Laxmi Vanam, Advanced Analytics Lead.
Large organizations in regulated environments face the same problem: decades of business-critical logic buried inside systems that few current employees fully understand.
The challenge is especially acute in financial services and insurance, where reporting pipelines, client-servicing applications and regulatory data feeds may have evolved over decades. Successive generations of engineers modify these systems, embed new business rules and create dependencies across databases, applications and reports.
As experienced employees retire or move on, organizations lose the institutional knowledge required to explain how critical data is sourced, transformed, controlled and reported. In regulated industries, that loss can affect reporting accuracy, operational resilience and audit readiness.
The real bottleneck is not the age of the code. It is the inability to explain the logic embedded within it.
Why Modernization Begins With Understanding
Legacy modernization is often treated primarily as an engineering challenge. The assumption is simple: replace the platform, rewrite the code or migrate the data, and the problem will be resolved.
An organization cannot safely replace, migrate or retire a system unless it can answer several questions: What business rules are embedded within it? Which sources and transformations produce the final output? Which reports and applications depend on it? What controls are implemented in the code? What will be affected if a field, table or calculation changes?
Without these answers, modernization becomes an exercise in transferring poorly understood logic from one platform to another. The technology may change while the opacity remains.
Why Manual Code Analysis Does Not Scale
Organizations often address this challenge by assigning engineers and analysts to examine legacy code, reconstruct its logic and document it before modernization begins.
The work is necessary, but the traditional process is slow, expensive and difficult to scale. A single report may depend on thousands of lines of SQL, stored procedures, transformations and downstream dependencies.
Manual review also introduces inconsistency. Reviewers may interpret the same logic differently, assumptions may remain undocumented and the code may change before the analysis is complete.
In a regulated environment, an incomplete interpretation can become a reporting failure, operational risk or control gap.
Using Generative AI To Explain Existing Systems
This challenge led our team to develop a generative AI-enabled architecture designed to accelerate legacy-code comprehension, reconstruct data lineage and translate complex technical logic into accessible documentation.
As the architect of the approach, I focused on designing a framework that combines structural code analysis, AI-assisted semantic interpretation and human validation.
The objective was to help organizations understand the code and logic they already depend on.
The architecture is designed to identify technical structures and dependencies and convert them into documentation that engineering, governance, risk, audit and compliance teams can use together. Outputs can include source-to-report lineage, database and column dependencies, transformation logic, embedded business rules, downstream impacts and plain-language explanations.
Generative AI should not independently infer enterprise lineage without controls. A reliable approach should first extract verifiable technical evidence from the underlying code. AI can then interpret and communicate that evidence in language different stakeholders can understand.
The Difference Between Structural Accuracy And Semantic Accuracy
Structural accuracy asks whether the system correctly identified a database, table, column, join, dependency or transformation path. Semantic accuracy asks whether the explanation correctly represents the business purpose of that logic.
A system may correctly identify that one table feeds another while incorrectly explaining why the transformation occurs.
Organizations should, therefore, evaluate technical extraction and business interpretation separately. Deterministic analysis is better suited to identifying structural relationships. Generative AI is better suited to translating complex logic into readable explanations.
The strongest approach combines both. The technical structure should be extracted first, the generated explanation should remain grounded in that evidence and high-impact interpretations should be reviewed by qualified professionals.
From Static Documentation To Regenerable Knowledge
Many organizations still treat data lineage as a documentation exercise: conduct an assessment, produce a diagram and update it periodically.
Treating lineage as a continuously regenerable output changes the operating model. When code, data sources or dependencies change, the lineage and supporting documentation can be generated again.
This changes the economics of modernization. The question is no longer whether an organization can afford to document thousands of assets manually. The question becomes whether it can establish a governed process for continuously producing and reviewing that knowledge.
This does not replace experienced professionals. It allows them to spend less time reconstructing relationships and more time validating critical logic and making modernization decisions.
Why This Matters Across Regulated Industries
Although financial services provides one of the clearest examples, the challenge extends across regulated industries.
Insurance organizations rely on legacy logic for underwriting, claims, billing and statutory reporting. Healthcare organizations depend on interconnected systems for patient records, reimbursement and clinical reporting. Utilities and public agencies also operate long-lived systems supporting essential services and regulatory obligations.
The core challenge is the same. Organizations cannot confidently modernize systems when they cannot explain how critical data moves, which rules shape the output, where dependencies exist and what may break when change is introduced.
Three Lessons For Technology Leaders
First, do not treat lineage as a one-time project. Any solution that produces only a static artifact will become outdated.
Second, use AI to understand before using it to replace. Before rewriting a system, establish a reliable understanding of its existing logic, dependencies and business rules.
Third, make explainability a design requirement. Every AI-generated explanation should be traceable to supporting evidence and subject to human validation.
The Foundation For Responsible Modernization
The organizations that modernize successfully over the next decade may not simply be those with the newest infrastructure. They will be the organizations that first build a reliable and continuously updated understanding of what their existing systems actually do.
That work may be less visible than a cloud migration, but it makes modernization safer, faster and more defensible.
By combining deterministic technical analysis, generative AI-assisted interpretation and human validation, organizations can transform legacy code from an opaque dependency into accessible institutional knowledge. That knowledge is the foundation for stronger governance, safer modernization and more transparent enterprise decision-making.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?