Cloud EPM: check AI access, audit permissions and automation before 2027

Why it matters

Unreviewed configurations could lose Generative AI features, find audit events inaccessible to existing users, or operate Linux automation on a deprecated JDK; actual effects depend on installed versions, roles and use.

First step

Identify the Cloud EPM products and current versions, then check which of the three conditions applies and test one authorized workflow before changing production.

Suggested owner

Cloud EPM platform administrator, Enterprise Data Management audit owner and relevant finance/security owners

Who should check?

Organizations using Oracle Cloud EPM products, especially Enterprise Data Management teams whose users download system audit events; Linux or UNIX automation hosts running EPM Automate with JDK 17; and Cloud EPM environments intentionally held below version 26.08 that depend on Generative AI features. An ordinary NetSuite ERP account without these Cloud EPM configurations is not automatically affected.

Important limits and exceptions

The conditions have different consequences. On Enterprise Data Management 26.12, Oracle limits viewing and downloading system audit events through the Audit screen or REST API to Service Administrators and users with the Audit granular role; this is not the Account Reconciliation TM_AUDIT_TRAIL schema change or NetSuite ERP System Notes. JDK 17 support for Linux/UNIX EPM Automate is scheduled to be deprecated in Cloud EPM 27.01; Oracle recommends JDK 21 but does not establish that every existing job instantly stops. Generative AI feature access stops by the end of January 2027 only for environments still below 26.08; it is not a retirement of the NetSuite ERP AI Connector. Oracle release labels and month-based guidance do not establish each tenant's maintenance day or prove rollout. The related 26.12 EPM Automate 26.09 client and encrypted-password-file requirements are covered separately in the existing compatibility article. No customer version, user role or job has been inspected.

Published milestones

October/November 2026 — Oracle readiness guidanceExisting Oracle NetSuite Cloud EPM and Cloud EPM Important Actions pages document the conditional feature, Java and audit requirements. Ebenstead identified this catch-up November 8 and published the guidance November 9; neither date is an Oracle product release.
December 2026 / Cloud EDM 26.12 — audit-event access restrictionAfter the affected environment receives 26.12, only Service Administrators and users with the Audit granular role may view or download system events through the Audit screen and REST API. Review effective roles and report users ahead of rollout.
January 2027 / Cloud EPM 27.01 — JDK 17 support deprecationOracle plans to deprecate JDK 17 support in Linux and UNIX EPM Automate; test an approved JDK 21 configuration and actual scheduled tasks before changing production hosts.
By the end of January 2027 — Generative AI version minimumCloud EPM environments that have not reached 26.08 or later lose Generative AI feature access. Confirm any intentionally deferred environments and their upgrade schedules before the stated conditional milestone.

Check your Oracle account notice before scheduling an update.

A practical response

Have the Cloud EPM application owner identify products and actual update versions, deployment windows and intentionally skipped or deferred updates; establish whether Generative AI, system audit downloads or Linux/UNIX EPM Automate are in use.
For Enterprise Data Management, have the security owner compare users of the Audit screen and REST API against Service Administrator and Audit granular-role permissions. Test legitimate viewing/download workflows after authorized role changes.
Inventory EPM Automate hosts and JAVA_HOME values. Test JDK 21 and important job schedules in an approved non-production environment before planning controlled production changes; distinguish JDK support from the existing encrypted-password/client-version cutover.
Validate the effect of Cloud EPM 26.08 or later on the exact Generative AI workflows in any deferred environment. Document fallback processes and owner-approved maintenance choices without presuming a universal upgrade date.

What we’ll review

Request an approved list of Cloud EPM environment/product versions and maintenance notices, identity of their Service Administrator and audit owners, effective Audit granular roles and any REST audit downloads, EPM Automate versions and Linux/UNIX JAVA_HOME/JDK values, and a sanitized inventory of Generative AI workflows. Confirm which features are actually used before recommending configuration changes.

Sources and updates

Oracle documentation

Oracle Cloud EPM November 2026 important actions: Financial Reporting stops working with 27.02 ↗Oracle publication/update date not stated on this page. · Last successful source check: 2026-11-07

NetSuite Cloud EPM October actions and considerations ↗Oracle publication/update date not stated on this page. · Last successful source check: 2026-10-20

Update history

2026-11-08 — Previously issued Oracle Cloud EPM readiness notices identified by Ebenstead as unpublished material catch-up; this date is discovery, not Oracle publication.
2026-11-09 — First Ebenstead publication of the combined, configuration-specific Cloud EPM guidance; no customer rollout or exposure asserted.

Follow this topic via RSS

How Ebenstead helps

Cloud EPM Version, Automation and Audit Control Pilot — proposed scoped one-off

Signed Functional Requirements Document identifying one approved environment and an agreed AI, automation or EDM audit workflow, roles, boundaries and acceptance criteria
Version/role/JDK dependency inventory with one authorized representative compatibility or role-access test and a before/after evidence record
Documented exception, risk and rollback checklist addressing customer maintenance dates and an agreed finance/security owner
Test results, operational instructions, owner UAT and final client signoff

Scope

Proposed one-off pilot only, not an individually approved service package or evidence of customer impact. Cross-environment migrations, identity/security redesign, infrastructure updates or multiple business processes require a separate scoped project. No broad administrative changes are included.

Ongoing administration

Inventory and limited coordination could fit a separately agreed Administrator Subscription only within approved scope and real capacity; actual permission, runtime or production changes require the customer's authorized owner and defined acceptance tests.