In short: AI-driven legacy code modernisation allows enterprises to finally decode and migrate decades-old technical debt safely. By extracting business rules rather than just translating syntax, IT leaders can decommission mainframe infrastructure with significantly lower risk.
The Situation
The global economy runs on code written before most of today’s software engineers were born. Core banking systems, government registries, and aviation networks remain heavily dependent on mainframe architectures and legacy programming languages like COBOL or RPG. For years, the prohibitive cost and operational risk of migrating these systems have paralysed enterprise IT. Companies are forced to maintain increasingly expensive legacy infrastructure while the talent pool capable of operating it slowly retires. However, the release of Advancing coding in low‑resource programming languages by OpenAI fundamentally alters this equation.
Historically, large language models have struggled with legacy environments because their training data is dominated by modern, web-native languages like Python and JavaScript. By introducing targeted capabilities for low-resource languages, AI models are now demonstrating proficiency in domains that were previously too niche or data-poor for reliable automation. This signals that legacy code modernisation is finally shifting from an intractable, multi-year manual slog to a manageable, AI-assisted engineering discipline.
What This Signals The primary barrier to decommissioning mainframe systems is no longer a lack of engineering talent willing to write legacy syntax; it is the sheer volume of undocumented business logic. AI is now capable of acting as the translation and discovery layer between decades-old technical debt and modern cloud architectures.
The Real Challenge of Legacy Code Modernisation
What most enterprise teams get wrong about AI and legacy systems is treating the migration as a pure syntax translation problem. The naive assumption is that an engineering team can simply pass a COBOL file into a large language model, ask for Java or C#, and deploy the resulting output into production.
This approach reliably ends in disaster. A forty-year-old mainframe programme does not just process transactions; it is a geological record of the business. It contains decades of undocumented regulatory patches, forgotten workarounds, and bespoke logic written specifically to compensate for the hardware limitations of 1980s infrastructure. When you attempt a direct, line-by-line translation, you do not modernise the system—you merely replicate the structural flaws of the past in a modern language. The result is ‘object-oriented COBOL’: code that technically compiles in a cloud environment but remains entirely unmaintainable by a modern software engineering team.
The real challenge lies in recovering the lost intent behind the code. Before a single line of modern software is written, the business rules must be extracted, mapped, and verified against current operational realities. Historically, this discovery phase consumed the vast majority of a modernisation budget, requiring teams of business analysts to painstakingly trace data flows through millions of lines of unoptimised code. The breakthrough with low-resource AI proficiency is not just in writing new code, but in the model’s ability to ingest legacy repositories and generate human-readable documentation, flow diagrams, and test cases that decode the system’s actual, undocumented behaviour.
The Enterprise Playbook
To capitalise on these new AI capabilities, organisations must abandon the high-risk ‘big bang’ rewrite in favour of an AI-assisted, iterative extraction process. We recommend a phased approach that uses generative models to understand, test, and finally rebuild legacy assets systematically.
First, deploy AI to map the current state and recover the business intent. Feed the legacy codebase into a secure, enterprise-grade model to generate comprehensive documentation and architectural diagrams. The goal here is to separate the core business rules from the legacy technical implementations—such as memory management workarounds specific to old mainframes. This phase gives enterprise architects a clear, objective view of what actually needs to be rebuilt and what can be safely discarded.
Second, establish an AI-generated intent-based test harness. One of the highest risks in legacy code modernisation is breaking undocumented functionality that downstream systems rely on. Engineering teams must use AI to read the legacy code and generate hundreds of unit and integration tests that capture the current input-output behaviour. This creates an impenetrable safety net, ensuring that the modernised application behaves exactly like the legacy system under identical conditions. Our Decision guide: Legacy rewrite vs AI-assisted modernisation: should you start again or decode what you have? provides a strict framework for choosing when to map existing behaviour versus when to rethink the logic entirely.
