The Auditability Gap

Executive Summary

AI assistants such as Claude, ChatGPT, Codex, and a growing family of agentic systems have transformed how individual developers and analysts work with legacy code. Explanations, business rules, documentation, and even modern re-implementations can now be produced in minutes rather than days. This democratization of code understanding is one of AI's genuine achievements.

However, an AI chatbot is an exceptional assistant for understanding code — it is not, by itself, an enterprise modernization platform. When modernization moves beyond a handful of programs into systems containing millions of lines of mission-critical code, three structural gaps emerge — each now supported by a growing body of published research and industry data.

Consistency. Every prompt is a decision, every analyst phrases questions differently, and models drift over time. Large-scale reproducibility experiments confirm that LLM output variability grows with task complexity and that newer models are not automatically more consistent ^[4]. Across thousands of programs, the result is not necessarily incorrect documentation — it is inconsistent documentation, and every downstream architecture, migration, and testing decision inherits that variance.

Governance. Enterprise-scale extraction requires standardized processes, uniform categorization, automated validation, and reproducible results. These properties do not emerge from ad hoc conversation; they are the product of orchestration and repeatable workflows.

Auditability. Every extracted business rule must be traceable to its source file, line numbers, calling hierarchy, and execution paths — and every generated artifact must trace back to the rules and code from which it was derived. Regulators now treat this lineage as an evidence requirement, not a best practice ^{[10], [11], [12]}. Without it, organizations are forced to trust AI output rather than verify it.

This paper — the first in BlueDrop's NextGen Modernization Series — argues that the future of modernization is certainly AI-driven, but success will belong to organizations that combine the intelligence of AI with the discipline of enterprise governance. The decisive question is no longer whether AI can understand legacy code. It is whether your modernization process can prove, verify, and audit everything the AI produces.

1. A Genuine Revolution at the Developer's Desk

The arrival of AI assistants has fundamentally changed the way developers approach legacy applications. Work that once required days of navigating unfamiliar COBOL, PL/I, Java, or C++ codebases can now be completed in minutes. A developer asks a question and receives an explanation. An analyst requests a business rule and gets a well-written summary. Documentation appears on demand, dependencies surface through dialogue, and modern code can be generated directly from legacy implementations.

For the individual practitioner, this is transformational. Instead of spending hours tracing a single variable through hundreds of procedures, a developer can hold an interactive conversation with the code itself. For business analysts, the effect is even more profound: logic that spent decades buried inside programs written before they were born is now accessible to people who have never written a line of COBOL. This democratization of code understanding is one of AI's genuine achievements, and nothing in this paper should be read as diminishing it.

But there is a critical distinction that organizations must recognize before betting a modernization program on it.

The difference becomes painfully clear the moment a modernization effort moves beyond a handful of programs and into systems containing millions of lines of mission-critical code.

2. The Scale Problem: One Chat Session at a Time

The trouble begins with a seemingly reasonable assumption: if a conversation with an AI can explain one program, then thousands of conversations can explain thousands of programs. Enterprise systems expose the flaw in that logic quickly.

A typical banking, insurance, healthcare, or government platform is not a collection of independent programs. It is a dense web of millions of lines of source code spanning multiple languages, thousands of interconnected programs, batch jobs and online transactions, shared copybooks and libraries, and decades of accumulated business rules — with regulatory calculations frequently spread across hundreds of distinct execution paths.

The scale of the installed base makes this more than a theoretical concern. Widely cited industry estimates place roughly 220 billion lines of COBOL in active production worldwide — much of it carrying business logic that was never formally documented — and credit COBOL with underpinning the large majority of ATM and card transactions processed every day ^[1]. The historical track record of attacking that scale without disciplined discovery is sobering. One industry analysis of 29 mainframe-to-cloud migrations conducted between 2020 and 2025 found that roughly two-thirds failed to meet their stated objectives ^[2], and broader industry benchmarking reports that failed modernization projects overrun budgets by roughly 2.5 times and timelines by 1.8 times — with incomplete business-logic mapping before work begins identified as the leading cause ^[3].

What works brilliantly for understanding a single program does not simply multiply. It degrades. These systems cannot be modernized one chat session at a time.

3. Consistency: The Hidden Challenge

The first casualty of the chat-driven approach is consistency, and it fails in a way that is easy to miss because nothing is obviously wrong.

