Legacy Code Modernization with AI: What Actually Works

Legacy code modernization with AI is the use of large language models and coding agents to understand, test, refactor, translate, and upgrade aging codebases — at the level of the code itself, function by function and module by module. It is not a magic rewrite button. Used with discipline, AI compresses the most labor-intensive parts of modernization: McKinsey reports 40–50 percent faster modernization timelines and roughly 40 percent lower technology-debt costs when generative AI absorbs the manual work. Used carelessly, it changes system behavior silently and ships the regression to production.

This guide is for engineering leaders and senior developers deciding what to actually do to the code. It covers the five techniques where AI demonstrably works, the tooling trade-offs, and the gated workflow that keeps behavior intact. For the program-level view — sequencing waves, governance, and business cases across an application portfolio — see our pillar guide to AI-powered legacy modernization.

What Legacy Code Modernization with AI Means

Legacy code modernization with AI means applying AI where the constraint really lives: in millions of lines of poorly documented, thinly tested code that nobody fully understands anymore. Michael Feathers' working definition — legacy code is code without tests — explains why modernization stalls. You cannot safely change what you cannot verify, and you cannot write meaningful tests for code you don't understand.

That framing also explains what AI changes. Reading code, explaining code, and drafting tests are exactly the tasks large language models are strongest at — and exactly the tasks that consumed most of the human effort in every pre-AI modernization program. The architecture decisions still belong to people. The archaeology no longer does.

It helps to distinguish three levels, because "modernization" gets used for all of them:

Level	Question it answers	Where it's covered
Portfolio	Which systems to modernize, in what order, with what budget	Enterprise modernization strategy
Program	How to run a modernization initiative: phases, waves, governance	AI-powered legacy modernization roadmap
Code	What to do to the code itself: understand, test, refactor, translate, upgrade	This article

Five AI Techniques That Work on Legacy Code

Across published enterprise results and our own delivery work, five code-level techniques have earned their place. They compound in roughly this order — each one makes the next safer.

1. Code comprehension and explanation

The first win is turning opaque code into explained code. Modern models read a 3,000-line stored procedure or a COBOL batch job and produce an accurate plain-English account of what it does, which inputs matter, and where the edge cases hide. Morgan Stanley's internal DevGen.AI tool took exactly this approach: rather than auto-rewriting code, it translated nine million lines of legacy code into plain-English specifications, saving an estimated 280,000 developer hours that engineers then used to reimplement functionality in modern languages.

Comprehension output is only as good as its validation — subject-matter experts must confirm whether each recovered behavior is intended, tolerated, or obsolete. The full recovery workflow, including that validation gate, is in our guide to legacy system documentation with AI.

2. Characterization test generation

Before changing behavior, pin it down. Characterization tests (also called golden-master tests) record what the system currently does — not what a spec says it should do — so that any refactoring that changes observable behavior fails a test immediately. Writing them by hand for a large legacy module used to take weeks; AI drafts them in hours by reading the code, enumerating branches, and generating cases that exercise them.

Two rules keep this honest. First, a human reviews the generated tests for meaningfulness — coverage percentage is easy to inflate with assertion-free tests. Second, the tests capture today's behavior including its bugs; deciding whether a pinned behavior is a feature or a defect is a product decision, not an AI decision.

3. Refactoring in place

With behavior pinned, AI-assisted refactoring becomes routine rather than heroic: extracting functions from thousand-line procedures, removing dead code, untangling global state, introducing seams and interfaces where none existed. The discipline that matters most is batch size. Small, reviewable pull requests with the characterization suite running in CI catch semantic drift immediately; a 5,000-line "AI cleanup" PR is unreviewable and therefore unsafe.

Refactoring in place is also the technique that pays down measurable debt — duplicated logic, outdated idioms, missing abstractions. For the economics of that work at scale, including how to price debt in business terms, see how to reduce technical debt with AI.

