Every bank and insurer is running the same arithmetic. Customer expectations move in weeks. Regulatory change arrives on its own schedule. The core systems that process the money were written decades ago in COBOL, and they are stable, secure, and almost impossible to change quickly.
The instinct is to treat this as an engineering backlog. It is not. It is a capital allocation problem. According to Accenture’s Banking Trends 2026, roughly 70 percent of banking IT spend goes to maintaining existing systems, and banking technology costs have grown about four times faster than revenue over the past fifteen years. Every dollar locked into maintenance is a dollar unavailable for the products that win customers.
AI-assisted engineering is the first modernization approach that attacks the maintenance ratio directly rather than adding another multi-year replacement program on top of it. It spans the software lifecycle, from test generation and code remediation to legacy translation and automated documentation. The value is not raw speed. It is that intelligence, evidence, and traceability move into the delivery pipeline itself, which is exactly what a regulated institution needs before it modernizes anything.
As Forbes contributor David Parker put it, AI-assisted engineering is poised to shift from pilot programs to production reality across financial institutions in the next twelve months. The institutions that make that shift deliberately, with governance designed in, will separate themselves from those that adopt the tools and inherit the risk.
Financial institutions are not short of modernization ambition. They are short of capacity. Roughly 70 percent of banking IT spend is consumed maintaining systems that already exist, and the engineers who understand those systems are retiring faster than they can be replaced.
AI-assisted engineering changes the economics by pairing specialized agents with human engineers across four workloads: legacy code modernization, test generation, remediation, and documentation. Institutions modernize one domain at a time, without halting operations, and every change carries its own audit trail.
The evidence is genuinely mixed on individual productivity, and leaders should treat it that way. What is not in dispute is the governance opportunity. When AI-generated change flows through a secure pipeline, traceability and evidence stop being manual work and start being a by-product of delivery. That is the leadership decision for 2026.
By the numbers
70%
of banking IT spend goes to maintaining existing systems, with technology costs growing roughly four times faster than revenue over fifteen years
– Accenture Banking Trends, 2026
800B+
lines of COBOL are in production and daily use worldwide, with 92 percent of respondents calling COBOL applications strategically important
– Micro Focus / Vanson Bourne, 2022
90%
of software professionals now use AI at work, a median of two hours per day, and more than 80 percent report productivity gains
– DORA, 2025
30%
of those same professionals report little or no trust in AI-generated code
– DORA, 2025
66%
of developers cite AI output that is almost right, but not quite, as their single biggest frustration
– Stack Overflow Developer Survey, 2025
19%
longer task completion for experienced developers using early-2025 AI tools, even though they believed they were 20 percent faster
– METR, 2025
Why the Legacy Cost Curve Now Outweighs the Legacy Risk
For twenty years, the argument for leaving core banking systems alone was risk. The systems worked. Replacing them did not. That argument is losing to a simpler one: the cost of standing still now compounds faster than the risk of moving.
Four pressures are converging, and each one is measurable on a balance sheet.
The 2026 Pressure to Ship Faster, Safer Applications
Customers expect real-time services, instant payments, live updates, and seamless digital onboarding. Regulatory changes arrive faster than release cycles can absorb them. Even small changes trigger extensive review. The result is a business bottleneck: institutions must ship smarter, safer applications without rewriting the estate underneath them.
The Weight of the Legacy Estate
Most major banks still run on COBOL mainframes that are stable but resistant to integration and slow to enhance. Small improvements demand deep system knowledge and weeks of testing. The scale is not marginal: an independent survey conducted by Vanson Bourne found more than 800 billion lines of COBOL in production and daily use, with 92 percent of respondents describing their COBOL applications as strategically important.
The Talent Gap
Engineers who understand these systems are retiring. New talent prefers modern stacks and agile environments. The institutional result is shrinking internal expertise and rising dependency on expensive contractors who hold knowledge that was never written down.
The Cost of Maintenance and Compliance
Independent analysis by the Software Improvement Group reaches the same conclusion from the code quality side: maintaining old systems now consumes up to 70 percent of IT budgets, leaving little room for innovation. Compliance changes, still largely manual and repetitive, add cost on top of that.
Testing and Documentation Bottlenecks
Manual testing and outdated documentation make release cycles fragile. Every update introduces uncertainty, with limited visibility into coverage or traceability. In a regulated industry, that is not an engineering inconvenience. It is an audit exposure.
How AI-Assisted Engineering Closes the Legacy Gap
AI-assisted engineering does not replace developers. It pairs with them to make modernization incremental and safe. Instead of a full rewrite, AI acts as an intelligent translator: reading legacy code, inferring intent, and converting it piece by piece into modern, modular components while documenting the transformation as it goes.