Every prompt is a decision. Every developer phrases questions differently. Every analyst asks for a different level of detail. Different AI models produce different explanations of the same code, and even the same model may generate subtly different outputs over time. Multiply those variations across hundreds of developers, thousands of programs, multiple teams, and months of analysis, and the result is not necessarily incorrect documentation — it is inconsistent documentation.

Inconsistency is not a cosmetic problem. Architecture decisions are made on top of these artifacts. Migration scope is estimated from them. Test cases are derived from them. When the underlying documentation varies in structure, depth, and terminology from one program to the next, every downstream activity inherits that variance, and the modernization initiative pays for it in quality, schedule, and rework.

4. Enterprise Scale Demands Governance, Not Just Intelligence

Large-scale modernization requires far more than well-written AI summaries. It requires a standardized extraction process in which every program is analyzed the same way, business rules are categorized against a consistent taxonomy, data relationships are extracted uniformly, cross-program calculations are identified reliably, dependencies are preserved, outputs are validated automatically, and results remain reproducible over time.

None of these properties emerges naturally from ad hoc conversation. They are the product of orchestration, verification, and repeatable workflows — in short, governance. Conversational AI is a component of that machinery, not a substitute for it.

5. Auditability: The Largest Missing Piece

Perhaps the most consequential gap is also the one that receives the least attention: how do you audit AI-generated modernization artifacts?

Imagine a team of analysts has spent six months using chatbots to extract requirements from a core banking system. The moment anyone — an architect, a tester, a regulator — asks how a particular requirement came to exist, a cascade of uncomfortable questions follows. Which prompt generated it? Which version of which model was used? Which source files were actually analyzed? Were all execution paths considered, or only the obvious ones? Was any business logic silently omitted? Did the AI infer behavior that never existed in the original system? Can another analyst reproduce the same result? Can an auditor independently verify it?

These are not hypothetical risks. The vendors building AI transformation tools acknowledge them openly: IBM Research's published work on its own COBOL-to-Java assistant states that LLM-generated translations cannot be trusted without validation, and that manual verification remains a necessary, labor-intensive step ^[6]. Its companion evaluation research goes further, noting that LLMs are effectively black boxes, that proving equivalence between two programs is formally undecidable, and that its quality checkers are explicitly designed to detect hallucinated elements — code in the output with no corresponding element in the original source ^[7]. The broader research record reinforces the point: a joint university study spanning sixteen code-generation models and 576,000 samples found that nearly one in five software packages recommended by the models did not exist at all ^[8], and engineering benchmarks report that automated legacy-code conversion output typically requires 40 to 60 percent manual remediation before it is production-ready ^[9].

If the honest answer to the audit questions above is "we don't know," the organization does not have a documentation asset. It has a governance problem.

6. Every Requirement Needs a Lineage

Enterprise modernization should produce more than documentation. It should produce evidence.

Every extracted business rule should be traceable back to the original source file, the exact line numbers, the calling hierarchy, the related copybooks, the database fields it touches, the execution paths that reach it, and the decision logic and calculations it embodies. And the traceability must run in both directions: every generated component or migrated implementation should trace back to the business rules and source code from which it was derived.

This lineage creates an auditable chain of evidence — one that allows architects, testers, business owners, and auditors to understand precisely how every modernization artifact came into being. Without it, organizations are left with only one option: trusting the output rather than verifying it.

7. This Is Not Only a Regulated-Industry Concern

Financial institutions, insurers, healthcare providers, and government agencies clearly operate under strict regulatory obligations, and for them the case for auditability is self-evident. But the need does not stop at the boundary of regulation.

In fact, the regulatory floor is rising for everyone. Three frameworks now define audit-trail expectations for AI-assisted work: the EU AI Act, which is legally binding for high-risk systems and mandates record-keeping and traceability ^[10]; the NIST AI Risk Management Framework, which U.S. federal agencies and enterprise buyers increasingly treat as a practical baseline ^[11]; and ISO/IEC 42001, which is emerging as a procurement requirement for AI vendors ^[12]. A common thread runs through all three: logs, lineage, and documentation are treated as evidence that must be producible on demand — not as optional best practice. The pressure is already reshaping modernization programs: in a 2025 global survey of 500 senior IT and business leaders, 94 percent said regulation strongly influences their mainframe modernization strategy ^[13].

Beyond regulation, any organization migrating mission-critical software will eventually face the same questions. Did we preserve all business logic? Can we explain why a calculation changed? Can we identify the original implementation? Can we reproduce the migration if it is challenged? Can we prove the AI did not introduce assumptions the business never made?