Finally, orchestrate the translation and deployment within a governed pipeline. Instead of allowing developers to copy and paste translated snippets from a web interface, integrate the AI models directly into your CI/CD workflows. This ensures that all AI-generated code is automatically scanned for security vulnerabilities, adherence to modern architectural standards, and compliance with the EU AI Act. For a structured approach to this integration, leadership teams should implement the principles detailed in our whitepaper, AI–SDLC. From code to intent.
| Scenario | Recommended Approach | Key Risk |
|---|---|---|
| Undocumented core logic | Use AI to generate functional specifications and flow diagrams before writing any new code. | Misinterpreting 1980s hardware constraints as vital business rules. |
| High-risk transactional data | Generate identical test harnesses with AI, ensuring new modules pass legacy constraints perfectly. | Edge cases hidden in historical patches causing silent failures in production. |
| Siloed legacy modules | Iterative strangler-fig pattern, using AI to replace one verified microservice at a time. | Maintaining parallel infrastructure and data synchronisation for too long. |
By Role: What to Do This Quarter
| Role | Priority this quarter |
|---|---|
| CIO | Halt purely manual migration programmes and mandate an immediate proof-of-concept using AI to analyse and document a single, isolated legacy module. |
| CTO | Establish a governed AI-SDLC pipeline that strictly prevents line-by-line syntax translation, enforcing business-logic extraction and automated test generation before any modern code is written. |
| CISO | Implement rigorous data masking and sanitisation protocols to ensure that no sensitive production data or hardcoded credentials buried in legacy repositories are fed into commercial AI models. |
Questions to Pressure-Test Your Strategy
- Are we treating legacy code modernisation as a syntax translation problem rather than a business logic recovery exercise?
- Do our engineering teams have the automated tooling required to generate test harnesses for undocumented mainframe behaviour?
- Are we reliant on external vendors for manual code translation, or are we building the internal engineering maturity to govern AI-assisted extraction?
- How will we measure the structural integrity, accuracy, and security of the AI-modernised code before it reaches our production environment?
- Are we exposing proprietary business logic or regulated customer data to third-party models during the analysis phase without adequate masking?
Juan José López: «Translating COBOL to modern languages line-by-line using an LLM simply gives you object-oriented COBOL—which is an unmaintainable nightmare. The real value is using AI to decode the buried business rules first, so you can rebuild the architecture properly.»
FAQ
Q: How do we ensure the AI accurately translates complex, undocumented business rules?
A: Accuracy is achieved through a strict test-driven approach, not blind translation. We recommend using AI to first generate a comprehensive suite of automated tests based on the legacy system’s precise inputs and outputs. The new AI-generated modern code must pass this identical test harness perfectly before human engineers review and approve it.
Q: Is AI-assisted legacy code modernisation secure for highly regulated industries?
A: Yes, provided it is executed within a governed environment. Organisations must use private, enterprise-tier models that do not use corporate data for continuous training. Furthermore, engineering teams must implement aggressive data masking to ensure sensitive customer records or credentials hardcoded into legacy databases are stripped before analysis.
Q: What is the expected timeline for an AI-assisted mainframe migration compared to a traditional rewrite?
A: While timelines vary heavily by architectural complexity, the discovery and documentation phase—typically the most resource-intensive part of a manual rewrite—can be drastically accelerated using AI. However, the rigorous automated testing and parallel-running phases remain critical to operational stability and dictate the final deployment schedule.
Q: Does using AI eliminate the need for mainframe experts during the migration?
A: No. AI acts as an accelerator and discovery tool, but human oversight remains a regulatory and operational necessity. Subject matter experts and legacy engineers are still required to validate the AI-generated functional specifications and ensure the extracted business logic aligns with actual enterprise operations.
Bottom Line
The era of being held hostage by decades-old technical debt is ending. The advancements in AI proficiency for low-resource programming languages finally provide enterprises with a credible, scalable mechanism to modernise core infrastructure safely. However, the winners in this architectural transition will not be those who simply use AI as a fast syntax translator. The competitive advantage belongs to organisations that deploy these models to systematically recover their lost business logic, build robust automated testing safety nets, and fundamentally re-architect their systems for the cloud era. The technology to decode the past is here; success now depends entirely on engineering discipline and rigorous governance.