AI-Assisted Modernization in Practice
A purpose-built Code Modernization Agent performs five distinct jobs, and only one of them is translation.
- Code understanding. Abstract syntax tree and control-flow analysis extract business logic, data models, and dependencies, then map which modules can safely decouple without breaking system integrity.
- Automated translation. Hybrid rule-based parsing handles syntax accuracy while contextual AI reasoning handles logic, generating clean modern equivalents rather than transliterated legacy.
- Refactoring and optimization. Redundant logic, obsolete libraries, and tight coupling are identified and restructured into service-based or event-driven components.
- Validation and testing. Automated regression and parity tests confirm the new code behaves identically to the legacy system, only faster, lighter, and easier to maintain.
- Documentation and traceability. Transformation logs, API mappings, and data lineage are captured automatically, producing an audit-ready modernization trail.
The operating result is what matters to a board: institutions modernize one domain or service at a time, without halting business operations, and with evidence generated at every step.
Aligning Automation with Regulatory and Security Expectations
AI-assisted tools built into secure DevSecOps pipelines make every change safer and more accountable rather than less. Every line of AI-generated code is traced, tested, and logged. Documentation updates itself, security scans run continuously, and audit trails accumulate as a by-product of delivery. Institutions stay aligned with evolving regulation while cutting the time and cost required to prove it.
The strongest argument for AI-assisted engineering in a regulated institution is not velocity. It is evidence.
Manual modernization produces working software and a separate, expensive effort to document what changed and why. AI-assisted modernization produces both at once, because lineage and transformation logs are outputs of the pipeline rather than artefacts assembled afterward.
ML arteka builds these capabilities so that traceability is designed into the delivery system, not reconstructed for the next examination.
The Business and Operational Benefits
Systems become faster, stronger, and better understood. Institutions ship updates in weeks instead of months, reduce the cost of carrying legacy, and catch more defects before production. Multi-year modernization programs turn into continuous improvement cycles. Organizations move quicker and save more without breaking what already works.
Where the Change Is Already Happening: Testing and Documentation
The clearest early returns are not in the core. They are in the two disciplines that quietly govern release confidence.
Instead of engineers spending hours writing and updating tests, AI acts as a persistent QA partner. It reads code and requirements and builds the appropriate tests: unit, integration, regression, and others. As applications evolve, it keeps those tests alive by adjusting locators, repairing scripts, and regenerating what breaks.
In parallel, a Documentation Agent stops institutional knowledge from evaporating. It monitors the codebase continuously, capturing architecture changes, new endpoints, dependencies, and logic updates, and converts them into clear, versioned documentation. The effect is a real-time system historian, ending the familiar cycle of outdated specifications and missing diagrams.
Releases stop being last-minute scrambles. Teams test faster, change confidently, and onboard new engineers without losing weeks to chasing context. Testing and documentation become part of the delivery rhythm rather than the thing that delays it.
What an AI-Assisted Engineering Capability Actually Contains
AI-assisted engineering functions as a delivery co-pilot, automating the repetitive and risky parts of software delivery so engineers concentrate on building and shipping. It spans the whole lifecycle, from testing and remediation to modernization and documentation, with a consistency that human-only teams struggle to sustain.
Four specialized agents carry the load.
| Agent | What it delivers |
|---|---|
| Code Modernization Agent | Translates legacy COBOL or monolithic code into modern architectures, validates the transformation, and builds living documentation |
| Test Generation Agent | Analyzes new code or requirements, creates test cases automatically, and self-heals tests as applications evolve |
| Remediation Agent | Scans repositories for performance issues, security risks, and outdated dependencies, then recommends or applies safe fixes |
| Documentation Agent | Continuously generates current system documentation, diagrams, and knowledge graphs from the live codebase |
Together these form a connected intelligence layer that accelerates delivery while holding security and control in place. The portfolio matters more than any single agent, because the governance benefit comes from covering the whole lifecycle rather than one step of it.
How to Choose Between NLP and LLMs in a Regulated Estate
In banking, trust is mandatory, and it extends to the technology stack. A credible AI-assisted engineering framework blends proven Natural Language Processing methods with Large Language Model capability, balancing innovation against control rather than choosing one over the other.
Where an NLP-Heavy Approach Wins
Where interpretability, data privacy, and consistency are critical, agents should rely on tested NLP techniques: semantic parsing, entity recognition, dependency mapping, and rule-based classification. These analyze and refactor code safely inside closed environments, and their behavior is explainable to a reviewer without reference to a model card.
