In summary
- Explores six key risks organisations must manage when using AI to accelerate legacy modernisation, from inaccurate recommendations to security and governance challenges.
- Explains why human oversight remains essential, with AI supporting decision-making rather than replacing accountability and expertise.
- Highlights the importance of robust governance, including transparency, risk-based controls, continuous monitoring and clear ownership of decisions.
- Shows how organisations can balance AI-driven speed and efficiency with trust, security, compliance and long-term sustainability.
AI is creating exciting new opportunities to transform how organisations manage legacy technology estates. Yet the real differentiator may not be how quickly organisations adopt AI, but how effectively they govern it.
In our previous articles we explored both the challenge of technical debt and the opportunity AI presents. The next step is understanding how to manage the risks that come with these powerful new capabilities.
While AI has the potential to dramatically accelerate legacy modernisation, organisations should be careful not to view it as a silver bullet. As with any transformative technology, the greatest value comes when opportunities and risks are managed together.
In many ways, AI introduces a new category of technical debt risk. If implemented without appropriate controls, organisations may solve one challenge while creating another.
A successful AI-enabled modernisation strategy therefore requires leaders to consider not only how AI can accelerate delivery but also how it can be governed safely, ethically and effectively.
Risk 1: AI recommendations may be wrong
One of AI's greatest strengths is its ability to analyse vast amounts of information and identify patterns that humans may struggle to detect. However, AI generated recommendations are only as reliable as the data, context and algorithms behind them.
In a legacy estate comprising of thousands of applications, source information is often incomplete, inconsistent or outdated. Documentation may be missing. Ownership records may be inaccurate. Dependencies may not be fully understood.
As a result, AI can occasionally:
- Misidentify application dependencies.
- Underestimate migration complexity.
- Recommend inappropriate modernisation pathways.
- Produce inaccurate assessments of business criticality.
- Generate misleading conclusions based on incomplete data.
For example, an AI model may conclude that an application can be decommissioned because usage appears low, while failing to recognise that it supports a critical regulatory process used only periodically.
The solution is not to avoid AI but to ensure human oversight remains central. AI should augment expert decision making rather than replace it. Critical investment, architecture and risk decisions should always be validated through business, technical and operational review.
Risk 2: Hidden bias can distort priorities
AI systems learn from historical data. If historical decisions, operational processes or governance structures contain bias, AI can inadvertently reinforce them.
Within technology modernisation programmes, this can affect:
Application prioritisation.
- Resource allocation.
- Investment decisions.
- Risk assessments.
- Business case development.
For example, if previous investment decisions disproportionately favoured certain business areas, an AI model trained on historical data may recommend continuing this pattern even when organisational priorities have changed.
Managing this risk requires organisations to establish clear governance around training data, model validation and decision making criteria. Regular reviews should ensure recommendations align with current strategic objectives rather than simply replicating historical behaviour.
Risk 3: Loss of accountability
A common challenge in large organisations is what some governance experts describe as "automation bias" - the tendency for people to place excessive trust in automated outputs.
As AI systems become increasingly sophisticated, there is a risk that programme teams begin accepting recommendations without sufficient scrutiny. This can create ambiguity around accountability:
- Who approved a particular migration decision?
- Who accepted a risk assessment?
- Who is responsible if an AI generated recommendation proves incorrect?
- Strong governance frameworks make accountability explicit.
Every significant decision should have a named owner. Decision records should capture where AI has been used to inform recommendations and how human reviewers challenged or validated those outputs.
The objective is not simply transparency, but auditability and trust.
Risk 4: Security and data privacy concerns
Modernisation programmes often require access to some of an organisation's most sensitive information, including source code repositories, system architecture documentation, configuration data, operational processes, and potentially sensitive business or citizen data.
When AI tools are introduced into this environment, concerns naturally arise regarding data leakage, intellectual property exposure, unauthorised model training, regulatory compliance, and sovereignty and hosting requirements.
This is particularly important within government and regulated sectors where security obligations are significant.
Organisations can mitigate these risks by:
- Establishing clear AI usage policies.
- Using approved enterprise AI platforms.
- Defining strict data classification controls.
- Restricting access to sensitive information.
- Monitoring and auditing AI interactions.
Ensuring compliance with relevant security and regulatory requirements.
Security-by-design principles should apply to AI adoption in exactly the same way they apply to cloud or application modernisation initiatives.
Risk 5: Technical complexity and 'AI sprawl'
Ironically, AI can also contribute to the complexity it is intended to reduce.
Without clear governance, organisations may introduce multiple AI tools across different teams. Over time this can create:
- Duplicate capabilities.
- Inconsistent standards.
- Fragmented data sources.
- Increased licensing costs.
- New operational dependencies.
The result can be an emerging form of "AI sprawl" that mirrors the legacy estates organisations are already trying to simplify.
Leading organisations avoid this by establishing an enterprise-wide AI strategy, common tooling standards and clear architectural principles from the outset.
AI should become part of the target operating model, not another layer of uncontrolled complexity.
Risk 6: Overestimating AI capability
Perhaps the greatest risk is believing that AI can modernise an estate independently.
Legacy transformation remains as much a people and business challenge as a technical one. Successful programmes require stakeholder engagement, change management, funding decisions, governance approvals and strategic prioritisation.
AI can significantly accelerate analysis and delivery. It cannot replace leadership, organisational alignment or business ownership.
The organisations most likely to succeed will therefore focus on using AI to enhance existing capabilities rather than attempting to automate transformation wholesale.
Establishing the right governance model
The most effective organisations are increasingly adopting a governance model built around four principles:
1. Human-in-the-Loop decision making
AI supports analysis and recommendations, while humans retain accountability for decisions, approvals and risk acceptance.
2. Transparency and explainability
Teams should understand how recommendations were generated, what data was used and what assumptions underpin the outputs.
3. Risk-based controls
The greater the potential business impact of an AI assisted decision, the greater the level of governance, validation and independent assurance required.
4. Continuous monitoring
AI performance should be monitored on an ongoing basis, with controls in place to identify drift, inaccuracies, emerging risks and realised benefits.
Moving from AI adoption to AI assurance
As organisations explore the use of agentic AI within legacy modernisation, the conversation is rapidly evolving. The question is no longer simply, "How can AI help us move faster?"
A more important question is emerging:
"How do we move faster while maintaining trust, security and accountability?"
The answer lies in combining AI capability with robust governance.
Technology expertise provides the understanding of the estate. AI provides scale, speed and analytical power. Governance provides confidence that modernisation activities remain secure, compliant and aligned to organisational objectives.
When these three elements work together, AI becomes more than a productivity tool. It becomes a strategic enabler, helping organisations reduce technical debt faster, make better investment decisions and accelerate transformation whilst maintaining the controls necessary to manage risk.
In this model, success is not measured by how much AI is deployed. It is measured by how effectively AI helps deliver modernisation outcomes that are faster, safer and more sustainable.