What an Oracle Java license review asks for, and how to prepare an inventory

Oracle's questions about Java use tend to arrive as an email that sounds routine. Whether it's an informal review or a formal audit, the answer depends on facts you may not have gathered yet: which Java runtimes you run, where, and from which vendor. This guide covers what reviews ask for, according to published sources, and how to build that fact base before anyone sends anything to Oracle.

What a review or audit asks for

Pamela Fulmer of Tactical Law Group describes a shift in 2026 from "friendly" outreach to formal audit notices. According to the article, formal letters cite the audit clause, set a response window (the article mentions 45 days), name a third-party auditor, and request:¹

• global employee counts;
• Java deployments by version;
• installation inventories;
• virtualization and cloud environments;
• any other data Oracle considers relevant to calculating the employee metric.

The article also claims Oracle tracks Java download activity in detail. That is the firm's account, not something Oracle publishes, so treat it as a reason to know your own downloads rather than as a verified fact.¹ Oracle's own License Management Services page describes reviews that gather and validate usage data across hardware and software through agreed-upon collection methods.²

Why the version number decides so much

Oracle's license depends on the exact update, not the product name. Oracle JDK 17.0.12 is under the No-Fee Terms and Conditions, which allow commercial and production use;⁶ 17.0.13 is under the OTN license,¹⁰ which allows development and personal use but requires a license for other use.⁵ Oracle's FAQ says you may continue using a release under the license you downloaded it under.⁷ An inventory that says "Java 17" can't tell those apart; one that records Oracle JDK 17.0.12 with its full JAVA_RUNTIME_VERSION string can.

How to prepare the inventory

1. Agree the scope with counsel

Decide which legal entities, networks, clouds and device classes are in scope before collecting anything, and who will see the results. Collect facts about software, not personal data.

2. Collect facts from every host type

Cover servers, VMs, desktops and laptops, container images and CI. For each Java home record the path, the release file keys and the runtime name reported by java -version. The commands for each OS are in how to find Oracle Java installations; a minimal dated capture looks like this:

# Linux/macOS, one host: facts only, into a dated file
$ { date -u +%FT%TZ; hostname; uname -sr
  for r in /usr/lib/jvm/*/release /usr/java/*/release /opt/*/release /Library/Java/JavaVirtualMachines/*/Contents/Home/release; do
    [ -f "$r" ] && echo "== ${r%/release}" && grep -E '^(JAVA_VERSION|JAVA_RUNTIME_VERSION|IMPLEMENTOR|BUILD_TYPE)=' "$r"
  done; } > "java-inventory-$(hostname)-$(date -u +%F).txt" 2>/dev/null

3. Classify each install against Oracle's pages

Use one row per install and cite the Oracle page behind each classification. Anything with conflicting signals, bundled inside another product, or newer than the date you checked the terms is needs review, not a guess.

4. Understand the employee count, separately

Because the subscription metric counts employees, not installs, a single OTN-licensed production install can have a cost out of proportion to its footprint.³ Employee numbers usually come from HR and finance, and whether and how to share them is a question for counsel, not for the infrastructure team.

5. Decide remediation, and keep records

Typical options are replacing Oracle JDK with an OpenJDK build of the same major version, moving to an Oracle JDK release under NFTC, or buying a subscription. Whatever you choose, keep the dated inventory, the change records and the Oracle pages you relied on together.

Things to avoid

• Answering Oracle's questions before counsel has seen them.¹
• Reporting counts without versions: "lots of Java installs" says nothing about which license applies.
• Assuming IMPLEMENTOR="Oracle Corporation" means Oracle JDK; Oracle's GPL OpenJDK builds use it too.
• Claiming installed NFTC builds became paid. They didn't; the license follows the build.⁷

How RuntimeClear helps

RuntimeClear covers step 2 and most of step 3. The free, read-only scanner collects installs and references on Linux, macOS and Windows into one JSON file per host without network calls, and the report tool classifies each against cited Oracle pages in your browser. The paid report produces a dated PDF with the rules version, each finding's license and reason, and a list-price estimate that is clearly labeled as an estimate. It is an inventory for you and your counsel, not a position to send to Oracle.