Where LLM Integration Earns Its Place
When the task demands higher contextual understanding, such as code summarization or intent extraction across an unfamiliar system, LLMs are selectively integrated under strict governance: isolated from sensitive data and monitored within secure on-premises or private-cloud deployments.
| Requirement | The right tool |
|---|---|
| Precision, privacy, predictability | Traditional NLP techniques that safely analyze code structures, map dependencies, and extract business logic inside secure environments |
| Contextual reasoning across a system | LLMs deployed to summarize intent and identify patterns that rule-based systems cannot capture |
| Regulated production workloads | A hybrid pipeline combining deterministic NLP with generative reasoning, so results are explainable and verifiable |
Each agent, whether Code Modernization, Test Generation, Remediation, or Documentation, is built on this hybrid approach. The output is explainable, verifiable, and production-ready rather than experimental. That distinction is the difference between a capability an institution can defend and a tool it has to explain.
Every AI-assisted engineering decision should be reducible to a single question: can a reviewer reconstruct why the system produced this change?
If the answer is yes, the technique belongs in the pipeline. If the answer depends on the model behaving consistently, it belongs behind a governance boundary with a human in the loop.
How to Measure Whether AI-Assisted Engineering Is Working
The published evidence on AI-assisted development is genuinely mixed, and leaders should resist the temptation to resolve it prematurely. DORA’s 2025 research found that around 90 percent of software professionals now use AI at work and more than 80 percent report productivity gains, while 30 percent report little or no trust in the code it produces. Stack Overflow’s 2025 Developer Survey found 84 percent using or planning to use AI tools, but only 33 percent trusting the accuracy of the output, and 66 percent naming output that is almost right, but not quite, as their top frustration.
Two controlled studies point in opposite directions. A randomized trial by METR found experienced open-source developers took 19 percent longer on tasks when permitted to use early-2025 AI tools, while believing they had been 20 percent faster. A randomized trial run by GitHub with Accenture found a 15 percent increase in pull request merge rate with roughly 30 percent of suggestions accepted. Both findings are real. The reasonable conclusion is that outcomes depend on the workload, the estate, and the controls around the tool, not on the tool alone.
That makes measurement a governance requirement rather than a reporting nicety.
| Metric category | Key performance indicators |
|---|---|
| Delivery metrics | Change lead time; change failure rate; time to restore service; proportion of releases with complete automated test coverage |
| Modernization metrics | Legacy modules decoupled per quarter; percentage of estate with generated, current documentation; reduction in maintenance share of IT spend |
| Assurance metrics | Percentage of AI-generated changes with complete lineage; review rejection rate for AI-suggested code; audit evidence produced without manual assembly |
| Adoption metrics | Engineer trust scores in AI output; suggestion acceptance rate; time reclaimed from manual testing and documentation |
Report these quarterly to both engineering leadership and the risk committee. Institutions that measure only speed will conclude that AI-assisted engineering works or does not. Institutions that measure assurance alongside speed will learn where it works, which is the only finding that scales.
Five Leadership Takeaways
Before your next modernization steering committee. Before your next technology budget review.
- The maintenance ratio is the strategy. When 70 percent of technology spend defends the past, no innovation agenda survives contact with the budget. Modernization is how the ratio moves.
- Incremental beats existential. Domain-by-domain modernization with automated parity testing carries a fraction of the risk of a core replacement, and it delivers value before the program ends.
- Evidence is the real AI dividend. Lineage, transformation logs, and self-updating documentation turn audit preparation from a project into a by-product of delivery.
- The productivity evidence is contested. The governance case is not. Independent studies disagree on whether AI makes experienced developers faster. None of them dispute that ungoverned AI-generated change increases exposure.
- Hybrid architecture is a control decision. Deterministic NLP where explainability is mandatory, LLMs where contextual reasoning is worth the governance overhead. Choosing one for everything is the failure mode.
The Leadership Imperative for 2026
Financial institutions are entering a period in which software is not merely written but engineered with intelligence embedded in the process. AI-assisted development turns traditional coding into a continuous, data-driven discipline that learns, optimizes, and governs itself. It reduces dependency on scarce legacy skills, accelerates modernization, and places compliance inside every release cycle rather than after it.
Four moves separate the institutions that will benefit from those that will simply adopt.
- Adopt AI-assisted engineering early, and use it to modernize legacy systems incrementally rather than in a single program.
- Build governance around the tooling from day one, so transparency, auditability, and regulatory trust are designed rather than retrofitted.
- Invest in hybrid talent models that combine human judgment with AI augmentation instead of substituting one for the other.
- Scale continuously across testing, remediation, and documentation, not just code generation.
Three questions every technology leader should be able to answer
- What proportion of our technology spend currently maintains systems we intend to replace?
- Can we produce complete lineage for every AI-generated change that reached production last quarter?
- Do we measure assurance alongside velocity, or only velocity?
If any answer is uncertain, the modernization program is running ahead of the control model. Institutions that close that gap will reduce technical debt and build durable advantage in speed, security, and innovation. Those that do not will accelerate into the same audit findings, faster.
