than deleted.
- Issue a written legal hold that freezes the technical record and suspends log rotation, covering discovery scan output, Oracle download and My Oracle Support account history, removal and decommission logs, and the HR and vendor-management extracts behind headcount, because the evidence file you build now is the only thing that later contradicts Oracle's own telemetry.
- Designate one named owner for all Oracle communications and prohibit direct IT-to-Oracle contact, in writing, to every engineer and admin: no informal replies to GLAS, no portal uploads, no confirming install counts on a call, since 2026 reporting shows Oracle withholding subscription sales until customers first disclose usage and employee-count data.
- Build remediation and the version-upgrade plan as a counsel-directed workstream, targeting JDK 25 under the NFTC (free updates to September 2028, with Oracle's own blog and FAQ disagreeing on September versus October, so plan to the earlier date) and using removal logs Oracle cannot reopen, so what eventually reaches Oracle's desk is completion evidence, not your first-draft estimate.
Frequently asked questions
Does copying in-house counsel on a Java audit email make it privileged?
No. Copying a lawyer does not convert an operational document into a legal one. Privilege attaches when the communication is made to counsel for the purpose of obtaining legal advice, under a scope counsel actually directs.
A scan report forwarded to the general counsel with 30 other recipients is an IT document with a lawyer on the distribution list, and courts routinely treat it that way.
Is our Java install inventory itself protected by privilege?
Generally not. Privilege protects legal advice and, in some jurisdictions, attorney work product, but it does not protect underlying facts. Your installs, download records and headcount exist independently of any legal analysis, and Oracle can request them under the audit clause.
What you can protect is the interpretation layer: the exposure calculation, the legal characterization, and any estimate of what a settlement might cost.
When does a Java legal hold obligation start?
When litigation or a formal dispute becomes reasonably anticipated. In practice, a soft compliance email from Oracle is enough for many counsel to trigger a hold even though the soft letter is not a contractual event and carries no response obligation.
Waiting for the formal 45-day notice is a common error, because routine 30 or 90 day log rotation can destroy relevant records in the interval.
Do we have to hand over an internal exposure estimate if Oracle asks for it?
Almost never. Standard Oracle audit clauses give the right to verify usage, not the right to obtain your legal analysis or your internal valuation of the dispute. If the estimate was produced under a counsel-directed workstream, it is generally protectable.
If it was written in a business email eight months earlier, the position is far weaker, which is precisely why the sequencing matters more than the argument.
Why does the Employee metric make document hygiene more important than in a database audit?
Because the number is decoupled from deployment.
Under Oracle's Employee definition, which includes full-time, part-time and temporary employees plus those of agents, contractors, outsourcers and consultants, a 12,000-person enterprise faces roughly $1,188,000 a year at list whether it runs four Oracle JDK installs or four thousand.
That makes the dispute a binary question about whether any unlicensed install exists, and your own documents are the cheapest place for Oracle to find the answer.
What should we do about exposure spreadsheets that already exist outside privilege?
Do not delete them. Once a hold obligation is even arguably live, deletion converts a licensing problem into a spoliation problem, which is far worse.
Inventory what exists, route it to counsel for assessment, and build the counsel-directed workstream going forward so the current, post-remediation analysis is the protected one. In many engagements the practical fix is producing a defensible later record rather than trying to erase an earlier one.
Does moving to JDK 25 remove the need for any of this?
It reduces future exposure but does not close the historical record. Oracle states JDK 25 binaries are free in production under the NFTC with updates under that grant until September 2028 (Oracle's blog and FAQ differ on September versus October, so treat the date as approximate).
Prior-period use of Oracle JDK 8, 11, 17 or 21 under OTN terms remains assessable, and your removal and decommission logs are what close it, which is why those records deserve over-preservation rather than protection.
