Oracle Java audit defense: what to do when the letter arrives

A formal Oracle Java audit notice is a different document from the earlier “soft audit” outreach email — it typically cites a license-management or LMS engagement and asks for a documented response on a deadline. The instinct to answer quickly is understandable. The stronger move is to spend the first days establishing your own position before you answer theirs.

What the notice can actually establish

The notice typically points to evidence Oracle already has — download records, support contacts, or a prior soft-audit exchange — and asks you to run a data-collection script or submit a deployment report. What it does not establish on its own is which of those downloads turned into a licensable deployment, which machines run an alternative OpenJDK build instead, or whether a given install falls under a no-fee license window. Those distinctions are yours to make, and making them first changes the conversation.

Build your position before you respond

• Inventory before you run their script. Know what is actually installed, on which machines, and under which license terms before a vendor-supplied tool reports it for you.
• Separate Oracle builds from OpenJDK. Distributions such as Temurin, Corretto, and Zulu are not in scope for a commercial Java SE subscription; only confirmed Oracle JDK/Oracle builds are.
• Check the license terms per version. Oracle JDK 17 and later ship under the No-Fee Terms and Conditions for a defined window; earlier versions and post-2019 Java 8 security patches are where a subscription is typically required.
• Loop in counsel or a licensing advisor early. A formal audit notice carries contractual and legal weight that a soft-audit email does not — get advice on the response itself, not just the inventory behind it.

Answer with your inventory, not their assumption

Every response is stronger when it starts from a reconciled inventory rather than a defensive posture. Teams that separate Oracle builds from OpenJDK first, and map each Oracle install to its actual license status, often find the confirmed footprint is smaller than the notice implies — and some are able to show no subscription is owed at all once the inventory is clean.

How RenewalIntel helps

RenewalIntel maps where Oracle JDK is actually installed across your estate, separated from OpenJDK builds, so the inventory you bring to an audit response reflects deployment truth rather than download logs. It does not compute your per-employee price for you — that follows your headcount, not your usage — and RenewalIntel is software, not legal or negotiation representation.

See your Oracle Java exposure before you reply to the audit →