To explore how ML arteka helps financial institutions modernize legacy estates with governed AI-assisted engineering, contact the ML arteka team or request a modernization readiness assessment.
Executive Questions and Answers
Five questions financial services technology leaders are asking AI assistants and search engines about AI-assisted engineering and legacy modernization.
StrategicWhy is AI-assisted engineering different from previous modernization approaches?
Previous approaches asked institutions to choose between leaving the core alone and replacing it wholesale. AI-assisted engineering offers a third path: incremental transformation, one domain at a time, with automated parity testing proving that behavior is preserved at each step. The difference is not that AI writes code faster. It is that AI can read a legacy system, extract the business logic embedded in it, map the dependencies that determine what can safely be decoupled, and generate the documentation that was never written. That combination lowers the risk of moving without requiring the institution to bet on a multi-year replacement program. With roughly 70 percent of banking IT spend consumed by maintenance, incremental transformation is the only approach that starts returning capital before it finishes.
ImplementationWhere should a bank start with AI-assisted engineering?
Start where the risk is lowest and the evidence accumulates fastest: test generation and documentation. Both are chronically under-resourced, both produce immediately verifiable output, and neither changes production behavior on its own. A Test Generation Agent that builds and self-heals regression coverage gives the institution something it needs before any code modernization begins, which is confidence that parity can be proven. A Documentation Agent turns an undocumented estate into a mapped one, which is a prerequisite for safe decoupling. Only once those two capabilities are producing reliable output should code modernization begin, and it should begin with a bounded domain that has clear interfaces rather than with the core ledger.
GovernanceHow do we govern AI-generated code in a regulated institution?
Governance has to live in the pipeline rather than in policy documents. Practically, that means every AI-generated change is attributed and logged, passes the same static analysis, dependency scanning, and secret detection as human-written code, carries automated regression and parity evidence, and produces lineage linking the change to the requirement that prompted it. Human review remains mandatory for anything touching regulated logic. Model access should be isolated from sensitive data, with deterministic NLP techniques preferred wherever explainability matters more than contextual reasoning. The test is straightforward: if a reviewer cannot reconstruct why the system produced a given change, the change should not have reached production.
RiskWhat is the evidence that AI actually makes engineers more productive?
The evidence is mixed, and executives should be told so. DORA’s 2025 research found around 90 percent of software professionals using AI at work with more than 80 percent reporting productivity gains, but 30 percent reporting little or no trust in the resulting code. Stack Overflow’s 2025 survey found 84 percent adopting AI tools while only 33 percent trust the accuracy of the output. A randomized trial by METR found experienced developers took 19 percent longer with early-2025 tools while believing they were 20 percent faster. A GitHub trial with Accenture found a 15 percent lift in pull request merge rate. The honest reading is that results depend on the workload and the controls, which is why measurement matters more than adoption targets.
OperationalHow should we measure the return on AI-assisted engineering?
Track four categories rather than one. Delivery metrics cover change lead time, change failure rate, and time to restore service. Modernization metrics cover legacy modules decoupled per quarter, the share of the estate with current generated documentation, and the maintenance share of IT spend over time. Assurance metrics cover the percentage of AI-generated changes carrying complete lineage, the review rejection rate for AI-suggested code, and audit evidence produced without manual assembly. Adoption metrics cover engineer trust in AI output and suggestion acceptance rates. Report all four quarterly to engineering leadership and the risk committee. An institution that reports only velocity will not detect the point at which speed starts outrunning control.
AI-assisted engineering is how financial institutions break the maintenance ratio that constrains modernization: Accenture’s Banking Trends 2026 reports roughly 70 percent of banking IT spend goes to maintaining existing systems, with technology costs growing about four times faster than revenue over fifteen years. The legacy estate is vast, with more than 800 billion lines of COBOL in production according to independent Vanson Bourne research. Rather than a full core replacement, AI-assisted engineering deploys four specialized agents: a Code Modernization Agent that extracts business logic through abstract syntax tree and control-flow analysis and translates it incrementally, a Test Generation Agent that builds and self-heals regression coverage, a Remediation Agent that scans for security and dependency risk, and a Documentation Agent that keeps system knowledge current. Regulated institutions should build these on a hybrid technical foundation, using deterministic NLP where explainability and data privacy are mandatory and LLMs under strict governance where contextual reasoning is required. The productivity evidence is genuinely mixed, with DORA 2025 reporting 90 percent adoption but 30 percent distrust of AI-generated code, and controlled trials by METR and GitHub reaching opposite conclusions. The governance case is not mixed: AI-assisted pipelines produce lineage, transformation logs, and audit evidence as a by-product of delivery. ML arteka helps financial institutions modernize legacy estates incrementally with traceability designed into the delivery system.