What seven financial services leaders told us about AI and the mainframe
TL;DR: Banks and insurers want AI agents on their core systems, but retiring experts, nightly batch data, governance demands and unclear ownership hold them back. We met with seven senior leaders from across financial services and…
What seven financial services leaders told us about AI and the mainframe
TL;DR: Banks and insurers want AI agents on their core systems, but retiring experts, nightly batch data, governance demands and unclear ownership hold them back. We met with seven senior leaders from across financial services and insurance, and they named the same blockers we see in the field. Lior Ribalov's answer: connect legacy logic and data as APIs, activate governed AI agents on real operations, then modernize into any platform at your pace.
We met with seven senior technology and AI leaders from across financial services and insurance, joined by Lior Ribalov, OpenLegacy's SVP of modernization and GenAI. The group shares one assignment: bring AI to core systems that still run on the mainframe.
We asked what blocks AI from reaching mainframe logic and data, and how ready their organizations are for AI agents. We also asked how they make the business case. Their answers, and the path that came out of the discussion, follow below.
In this article
- The people who understand the system are retiring
- AI agents can't wait for the nightly batch
- AI needs to know what the data means
- In regulated firms, governance comes first
- Ownership and the business case
- The path forward: connect, activate AI, modernize
- See the path from legacy to AI in a demo
The people who understand the system are retiring
Knowledge loss was the blocker everyone in the room expected. Still, almost every leader raised it before we reached a single technical question.
The developers who wrote the COBOL decades ago have retired or moved on, and their documentation describes a system that has changed many times since. So teams at banks and insurers depend on a shrinking group of veterans to explain what a program does. More than one leader described a core platform that relies on one or two people to keep it running. And younger engineers rarely choose mainframe work, which widens the gap.
AI looks like the obvious fix, and in part it is. Teams told us AI tools now convert legacy code into Java and other languages in days. But when nobody understands both the old code and the new code, nobody can confirm the converted version does what the original did. In a regulated business, an unverified conversion carries more risk than the code it replaced.
Lior Ribalov, OpenLegacy's SVP of modernization and GenAI, pairs AI with the business. AI maps the legacy system and documents its business rules. Then business experts review that documentation one process at a time and decide which rules still matter. As he put it, teams shouldn't try to "prompt their way from point A to point B."
Knowing what the system does solves half the problem. The other half is getting its data to AI fast enough to matter.
AI agents can't wait for the nightly batch
The second blocker came down to timing. Most mainframes still move data in nightly COBOL and DB2 batch runs, and AI agents work on a different clock.
An AI agent handling a customer question needs today's policy details, and a risk agent needs the current loan status. But the mainframe holds that data, along with the business logic that governs it, and it offers few APIs. So yesterday's batch output becomes the best answer an agent can get.
Some teams work around the gap by copying mainframe data into a cloud data platform. The copy helps with reporting and analytics. Still, every copy ages from the moment it lands, and it carries none of the business rules that decide how the data gets used.
Lior pointed to a different model. Instead of moving data out on a schedule, teams expose legacy logic and data directly, as APIs and MCP tools that agents call when they need them. And access runs both ways, so agents can read legacy data and also act on it, for example by writing a newly calculated renewal price back to the core system.
Access solves the timing problem. Meaning is the harder one, because an agent can reach the right data and still misread it.
AI needs to know what the data means
Several leaders called meaning the bigger risk. A term like "asset" or "trade" can carry a different definition in each part of a bank or insurer, and legacy systems rarely record which one applies. Even an insurance loss ratio raises a hard question about which column holds the authoritative claims figure.
Implementation teams told us that when they hand raw legacy records to an AI model, it tends to hallucinate. One leader added a sharper warning: AI will find whatever answer your question points it toward. Without subject matter experts who know what the data means in context, a confident answer can still be wrong.
So context comes first. Lior recommends giving the AI two catalogs before it sees any code. The first is a data map, or semantic layer, of the system's data entities. The second is a business process catalog that describes what the system does for the business. Then the code goes on top, and agents give far better answers about where a premium calculation lives or which regulatory rule applies.
Context also needs focus. OpenLegacy exposes only the fields an agent needs for a given task, which cuts AI context by up to 99%.
For regulated firms, the next question is who controls what those agents can see and do.
In regulated firms, governance comes first
Ask a bank or insurer how ready it is for AI agents, and the conversation turns to governance within a minute. One leader put it plainly: governance is the main focus for now.
Regulators set the floor. Code that AI writes still has to follow the same development lifecycle, and leave the same audit trail, as code a person writes. Security adds a second concern. Many teams see the mainframe as secure by design, so they want API access to carry at least the same level of control.
Agents make the job harder. A traditional workflow follows one fixed path that teams can test scenario by scenario, while an agent decides for itself what to access and when.
Lior's view is to design governance in from day one. OpenLegacy, working with AWS, applies controls down to a single agent and a single prompt, with an audit trail that shows who accessed what. And deterministic workflows send the same input down the same path every time, which gives risk teams something they can test and sign off. Leaders who already run agents described a steady sequence: human-approved actions on well-defined processes first, then more autonomy as confidence grows.