4. Code translation

Translation — COBOL to Java, VB6 to C#, AngularJS to React — is where expectations most outrun reality. LLMs translate individual units well, but a line-for-line translation of a whole system reproduces the old architecture in a new syntax, and idiomatic differences (numeric precision, error handling, implicit ordering) create subtle behavioral gaps. The teams that succeed treat translation as a draft that must pass the characterization suite, and they invest in the surrounding harness — automated validation, differential testing against the legacy system, rollback — more than in the translation prompt itself. Google's report on its internal LLM-driven migrations found roughly 50 percent of migration time saved, with the gains coming from exactly that toolchain-plus-verification structure.

Translation is a deep enough topic that we cover it separately: the six-step workflow, cost model, and failure modes are in our AI-assisted code migration playbook.

5. Dependency and framework upgrades

The least glamorous technique has the most predictable ROI: moving off end-of-life runtimes and frameworks. This is where deterministic tools and AI combine best — OpenRewrite applies verified transformation recipes at scale, and AI handles the residue the recipes can't express. Amazon reported that agent-assisted transformation let a five-person team upgrade 1,000 production Java applications in two days, work that previously averaged about 50 developer-days per application. If your estate runs on aging JVMs, our guide to modernizing Java legacy applications walks through version-specific breakage and sequencing.

What AI Still Can't Do to Legacy Code

Honest scoping prevents the most expensive failures, so state the limits plainly:

• Recover intent that isn't in the code. AI reads what the code does, not why. The regulatory reason behind a strange rounding rule, the customer commitment behind a hard-coded exception — that context lives with people, and modernization programs must budget interview time to capture it.
• Make architectural decisions. Which modules become services, which get retired, what the target data model looks like — these are judgment calls with business consequences. AI informs them with dependency maps and usage analysis; it doesn't make them.
• Guarantee semantic equivalence. No model certifies that translated code behaves identically. Only differential testing against pinned behavior does. Any vendor claiming otherwise is selling the demo, not the system.
• Absorb accountability. A regulated enterprise still needs a named human owner for every change that ships. Review, provenance, and audit trails are part of the workflow, not an afterthought.

Choosing the Tooling: Codemods, Assistants, or Agents

Three tool classes dominate legacy code work, and mature teams use all three deliberately rather than picking a favorite:

Tool class	What it is	Best for	Limit
Deterministic codemods	Rule-based transformations (OpenRewrite, jscodeshift)	Framework and API migrations with known patterns	Can't handle novel or context-dependent code
IDE assistants	Copilot-style, developer-driven	Comprehension, test drafting, small refactors inside the editor	Throughput bound by developer attention
Autonomous coding agents	Devin-class agents working full tasks in parallel	Batch refactoring waves, upgrade campaigns, test backfill across many repos	Needs explicit guardrails, CI gates, and review capacity

The economic shift comes from the third row: agents parallelize the repetitive 80 percent of modernization work, while your senior engineers concentrate on the architectural 20 percent. As an official partner of Cognition (Devin) and Replit, we run this operating model in client engagements — and the binding constraint is rarely the agents. It's whether your review process, test suite, and CI pipeline can absorb agent-scale throughput safely. How to build that absorption capacity is the subject of production-safe AI-generated code.

A Safe Workflow: Seven Steps with Quality Gates

The number-one risk in legacy code modernization with AI is silent behavior change — code that looks cleaner and compiles green but does something subtly different under production inputs. Every step below exists to make behavior change loud.

1. Scope and risk-map. Define the do-not-break list: money paths, compliance-relevant calculations, external contracts. If you haven't inventoried the estate, start with an AI legacy system assessment to know what you own and what it touches.
2. Baseline behavior. Generate characterization tests for every module in scope; capture golden-master outputs for batch processes. No structural change begins before this suite exists and runs in CI.
3. Set batch rules. Cap PR size (a few hundred lines is a practical ceiling), one concern per change, human review mandatory. This is the control that keeps AI throughput reviewable.
4. Apply the technique. Comprehension, refactoring, translation, or upgrade — using the cheapest tool that works: deterministic codemod first, assistant second, agent for scale.
5. Gate in CI. Characterization suite, static analysis, and security scanning (AI-written code gets no exemption from SAST) must pass on every batch. Track rework rate and defect escape rate, not just velocity — DORA's stability metrics apply unchanged to agent-written code.
6. Roll out incrementally. Canary or shadow-run modernized components against the legacy path before cutover. Big-bang cutovers throw away the safety the previous five steps built; incremental delivery patterns are covered in modernizing without a big-bang rewrite.
7. Monitor and feed back. Watch error rates and output diffs post-release; feed anomalies back into the characterization suite so the safety net tightens over time.