Failing to answer these questions has a price: expensive rework, delayed implementations, failed compliance reviews, operational risk, and — hardest to recover — the erosion of stakeholder confidence. The cost is measured not only in money, but in time and trust.

8. Intelligence Plus Discipline

Conversational AI has permanently improved how humans interact with legacy systems. It lets developers understand unfamiliar code faster than ever before and gives analysts access to business logic that was previously locked away in decades-old applications. These are remarkable advances, and they belong in every modernization program.

But the evidence of the past two years shows what happens when organizations mistake a powerful tool for a complete method. MIT's widely discussed study of enterprise generative AI — based on 150 leadership interviews, a survey of 350 employees, and 300 public deployments — found that only about five percent of pilots achieved measurable business value, while the vast majority stalled ^[14]. Gartner has similarly projected that a large share of generative AI projects are abandoned after proof of concept ^[15]. Crucially, the MIT researchers traced the failures not to model quality but to how AI was put to work: the failing majority relied on generic tools that impress in demos but break inside real workflows, while the successful few embedded AI deeply into governed, high-value processes ^[14]. Modernization done that way pays: the same 2025 industry survey that documented regulatory pressure also reported returns of roughly 290 to 360 percent on well-scoped mainframe modernization programs ^[13].

Enterprise modernization requires capabilities that no conversation can provide. It requires repeatability, so results do not depend on who asked the question. It requires governance, so thousands of programs are analyzed to one standard rather than a thousand personal ones. It requires verification, so outputs are checked rather than assumed. And above all, it requires complete auditability — a traceable lineage connecting every generated artifact back to the original source.

The future of modernization will certainly be AI-driven. But success will belong to the organizations that combine the intelligence of AI with the discipline of enterprise governance.

The real question is no longer whether AI can understand your legacy code.

References

1. Reuters, widely cited industry estimates (via secondary reporting): approximately 220 billion lines of COBOL in active production and COBOL's role in the large majority of ATM/card transactions. Figures are estimates and should be treated as indicative of scale.
2. Modernization Intel (2025). Analysis of 29 mainframe-to-cloud migration projects, 2020–2025. Vendor-conducted study; sample size and methodology as disclosed by the publisher.
3. Industry benchmarking compiled from Capers Jones Software Benchmarks (2022–2023) and related modernization cost analyses: budget and timeline overruns in failed modernization projects; undocumented business logic as the primary failure cause.
4. Wang, J. J., and Wang, V. X. (2025). Assessing Consistency and Reproducibility in the Outputs of Large Language Models: Evidence Across Diverse Finance and Accounting Tasks. arXiv:2503.16974.
5. An Empirical Study of LLM-Based Code Clone Detection (2025). arXiv:2511.01176. On output consistency and reproducibility as prerequisites for practical LLM-based code analysis.
6. IBM Research (2025). Automated Testing of COBOL to Java Transformation. arXiv:2504.10548. Testing framework experience for IBM watsonx Code Assistant for Z.
7. IBM Research (2025). Quality Evaluation of COBOL to Java Code Transformation. arXiv:2507.23356. On black-box evaluation, undecidability of program equivalence, and detection of hallucinated code elements.
8. University of Texas at San Antonio, Virginia Tech, and University of Oklahoma (2024). Joint study of package hallucination across 16 code-generation LLMs and 576,000 generated samples.
9. IEEE Software / Software Engineering Institute, Carnegie Mellon University (2022). Benchmarks on manual remediation required for automated COBOL conversion output.
10. Regulation (EU) 2024/1689 (EU Artificial Intelligence Act). Record-keeping, technical documentation, and traceability obligations for high-risk AI systems.
11. National Institute of Standards and Technology (2023). AI Risk Management Framework (AI RMF 1.0). Govern, Map, Measure, and Manage functions; documentation and audit-trail expectations.
12. ISO/IEC 42001:2023. Artificial intelligence — Management system. Auditable management-system requirements for organizations developing or using AI.
13. Kyndryl (2025). State of Mainframe Modernization Survey Report. Global survey of 500 senior IT and business leaders; regulatory influence and modernization ROI findings.
14. MIT NANDA Initiative (2025). The GenAI Divide: State of AI in Business 2025. As reported by Fortune, August 2025. 150 leadership interviews, 350-employee survey, 300 public deployments analyzed.
15. Gartner (2024–2026). Projections on abandonment of generative AI projects following proof of concept.

© 2026 BlueDrop. All rights reserved. Third-party statistics are cited for commentary and remain the property of their respective publishers.