AI how-to guides Technology and data
How to modernise legacy code with AI
Use AI first to understand the legacy system: extract business rules, data flows and dependencies into documentation engineers can query. Then translate and refactor module by module, with regression tests generated from how the current system actually behaves, and cut over one capability at a time with rollback. Engineers review every change and decide the target architecture.
What AI does
- Reads legacy code and extracts business rules, data flows and dependencies into a searchable map.
- Explains what a module does in plain language and documents it as it goes.
- Translates modules into the target language or stack following governed prompts and your conventions.
- Generates regression tests from the observed behaviour of the current system, not from outdated specs.
- Keeps a record of every AI-generated change and the human review behind it.
What stays with people
- The target architecture and the order in which capabilities move.
- Reviewing and approving every translated module before it ships.
- Deciding which business rules are still valid and which should change.
- Accountability for the cutover and the rollback decision.
How to put it in place
-
Map the legacy system and pick the first capability
Inventory modules, data stores, interfaces and who depends on them, and note the regulatory constraints. Choose a first capability with clear boundaries and real business value, not the most tangled part of the system.
-
Mine the knowledge before touching the code
Use AI to extract business rules, data flows and dependencies into documentation and a dependency map. Have the people who know the system check it, since their corrections are the most valuable input you will get.
-
Capture current behaviour as tests
Record inputs and outputs of the legacy module in real or representative runs and turn them into regression tests. These tests define done: the new code must behave the same unless a rule is deliberately changed.
-
Translate and refactor with review gates
Let AI translate the module into the target stack under governed prompts, then run tests, static analysis and security checks. Engineers review each change and fix what the AI misunderstood.
-
Cut over in steps with rollback
Route traffic for the capability to the new code behind a facade or feature flag, run old and new in parallel and compare results. Retire the legacy module only when the new one holds, then move to the next capability.
What you need
- Access to the full legacy source code, job definitions and database schemas.
- People who know the system, even part time, to validate extracted rules.
- An environment where the legacy system can be run to observe behaviour.
- A defined target architecture and a CI pipeline for the new code.
- Security and IP rules for which AI tools may read the code.
When it is not worth it
- Stable legacy systems that rarely change and carry no risk of losing the people who know them.
- When the business plans to replace the whole function with a packaged product anyway.
- Without any way to run or observe the legacy system, so behaviour cannot be tested.
Risks and how to control them
- Business rules lost or changed in translation: compare old and new behaviour with regression tests and parallel runs before each cutover.
- AI misreading obscure code: have experts validate extracted rules and keep human review on every translated module.
- Code leaving the organisation: use AI tools under enterprise terms or in a controlled environment, with access scoped to what is needed.
- Big-bang thinking creeping back: cut over by capability with rollback, so each step delivers value and can be undone.
- Regulatory gaps in critical systems: keep an audit trail of what changed, why and who approved it.
How Thinkia does it
We mine the legacy codebase first: business rules, data flows and dependencies go into a queryable knowledge graph your engineers can search. Governed prompts then translate modules into the target stack, and regression tests are generated from observed behaviour, not from incomplete specs.
Cutover happens capability by capability, with feature flags, rollback and parallel-run validation. Security, IP and compliance review sit inside the AI workflow, every AI-generated change keeps an audit trail of human review, and documentation is a by-product of the migration. Your engineering team owns the rollout cadence.
The Thinkia solution behind this guide
- Legacy modernization with AI co-pilotsModernize incrementally, govern as you ship
- Enterprise AI-SDLC rolloutAI co-pilots at scale, guardrails included
Thinkia products involved
Frequently asked questions
Can AI convert COBOL to Java automatically?
It can translate much of the code, but not reliably on its own. The safe approach combines AI translation with regression tests from current behaviour, human review of every module and a gradual cutover.
Is it better to rewrite from scratch or modernise step by step?
Big-bang rewrites often lose sponsorship and drift from the business. Modernising capability by capability delivers value earlier and limits risk, as long as you can route traffic between old and new.
What if nobody understands the legacy code anymore?
That is where AI helps most at the start: it can read the code and explain rules and dependencies. Those explanations still need checking against how the system behaves in practice.
How do you know the new code does the same as the old?
With regression tests built from the legacy system's real inputs and outputs, and by running old and new in parallel and comparing results before switching over.
Is it safe to give legacy code to an AI tool?
Only under enterprise terms or in an environment you control, with access limited to what each step needs and a record of what the tool saw and produced.
Keep exploring
Related guides
- How to use AI across the software development lifecycle
- How to keep expert knowledge when people retire
Related decisions
- Legacy rewrite vs AI-assisted modernisation: should you start again or decode what you have?
- LLM evals vs human review: how should you assure the quality of enterprise AI?