How to Use AI Coding Tools to Resurrect Legacy Internal Systems: A How-To Guide

The short answer

You update legacy software with AI by using coding agents to read the undocumented codebase, generate tests that pin down its current behavior, then write small, verified patches and drivers instead of a full rewrite. This lets teams keep systems they already own running securely for a fraction of what a SaaS replacement or a from-scratch rebuild costs. The average global enterprise wastes more than $370 million a year failing to modernize legacy systems efficiently, and nearly $134 million of that is tied to slow, resource-intensive transformation projects alone.¹ AI-assisted patching gives you a third option between "suffer with it" and "buy a new platform."

Why teams are reaching for AI instead of a new SaaS contract

Most internal systems don't die of old age. They die of neglect, because nobody wants to touch the code. The person who understood the billing reconciliation script left four years ago. The vendor of your inventory system stopped answering emails. So the default move becomes: buy a SaaS replacement, migrate the data, retrain the team, eat the new subscription forever.

That default is expensive. Enterprises typically spend 60 to 80 percent of their IT budget just keeping existing systems alive, according to industry benchmarks reported across multiple modernization studies.² For the U.S. federal government alone, ten of the most critical legacy IT systems, ranging from 8 to 51 years old, cost about $337 million a year to operate and maintain.³ That's money spent standing still, not money spent replacing anything.

AI coding tools change the math because they attack the actual bottleneck: nobody understands the old code, and writing characterization tests and patches by hand takes too long. A coding agent can read a 20-year-old codebase, explain what it does, draft tests that pin its current behavior, and propose a scoped patch, in hours instead of weeks. That is genuinely new. It wasn't possible three years ago at this speed or this price.

The core idea: patch and extend, don't rebuild

The angle here is simple. Instead of retiring an owned system and renting its replacement, use AI to keep the owned system alive: write the missing driver so it talks to a modern API, patch the dependency that's now end-of-life, generate the test suite that lets you touch the code safely again. You are treating the software as an asset worth maintaining, not a liability to escape.

This works because AI is disproportionately good at exactly the tasks that made legacy maintenance expensive: reading undocumented code, writing tests for code that has none, and doing mechanical refactors at scale. McKinsey's research on generative AI in IT modernization found 40 to 50 percent faster modernization timelines and roughly 40 percent lower technology-debt-related costs when generative AI takes on this manual work.

The step-by-step process

1. Map the system before you touch it

Before any patch goes in, point an AI coding agent at the full codebase and ask it to produce a plain-language account of what each module does, what depends on what, and where the risk lives. This is the step manual modernization projects used to burn weeks or months on. Morgan Stanley's internal tool, built on GPT models, processed nine million lines of legacy COBOL and translated it into plain-English specifications, saving an estimated 280,000 developer hours in the process.⁴ You don't need Morgan Stanley's scale to benefit from the same technique on a much smaller internal tool.

2. Pin current behavior with characterization tests

This is the step most teams skip and later regret. Before changing anything, have the AI generate characterization tests, sometimes called golden-master tests, that record what the system does right now, bugs and all. This gives you a tripwire: any patch that changes observable behavior fails a test immediately instead of failing silently in production. Writing this suite by hand for a large, undocumented module used to take weeks. AI drafts it in hours by reading the code and enumerating the branches. A human still has to review the generated tests for whether they're actually meaningful, not just padding a coverage number.

3. Write the driver or patch in small batches

Once behavior is pinned, ask the agent to write the specific thing you need: a driver that lets the old system talk to a new payment processor, a patch that swaps a deprecated library, a wrapper that exposes an internal API modern tools can call. Keep changes small and reviewable. A five-thousand-line "AI cleanup" pull request is not reviewable and is therefore not safe. A few hundred lines with a clear scope is.

4. Gate everything in CI

Every patch runs through the characterization suite, static analysis, and security scanning before it ships. AI-written code gets no exemption from these checks. This is also where dependency and framework upgrades pay off fastest: an internal Amazon team of five people used an AI agent to upgrade one thousand production Java applications from version 8 to 17 in two days, with individual upgrades averaging about 10 minutes each, compared to the two to three days per application that manual upgrades used to take.⁵

5. Roll out incrementally and monitor

Run the patched system alongside the old path where possible, or canary the change to a small slice of traffic first. Watch error rates and behavior diffs after release, and feed anything unexpected back into the test suite so the safety net gets tighter over time. Big-bang cutovers throw away the caution the previous four steps bought you.

What this actually saves you

The cost comparison is the reason this approach is spreading. A mid-size legacy application, in the 200,000 to 500,000 line range, typically costs $400,000 to $1.2 million and takes 8 to 18 months to migrate manually. The same scope with AI assistance runs $200,000 to $600,000 over 4 to 10 months, according to industry cost tracking. That is before you even count what a new SaaS subscription would cost every year going forward, on top of the migration bill.

Where this fits with build vs buy

None of this means every legacy system deserves a patch instead of a rewrite. Some systems really have run out of runway: the business logic no longer matches how the business works, or the platform is a genuine security liability nobody can insure against. But for the internal tools that mostly work, that a small number of people depend on, and whose only real problem is that nobody dares open the code, AI-assisted patching is now cheap enough to be the sane default. Teams that treat their internal software as an asset worth maintaining rather than a rental to be swapped out are the ones getting the most mileage out of this shift, because they're not starting from zero every time a vendor raises prices or a library goes end-of-life.

FAQ

Can AI actually rewrite legacy code safely on its own? No, not unsupervised. AI can translate and refactor legacy code, but every credible success story pairs it with a verification harness, characterization tests, and human review before anything ships. Treat AI output as a draft, not a finished patch.

How much does AI-assisted legacy modernization typically cost compared to manual work? For a mid-size application (200,000 to 500,000 lines), manual migration runs $400,000 to $1.2 million over 8 to 18 months. AI-assisted work on the same scope typically runs $200,000 to $600,000 over 4 to 10 months, a 35 to 50 percent reduction in both cost and timeline.

What's the first thing I should do before writing any AI-generated patch? Generate characterization tests that capture what the system currently does. Without this safety net, you can't tell whether a patch changed behavior until it breaks in production.

Is this safe for regulated or compliance-heavy systems? It can be, if AI-generated changes go through the same controls as human-written code: mandatory review, static and security analysis, and a named human owner for every change that ships. Regulators audit outcomes and controls, not who typed the code.

Does this replace the need to eventually retire really old systems? No. Some systems genuinely need to be replaced, especially when the underlying platform is an unsupported security risk. AI-assisted patching is best suited to systems that mostly work and just need to keep working, not systems that have fundamentally outlived their design.