Governance answers the risk question. Funding and ownership decide whether the work begins at all.
Ownership and the business case
Even with the technical answers in hand, many programs stall before they begin. Legacy data often has no clear owner, so a team can spend weeks on a business case and then find nobody with the authority to approve it. Large mainframe programs also run for years and cost accordingly. And decades of stable operation feed the instinct to leave a working system alone.
The instinct has merit, since a system that does its job well doesn't need a new platform for technology's sake. But AI changes the math. Leaders described AI-native competitors that build financial products in weeks, while incumbents hold decades of business logic and data those newcomers can't match.
Executives who approve these programs often come from finance or operations, and boards don't always separate an AI improvement from an infrastructure upgrade. Lior's advice is to let the business process lead. Frame the case around what a specific process gains, such as new financial products or higher productivity, and present the infrastructure as what that process requires. A high-value process makes the strongest first candidate, because early, visible returns keep sponsors committed. And reusing existing business logic, rather than rewriting it, cuts modernization cost by up to 60%.
Lior then laid out the path OpenLegacy follows with customers.
The path forward: connect, activate AI, modernize
Lior opened his closing remarks with a prediction. "Mainframe is here to stay," he said, "in some organizations longer than they anticipate." Yet the business logic and data inside those systems still need to reach AI, and his three steps work with both facts.
Connect: legacy logic and data as APIs
Teams decide which parts of the legacy system to expose, then expose them as APIs and MCP tools rather than nightly extracts. Lior calls the result a "headless mainframe." The legacy system keeps running, while a governed API layer becomes the contract every new application and agent uses. Over time, teams replace pieces behind that contract following the strangler fig pattern, and nothing in front of it has to change. OpenLegacy generates production-ready APIs from existing business logic, with 10x faster time-to-market than hand-built integration.
Activate AI: governed agents on real operations
Next, teams choose the business processes that need AI with legacy data as context. Agents get only the relevant logic and data, through governed access, so they can read records and also act on them. Lior recommends working on real operations from day one, with human approval on agent actions at first. OpenLegacy's OL Gene platform runs these agents with governance and audit trails built in.
Modernize: into any platform, at your pace
Lior urged teams to count business processes instead of lines of code. AI-assisted analysis works like an x-ray of the legacy system. It maps each business process and its dependencies, and it separates 30-year-old logging code from the rating logic that drives the business. Business experts then decide the future state, and teams forward-engineer each process into Java or any other target the organization chooses.
A coexistence bridge keeps the old and new systems in sync while each process moves, so both run side by side with zero big-bang risk. Pick a high-value process, prove its value in production within months, then move to the next one.
Lior believes the enterprises that put their legacy logic and data to work will hold an advantage, even over the AI-native companies entering their markets. The leaders we met already own that asset. The path above gives them a way to use it.
See the path from legacy to AI in a demo
Most leaders we met face some version of these blockers. The ones making progress picked one business process that matters, connected it, put governed agents to work on it, and modernized from there.
Book a demo to see the connect, activate AI, modernize path running on real legacy systems, and to talk through the high-value process you'd tackle first.
FAQ
What's stopping banks and insurers from using mainframe data with AI? The leaders we met named four main blockers: retiring experts who understand the systems, nightly batch processing instead of real-time access, unclear meaning in legacy data, and governance demands from regulators. Unclear data ownership and hard-to-make business cases slow many programs down even further.
How do you modernize a mainframe when the original developers have retired? AI-assisted reverse engineering maps the legacy system and documents its business rules. Business experts then review that output one business process at a time and decide which rules still matter. The approach turns tribal knowledge into validated documentation, so teams can verify each converted process before it goes live.
How can AI agents get real-time access to mainframe data? Instead of copying data in nightly extracts, teams expose legacy logic and data directly as APIs and MCP tools. Agents call them when they need current answers, and they can write updates back to the core system. OpenLegacy generates these APIs from existing business logic, with 10x faster time-to-market than hand-built integration.
How do you govern AI agents that read and update core systems? Design governance in from day one. Apply controls down to the individual agent and prompt, with an audit trail of who accessed what, and use deterministic workflows that risk teams can test. Many teams begin with human-approved actions. OpenLegacy's OL Gene platform runs agents with governance and audit trails built in.
Should we rewrite COBOL with AI, wrap it with APIs, or replace the system? The answer depends on the business process. Validated logic, such as a complex rating engine, can stay in place behind a REST API while new applications run on top of it. Other processes justify a rewrite into Java or another target. Modernizing one process at a time, with coexistence, lets teams decide case by case.
Can AI document undocumented COBOL, and can we trust the output? AI documents legacy code quickly, and trust comes from validation. Business experts review the AI's output for each business process and confirm which rules still apply. With that human review in place, AI-generated documentation becomes a dependable basis for modernization decisions and for verifying converted code.