A Smarter Way to Modernize Your System With AI

90% of vertical AI use cases are still stuck in pilot. That’s McKinsey’s number from 2026, and it’s the single most important statistic for anyone planning to ship AI into a legacy system this year. The question isn’t whether AI can modernize the code. The question is whether the team can get past the pilot.

If you’re trying to modernize your system with ai, here’s the path that actually moves programs out of pilot purgatory.

Step one: define outcomes and guardrails before touching a model. Pick one workflow instead of a portfolio. One. Write a one-page scorecard covering baseline metrics, numeric targets, unacceptable failure modes, latency and cost ceilings with alerting, and escalation paths for when the AI suggests versus when a human decides. Do this before model selection turns into a political fight. It will.

Step two: map the system, the data, and the actual work. Org charts lie. Work happens in shadow spreadsheets, Slack DMs, and a senior engineer’s head. Build a workflow map with exception paths, a system map with owners, and data lineage for each key field. Clarify system of record (where the truth lives) versus system of action (where people work). Miss this and the result is a bug that reads correctly on every screen and lies in the database.

Step three: choose the right first use case. Feasibility comes down to four things: data access, integration surface, risk profile, and evaluability. Good first picks in 2026 are RAG-based Q&A, grounded summarization, classification, developer assistance, and assistive drafting with human approval. Bad first picks are high-stakes automated decisions and regulator-facing outputs with immature evaluation. Quick test: can the team build a golden set of 50 correct examples in under a week? If not, it’s a research project dressed up as a product. Rename it and replan.

Step four: build the data and access foundations. RAG ingestion must clean content, attach metadata, and preserve lineage. Stale retrieval is worse than no retrieval because it looks authoritative. Enforce access control at retrieval time, not at the UI. UI-level controls alone will leak. Minimize PII in prompts, redact where possible, and isolate AI services on the network. This is the step most programs under-resource, and it’s the step that determines whether the system passes a security review in month five.

Step five: decide the architecture pattern. Three patterns, chosen by how many teams will use the thing. Embedded AI when one application owns the workflow (tight coupling is the risk). Sidecar service when several apps share the capability (network hops and API discipline become the risk). Shared platform when multiple teams will build on it over 12 or more months (upfront cost and multi-tenancy are the risks).

Start with Embedded or Sidecar. Earn the way to a platform. Building the platform first burns $2M before shipping a single feature, and the feature never arrives because the platform keeps growing. Treat RAG as its own subsystem with dedicated SLOs, evaluation, and threat model.

Step six: ship a thin vertical slice. A thin vertical slice runs end-to-end through every layer. UI, business logic, data access, AI service, and back to the user. It surfaces the real risks before architecture gets locked in. Build evaluation in from day one with offline datasets, regression across prompts and model versions, and human review for ambiguous outputs. Keep a working non-AI path behind a feature flag. It will be needed at some point, usually at the worst possible moment.

Step seven: productionize with LLMOps and MLOps discipline. Treat prompts, retrieval indexes, and model versions as first-class artifacts. They get versioned, reviewed, and deployed like application code. Run CI/CD with staged environments. Monitor latency, error rates, cost, and quality. Use canary releases and shadow mode for model changes. Add red teaming for prompt injection, jailbreaks, and data extraction. The teams that skip this step are the same teams whose systems go dark in month nine when the model vendor ships an update nobody tested against.

Step eight: roll out, drive adoption, scale. Phased rollout cuts organizational risk. Narrow cohort first, expand when metrics hold steady, keep governance gates tied to artifacts rather than opinions. Adoption is the usual bottleneck. Trust, workflow mismatch, and UI friction kill more features than quality does. Ship the AI into tools people already use. Track cycle time, rework, error rates, and escalations against a baseline.

The 2026 tool landscape, honestly The tool market moved faster in the last 18 months than in the five years before it. Pricing and positioning below is current as of early 2026 and will shift again by Q3. That’s just the nature of this space right now.

GitHub Copilot Enterprise ($39/user/month). Broad developer productivity, IDE-embedded, strong enterprise story with SOC 2. Weaker on COBOL nuance than on Java. Cloud-only.

Claude Code from Anthropic (usage-based). Large-context analysis, code exploration, and the COBOL capability that dropped IBM stock 13% when it was announced in February 2026. API-based deployment. SOC 2 and HIPAA-eligible.

Amazon Q Developer (from $19/user/month). AWS-native modernization and Java upgrades. Stronger on Java modernization than on mainframe. Inherits AWS compliance posture. Cloud-only.

IBM watsonx Code Assistant for Z and Project Bob (enterprise pricing). Purpose-built for IBM Z. COBOL-to-Java migration on-platform. Works with IBM Z deployments including on-prem configurations. The only real answer for organizations that need everything inside the firewall.

Cursor ($20/user/month and up). Multi-file refactoring, large-scale changes, improving enterprise story. Weak on mainframe. Cloud-only.

Tabnine (enterprise pricing). Privacy-sensitive environments, on-prem deployment available, strong for regulated industries where “send our code to a third-party cloud” is a non-starter.

Zencoder (usage-based). Agentic analysis of AS/400 and similar legacy systems. ZDNET’s PRCA case study is the public reference point. Enterprise compliance story is still emerging.

TCS MasterCraft and TransformPlus (project-based). Large-scale COBOL modernization with services wrapping the tooling. On-prem available. Full enterprise stack for organizations that want the tool and the hands to use it in one contract.

Three things the tool list doesn’t capture. The right tool is usually two or three tools. Successful enterprise programs rarely run on a single copilot. Real programs pair a discovery-focused tool (Claude Code, Project Bob) with an IDE-embedded coding assistant (Copilot, Cursor, Tabnine) and a testing-focused tool in the CI/CD pipeline. Pick for the job, not for the brand.

“Enterprise-ready” is a spectrum. In regulated industries, the on-prem or air-gapped options matter more than feature parity. A tool that cannot be deployed inside the network cannot be used for the core banking system, no matter how good its benchmarks look on a vendor slide.

Build versus buy is real. When IP is sensitive enough or the domain knowledge is niche enough, fine-tuning an open-weight model on an internal codebase can be worth the engineering investment. Most organizations should not do this in year one. Maybe in year three, after the use cases have proven out and the team has built the operational muscle to maintain a custom model without breaking it every six weeks.

Where to actually start Pick one workflow. Write the scorecard. Map the data. Ship the thin vertical slice in 90 days. The 90% of use cases stuck in pilot aren’t stuck because the tools aren’t good enough. They’re stuck because the teams skipped steps one through four and tried to jump to the impressive-looking parts.

The boring steps are the whole point.

Read the full article to uncover the business case for why 2026 is different if you want to modernize your system with ai, and the governance failure modes that sink programs even with the right tools.