Why AI Changes How to Sequence a Modernization Portfolio

Contents9 sections

The Rule That Is Not in the Code

Somewhere in a state agency this quarter, a developer is reading a Common Business-Oriented Language (COBOL) paragraph that applies a dollar threshold to an eligibility decision. The number is a literal. There is no comment, no requirements document, and no one left on the team who can say where it came from. It might trace to a statute, a consent decree, or a rounding convention somebody adopted in 1994. The code is perfectly readable. The rule is not.

A computer terminal displaying dense green-on-black source code in a dimly lit office full of paper.

A few modules away in the same application, the logic is self-contained: a validation routine with clean paragraph boundaries, a surviving copybook, and behavior fully determined by its inputs. An AI coding agent can read that routine, describe what it does, generate tests that pin down its current behavior, and produce a translation a reviewer can check in an afternoon. On the threshold, the same agent produces fluent prose that is confidently wrong, and nobody on the team is positioned to catch it.

Those two modules are the same age, written by the same shop, running in the same production region. They do not cost the same to modernize, and AI-assisted tooling has widened the gap between them. AI lowers modernization cost unevenly across a portfolio, and the variation is now wide enough to change sequencing. Ranking candidates by age, by maintenance line item, or by which stakeholder complains loudest produces a different order than ranking by how much of a system's logic can be recovered, documented, and tested automatically. For state chief information officers (CIOs) building the next biennial request, the second ranking is the one worth defending to a budget office.

What the EY Survey Found

Ernst & Young LLP, which sells modernization services into this market, published survey results on October 29, 2026 that put numbers on the collision between AI spending and legacy debt. The EY State and Local Government Modernization Maturity Survey was conducted online by M Booth Research & Insights between July 23 and August 4, 2026, polling 200 U.S. state and local government decision-makers, split evenly between state respondents and local or municipal respondents from jurisdictions of at least 100,000 constituents. Two hundred self-selected respondents are not a representative sample of American state and local government, and every figure below is what leaders reported about their own agencies.

The pattern still warrants attention, with the caveat that EY sells modernization services and has a commercial stake in how these figures land. EY reports that "About three times as many say their agency spends significantly more of their annual IT budget on maintaining legacy technology systems (38%) rather than on implementing new solutions (12%)," and that "Three-quarters (75%) of state and local government decision-makers report that their agency's reliance on legacy technology systems will eventually lead to a significant operational failure." No independent source has replicated these two figures, so treat them as self-reported sentiment rather than audited fact. GovTech's independent coverage reported that 69 percent of respondents said they had either fully implemented AI or were in the process, and that 88 percent raised concerns about a lack of dedicated funding for modernization projects, which are often budgeted as special appropriations.

The audience's own association describes a compatible condition with no vendor in the room. In the 2026 State CIO Survey from the National Association of State Chief Information Officers (NASCIO), one CIO described the office as being on a "workforce cliff," adding that "The people who hold the institutional knowledge of our legacy systems are retiring, the pipeline behind them is thin and AI is simultaneously redefining what an IT job even is." Heavy maintenance spending, expectation of failure, fast AI adoption, and a retiring knowledge base are landing in the same budget cycle.

Where AI Helps and Where It Stalls

Current tooling is genuinely good at reading code. Given a reasonably structured COBOL module, a capable model will describe what it does, trace data flow through it, and flag branches that no longer appear reachable. IBM Research, which has a commercial stake in mainframe modernization, reported at the IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) in March 2026 that augmenting COBOL-to-Java translation with natural-language summaries improves 36 percent of eligible CodeNet samples and 50 percent of low-scoring enterprise benchmark samples, which the authors describe as effectiveness on the most challenging cases; those figures come from IBM's own benchmark and have not yet been replicated by an independent lab. The same abstract is candid about the ceiling, noting that model effectiveness "is limited by COBOL's domain-specific syntax and the scarcity of high-quality training data."

Test generation is the second place the tooling earns its keep, with a sharper caveat. Characterization tests, which pin down what a legacy system currently does rather than what it ought to do, are the practical safety mechanism for any migration. An empirical study of large language model test generation workflows found that ordering matters: generating tests after faulty code significantly reduced the fault detection rate compared with generating tests independently, 14 percent versus 25 percent, because the model's misunderstanding propagates into both artifacts and the tests end up certifying the bug. A systematic review adds that few studies have evaluated these methods in real industrial settings, and that performance deteriorates against outdated libraries, proprietary dependencies, unstructured legacy code, and thin documentation.

Where the tooling stalls is consistent and identifiable. It stalls where the rule is not in the code: a threshold like the one above, an exception path that exists because of a settlement nobody archived, eligibility logic maintained by hand in a lookup table, a nightly batch job whose real specification is a downstream report someone reconciles by eye. None of that is recoverable by reading source, and the models do not signal uncertainty when they hit it. The National Association of State Workforce Agencies (NASWA) found that over 90 percent of states were running unemployment insurance benefits and tax systems on older mainframe technology, relying on outmoded programming languages and data access methods: COBOL, together with the Customer Information Control System (CICS) transaction monitor and Virtual Storage Access Method (VSAM) files. Nine in ten reported that operations costs escalate every year. The Government Accountability Office (GAO) describes the same condition federally, with the most critical legacy systems ranging from roughly 8 to 51 years old and most responsible agencies either lacking modernization plans or holding incomplete ones.

What sets the cost of modernizing a system is how much of its logic can be made legible again. Age is a weak proxy for that, and it is the proxy most portfolio assessments still use.

Failures That Already Happened

An empty government office waiting area with closed service windows and rows of vacant chairs.

