TL;DR: AI can accelerate COBOL understanding, translation, and test generation, but Sonar argues that the real bottleneck is verifying whether output preserves business logic and control integrity across load-bearing systems. The practical shift is toward deterministic code analysis that treats human-written and AI-generated COBOL with the same gate.
At a glance
What this is: Sonar argues that AI can speed COBOL modernisation, but only verification can tell whether translated code still behaves correctly in critical production systems.
Why it matters: This matters because teams modernising legacy COBOL need a control that catches subtle logic drift, not just a faster way to generate code, especially when expert reviewers are disappearing.
By the numbers:
- roughly 220 billion lines of code still run in production, according to Reuters reporting cited by Sonar.
Context
COBOL modernisation is not a language nostalgia story. It is a control problem created by retirement-driven expertise loss, high-stakes legacy systems, and the arrival of AI systems that can translate code faster than humans can validate it.
The governance gap is verification depth, not generation speed. In environments where payroll, settlement, and public benefits depend on correct logic, AI increases throughput but also widens the distance between code production and trustworthy review.
Key questions
Q: How should teams govern AI-generated COBOL before it reaches production?
A: Treat AI-generated COBOL as draft material until it clears the same deterministic checks as human-written code. The key control is not whether the model can produce a plausible translation, but whether the result preserves business rules, branch handling, and embedded logic under repeatable analysis before release.
Q: Why does AI-assisted modernisation create verification risk in legacy systems?
A: Because AI can generate code faster than expert reviewers can validate it, especially when the original maintainers are retiring. That creates a verification gap in which subtle logic changes can survive review and reach systems that cannot tolerate incorrect behaviour.
Q: What breaks when expert COBOL reviewers are no longer available?
A: The safety net breaks first. Modernisation teams may still be able to produce translations, but they lose the domain knowledge needed to confirm whether the generated code still implements the original business intent, which increases the chance of costly regression in production.
Q: What is the difference between code generation and code verification in AI pipelines?
A: Code generation produces a plausible implementation, while code verification determines whether that implementation is trustworthy enough to merge and ship. In AI pipelines, the distinction matters because the tool that writes code is not the same control that proves the code is safe, maintainable, and ready for production.
Technical breakdown
Why AI-assisted COBOL translation creates verification debt
AI can summarise, translate, and refactor COBOL faster than a human team can manually inspect every change, but it does not understand business context in the way a domain expert does. That creates verification debt: more candidate code is produced than the review function can safely absorb. In legacy systems, small omissions such as unhandled branches, altered condition logic, or mismatched embedded SQL can change outcomes without obvious failure. The issue is not that AI is always wrong, but that it is plausible enough to pass a rushed review. The control point therefore moves from generation to deterministic validation.
Practical implication: Treat AI output as untrusted draft code until it clears the same analysis gates as any other change.
Deterministic analysis is the control layer for legacy code
Deterministic static analysis does not depend on a model guessing whether code is acceptable. It evaluates source against fixed rules, so the same defect is flagged every time, regardless of who wrote the code. That matters in COBOL because the code often contains embedded DB2 SQL, CICS logic, and long-lived business rules that are easy to break during translation. A consistent gate also scales better than expert-only review when the available reviewer pool is shrinking. The architectural point is simple: AI can accelerate transformation, but only a non-AI verifier can enforce repeatable standards across thousands of files.
Practical implication: Place static analysis and quality gates in the same pipeline stage for human-written and AI-generated COBOL.
Why legacy business logic needs human intent plus automated checking
COBOL systems often encode operational rules that were never fully documented because they lived in the heads of the original maintainers. AI is useful at surfacing and explaining that intent, but explanation is not assurance. A translated program can still preserve the wrong branch logic, omit an edge case, or reproduce an insecure pattern from the source. The safer pattern is to use AI for comprehension and drafting, then use automated analysis to catch the mismatches that neither the model nor an overworked reviewer will reliably spot. In modernization work, the review function becomes the real system of record.
Practical implication: Pair AI-assisted comprehension with automated rule checking before any translated code reaches a release gate.
NHI Mgmt Group analysis
Verification debt is the real risk introduced by AI in COBOL modernisation. The article is correctly framed around a review bottleneck, not a generation bottleneck, because AI increases the amount of code that must be trusted faster than the human expertise base can absorb it. In governance terms, this is a control capacity problem: the organisation can produce transformation output faster than it can establish confidence in that output. The practitioner conclusion is that verification design now matters as much as modernization intent.
