Modernizing High‑Risk Legacy Software with AI in a Controlled Way

This is particularly true in social security, where core systems often embody decades of legislation, policy changes, and highly specialized business rules. The system we modernized determines social security contributions, which directly influence citizens’ rights and entitlements, including pension outcomes. Application modernization in such an environment is therefore not just a technology challenge; it is a matter of risk management, accountability, and trust.

One particularly dark corner of the system was a highly specialized but outdated rule engine that contained decades of accumulated business knowledge.
The challenge we faced was modernizing without losing control over correctness.

A Domain Defined by Time

What makes the social security domain particularly complex is legislation accumulated over time.

When someone retires, the system may need to recalculate contributions going back more than 45 years. Not using today’s legislation but the legislation that was in force at the time. Each period comes with its own legal framework, thresholds, and exceptions. If even one edge case is missed, the result can be incorrect.

Why the Obvious Path Was Excluded

At first glance, the most obvious modernization path would be replacing the outdated rule engine and moving on. But that was not the path we chose.

The reason was straightforward: we wanted to be able to verify and understand the resulting behavior. The technology was aging, but the real challenge was the knowledge hidden inside it.

This was also a governance and compliance concern: in regulated domains, accountability requires that system behavior can be explained, verified, and defended. This aligns with emerging regulatory expectations around AI transparency and human oversight.

Starting from Control, Not Speed

We started with a simple question:

What evidence would convince us that this system behaves correctly across decades of changing legislation at a realistic scale?

Together with testers and subject‑matter experts, we defined a clear go / no‑go strategy based on a small number of clear principles:

• Transparent and precise side-by-side comparison using real historical data,
• execution at large scale, so rare cases cannot be overlooked,
• coverage of legally relevant years across multiple decades.

Modernization would move forward only if all of those conditions were met.

Using AI Within Clear Boundaries

AI played an important role in this process, but always within boundaries defined by people.

It helped us identify patterns in decades of business logic, determine which years were legally relevant, accelerate implementation work under strict constraints, and analyze large volumes of comparison results.

Humans remained responsible for deciding what had to be compared, what was acceptable behavior, and when evidence was sufficient.

Whenever AI started optimizing for technical metrics rather than real‑world outcomes, additional guardrails were introduced. These guardrails applied to code, business invariants, but also to tests, ensuring that unrealistic or incomplete scenarios were rejected automatically.

From Correctness to Long‑Term Maintainability

Our first goal was not maintainability. It was confidence. We first needed to prove that the behavior could be understood, validated, and reproduced reliably.

Once we were confident we could do that, the focus shifted to maintainability.

Using the verified behavior as a reference, the development team refactored the system into clear, maintainable code, continuously verifying that the behavior did not change.

The logic was also expressed in business‑readable automated scenario tests, allowing subject matter experts to read and validate cases directly. This step made decades of accumulated logic explicit and shareable. It also established a living safety net that keeps the system maintainable and future-proof.

The Result and Where This Leaves the Organization

Testing under production‑level load shows that the maintainable system behaves in line with the original implementation. Additionally, the modern Java implementation processes a full batch of approximately 1,500,000 records roughly four times faster than the legacy system under comparable conditions.

Most importantly, the organization now benefits from:

• A secure and supported platform that reduces operational risk,
• Transparent logic that engineers can maintain and domain experts can validate,
• A governance framework that enables future change without losing control.

This creates a foundation for sustainable evolution rather than one-time modernization.

The Takeaway

This is not a story about replacing people with AI.

It is a story about using AI to make hidden knowledge visible, while keeping responsibility and accountability explicit. In high-risk environments, the challenge is not moving faster. It is understanding and verifying enough to change safely.

That is where AI creates real value - when it’s managed correctly.