The 75 percent who expect a significant operational failure are extrapolating from systems that already failed once, in public, under load. The Bipartisan Policy Center's analysis of unemployment insurance modernization found that as claim volumes jumped during the pandemic, COBOL's inefficiencies contributed to deep backlogs and processing errors, and that antiquated systems were susceptible to attack by fraudsters. Georgetown's Beeck Center documented the acute version across three states, where claims volume skyrocketed overnight, systems crashed, and claimants were effectively blocked from filing. NASWA found 82 percent of states reporting difficulty implementing new federal or state law because of system constraints, the slow-motion version of the same failure.

GAO's 2025 update adds the security dimension. Of the 11 federal legacy systems it identified as most in need of modernization, seven were reportedly operating with known cybersecurity vulnerabilities that cannot be remediated without modernization.

How to Run a Five-Application Assessment

Pick five candidate applications and give an AI-assisted assessment a fixed, short window on each. Measure three things rather than one.

Start with how much of the system's behavior the tooling can document without human help: what share of modules produce a description a subject matter expert confirms is correct, and where the descriptions go vague or confidently wrong. Then measure how many characterization tests can be generated and validated against observed production behavior rather than against the model's own reading of the source, which is the error-propagation trap the test generation research identifies. Finally, record where the tooling stalls, specifically and by name, because the stall points are an inventory of logic that lives in institutional memory or in the data rather than in code.

The output is a recoverability score per application, and it will not track age. A twenty-year-old system with clean module boundaries and a maintained data dictionary can score far higher than a twelve-year-old custom web application whose business rules were negotiated in email threads and implemented inline. The two highest scorers become the first modernization tranche. The lowest scorers are not abandoned; they get a different first step, structured knowledge recovery with the people who still remember, while those people are still reachable.

The discipline we described in our account of agentic migration, human-defined scope paired with automated verification, applies to assessment the way it applies to execution. Timelines on any given system depend on what the assessment finds, and that post is explicit about where the approach does not belong, advising caution "where tests are thin, rollback is slow, or compliance requires extensive pre-approval." Those conditions describe a substantial share of state portfolios, which is why the assessment comes before the commitment.

Budgeting for the Second Year

Two software developers reviewing code together on a monitor in a daylit office.

The savings hold only if validation and year-two ownership are funded in the same appropriation that funds the migration. AI-generated code still needs reviewers who understand both the legacy system and the target platform, and in most state IT shops those people are the scarcest resource in the building.

The evidence on what happens when review capacity goes unfunded is substantial. A study of AI-assisted programming found core developers reviewed 6.5 percent more code after Copilot's introduction while showing a 19 percent drop in their own original code productivity, measured as commit activity. A large-scale analysis mining 302,579 AI-authored commits across 6,299 GitHub repositories found that 22.7 percent of tracked AI-introduced issues still survived at the repository's latest version. Static analysis of 4,442 Java coding assignments across five models found that bugs accounted for roughly 5 to 8 percent of the issues flagged and security vulnerabilities for about 2 percent, a rate the authors call significant. A review of agentic AI evaluation reports a deployment in which human inspection of SWE-bench agent output rejected 72 percent of agent-generated patches on maintainability grounds.

None of that argues against using the tooling. It argues for pricing the review into the budget from the start. The Secure Software Development Framework from the National Institute of Standards and Technology (NIST), including the SP 800-218A profile covering generative AI and dual-use foundation models, gives a recognized structure for what validation should cover, and the NIST AI Risk Management Framework with its Generative AI Profile supplies the governance layer above it. We made the same ownership-cost argument about prototypes that ship overnight and arrive as an invoice in year two. Migration is that pattern with higher stakes, because the system is already load-bearing when the bill lands.

Paying for the First Tranche

A laptop showing a budget spreadsheet beside a printed financial report with a pen resting on it.

The first question any state CIO asks is whether the opening tranche can be funded from the maintenance it retires. The federal Technology Modernization Fund, authorized by the Modernizing Government Technology Act of 2017, is the clearest working model of financing modernization as a repayable investment, with a program management office providing technical, acquisition, and financial assistance and oversight through execution. Most states have no equivalent vehicle, which is what the 88 percent funding concern in the EY data describes in practice: modernization competes as a special appropriation once per cycle, while maintenance renews quietly and never has to win an argument.

A recoverability assessment is small enough to run inside existing discretionary spend, and it produces the one artifact a budget office responds to: a defensible reason why these two systems and not those three. Run it in the cycle before the ask.

Reordering the Portfolio

Age, political visibility, and the size of the maintenance line were defensible ranking criteria when modernization cost scaled mostly with system size. Recoverable logic reflects what the tooling can now actually do, and it can be measured before the money is committed.

Some systems will stay hard because the logic was never written down and the people who knew it are gone or going. Those need human knowledge recovery first and tooling second, and the sooner that work starts, the more of it survives. A portfolio ranked by recoverability keeps a state IT shop from spending its first AI-era dollars on whichever system happens to be oldest, and points them at the ones where the work compounds.

Run the five-application assessment. Fund the review capacity in the same line as the build. Let the measurement pick the order.

Sources

Back to Blog

Why AI Changes How to Sequence a Modernization Portfolio

The Rule That Is Not in the Code

What the EY Survey Found

Where AI Helps and Where It Stalls

Failures That Already Happened

How to Run a Five-Application Assessment

Budgeting for the Second Year

Paying for the First Tranche

Reordering the Portfolio

Sources

More articles

Want our take on your AI roadmap?

Related services from Spruce

AI Roadmap

AI Readiness

Cloud Services