Teams that follow this loop routinely see the McKinsey-range acceleration. Teams that skip steps 2 and 5 see fast demos and slow incident reviews.

What Results to Expect — and What to Ignore

The credible evidence base for AI legacy code work now includes McKinsey's 40–50 percent timeline acceleration, Google's ~50 percent migration-time savings, Morgan Stanley's 280,000 developer-hours saved on comprehension alone, and Amazon's order-of-magnitude compression of Java upgrades. Note what these share: every one pairs AI with a verification harness and human review. None of them is "the AI rewrote our system."

Treat vendor claims of near-total automation or guaranteed equivalence as marketing. And measure your own program the same way the credible results were measured: hours saved on specific task classes, defect escape rate on modernized modules, cycle time from pinned behavior to shipped change — not lines of code "modernized."

In our own delivery work at Snowman Labs — 400+ projects delivered, with agentic modernization engagements reaching a first production milestone in two weeks — the pattern holds: the teams that invest in the harness first get the acceleration; the teams that start with translation prompts get rework.

FAQ

Can AI rewrite legacy code automatically?

AI can translate and refactor legacy code, but not safely without supervision. Treat AI output as a draft that must pass characterization tests, human review, and differential validation against the original system before it ships. The published successes — Morgan Stanley, Google, Amazon — all kept humans and verification harnesses in the loop.

How does AI help with legacy code?

AI helps in five concrete ways: explaining what undocumented code does, generating characterization tests that pin current behavior, refactoring in small verified batches, translating code between languages, and automating dependency or framework upgrades. The largest gains come from comprehension and test generation, because those were the most labor-intensive steps before AI.

Can AI modernize COBOL and other mainframe code?

Yes, with the right structure. Models handle COBOL comprehension well, and translation works when each unit is validated against pinned behavior. Morgan Stanley's approach — translate COBOL into plain-English specs first, then reimplement in modern languages — has proven more reliable at scale than direct code-to-code conversion.

How do we modernize code that has no test coverage?

Generate characterization tests first. These record what the system currently does, giving you a safety net without requiring a spec. AI makes this economical: it reads the code, enumerates branches, and drafts the cases, while humans review them for meaningfulness. No refactoring or translation should start before this suite runs in CI.

Is AI-generated code safe for production in regulated industries?

It can be, if it goes through the same gates as human code — mandatory review, static and security analysis, provenance tracking, and a named human owner per change. Regulators audit outcomes and controls, not authorship. The risk isn't AI-written code per se; it's AI-written code exempted from the controls.

How long does legacy code modernization with AI take?

Scope-dependent, but the published evidence points to 40–50 percent compression versus manual timelines. Single-application efforts that ran 12–18 months manually commonly land in 6–9 with an AI-assisted workflow; narrow campaigns like framework upgrades compress far more. The setup investment — assessment, characterization tests, CI gates — typically takes the first several weeks and is what makes the later speed safe.

Which AI tools deliver the fastest wins on legacy code?

Start with comprehension (any frontier LLM over your codebase) and deterministic upgrade tooling like OpenRewrite — both produce value in days. Test-generation tooling comes next. Autonomous agents deliver the largest totals but require CI gates and review capacity first, so sequence them after the harness exists.

Conclusion: Fix the Code, Keep the Behavior

Legacy code modernization with AI works when you treat it as verified transformation, not generation: pin behavior with characterization tests, apply the cheapest technique that works, keep batches small, and gate everything in CI. The five techniques above are proven at enterprise scale; the failure modes are equally well documented and entirely avoidable.

If you're deciding where AI-assisted modernization would pay off first in your estate — and whether your pipeline can absorb agent-scale change safely — start with an AI readiness assessment. We'll map your codebase risk, test coverage, and tooling gaps against the workflow in this guide, or talk it through with our team via contact.