Legacy code modernisation now depends on preserving control integrity, not just syntax fidelity. COBOL is high-stakes because the code is load bearing for payroll, settlement, public benefits, and other core processes. AI that produces code which looks correct but changes edge-case behaviour creates operational risk that traditional review practices will miss if they assume semantic fidelity. The practitioner conclusion is to treat behavioural equivalence as the standard, not just compilability.
Independent analysis layers are becoming the governance answer for AI-assisted software change. When reviewer expertise is scarce, organisations need a deterministic gate that does not rely on the same system that generated the code. That is the broader lesson here for agentic and AI-assisted development: generation and assurance must be separated. The practitioner conclusion is to make verification non-optional in any production path touched by AI.
Verification-first development is the right named concept for this transition. The article shows why modernisation programmes should stop treating AI as a replacement for review and start treating it as a source of higher-volume change requiring stricter checking. This is especially relevant wherever AI is applied to long-lived systems with hidden business logic. The practitioner conclusion is to build the modernisation programme around verification-first development, not model-first delivery.
From our research library:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
- Read next: AI Coding Agents Security Guide
What this signals
Verification-first development is becoming the practical control model for AI-assisted legacy modernisation. Organisations that still treat AI output as a productivity feature rather than a risk surface will discover that review capacity, not model capability, is the binding constraint. The safer programme design is to force every translated change through the same deterministic gate before it can influence production behaviour.
Control integrity is the metric that matters in load-bearing systems. If AI changes a payroll rule, a settlement branch, or a public-benefits workflow, the issue is not code style but whether the organisation can prove behavioural equivalence under release pressure. That makes automated analysis and human approval complementary, not interchangeable.
Legacy modernisation now depends on managing the verification gap. The wider the gap between code production and trustworthy review, the more likely subtle defects are to escape into business-critical systems. For practitioners, the immediate signal is simple: if AI speeds up delivery but verification does not scale with it, the programme is not modernising safely.
For practitioners
- Implement deterministic quality gates for AI-generated COBOL Run translated or refactored COBOL through the same static analysis and policy checks used for human-written code before merge or release.
- Prioritise behavioural equivalence checks over syntax review Validate branch handling, embedded SQL, and edge-case logic so the translated program preserves the original outcome, not just the same structure.
- Separate AI drafting from final approval Use AI for comprehension and first-pass translation, but require a reviewer or control layer that is independent of the generation step.
- Harden review coverage on load-bearing systems Apply stricter gates to payroll, settlement, benefits, and other systems where a subtle logic error creates outsized business impact.
Key takeaways
- AI speeds COBOL transformation work, but it also increases the amount of code that must be trusted faster than human reviewers can validate it.
- The main risk is not syntax failure. It is subtle behaviour change in systems where payroll, settlement, and public services depend on exact logic.
- A deterministic verification layer is the control that keeps AI-assisted modernisation from turning into production surprises.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0007 — Discovery | Legacy code review failure stems from insufficient visibility into hidden business logic. |
| Recommendation — Map modernization review gaps to discovery weaknesses and inspect translated code paths with deterministic analysis. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article concerns preserving correct control behaviour in critical production systems. |
| Recommendation — Apply control gates that ensure AI-generated changes cannot bypass approval and verification requirements. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | Automated verification of code before release is central to secure software change management. |
| Recommendation — Embed static analysis and release gating into application security workflows for all translated code. | ||
Key terms
- Verification debt: The accumulated gap between the identities an organisation manages and the confidence it can still have in validating them at the moment of access. It grows when verification, entitlement review, and offboarding do not keep pace with identity sprawl.
- Deterministic program analysis: Deterministic program analysis is code analysis that identifies relevant paths, sinks, and candidate locations through exact rules rather than probabilistic guessing. In a mixed AI workflow, it acts as the coverage engine, feeding the model the code slices it should reason about instead of asking the model to search the whole repository.
- Behavioral Equivalence: Behavioral equivalence means two systems produce the same outcomes under the same inputs and conditions, even if their code looks different. In AI-assisted porting, this is the real test of correctness because surface similarity does not guarantee identical runtime behaviour or failure modes.
- Control Integrity: The assurance that logging, endpoint protection, trust anchors, and enforcement points are functioning as intended. In practice, this means defenders must verify that security tools are not only deployed, but also healthy, connected, and resistant to tampering.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and workload identity concepts that help security teams reason about machine-driven control paths. It is suitable for practitioners who need a stronger governance lens across identity and automation programmes.
Published by the NHIMG editorial team on August 18, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org