Risks of AI-Only Migration

Part 6 made the case for the loop. The clearest way to see why a safeguard matters is to remove it and watch what breaks. This part removes the human and the gate and walks through what an AI-only migration actually does, not as fear-mongering but as a failure catalog, because the failures are specific, repeatable, and entirely avoidable once you can name them.

The reframe: AI-only migration does not fail because AI is bad at the work. It fails because it is good enough to look finished while being wrong in ways nobody checked. Plausibility without proof is the whole problem.

Risk 1: confidently plausible code

The foundational risk, the one every other risk builds on. AI-generated code does not fail like a careless junior’s, with bugs that announce themselves. It fails by looking exactly right. It compiles, it reads cleanly, it matches the request, and it can still diverge from the legacy on the rounding rule, the ordering quirk, the malformed record some downstream process has quietly depended on for years.

That failure mode is invisible by construction. There is no compiler error for “behaves differently than the system it replaced.” Without something checking the output against reality, the divergence ships, and it surfaces later as a production incident whose cause is buried in code that looked fine in review. The danger is not that AI writes bad code. It is that AI writes plausible code, and plausible is the hardest kind of wrong to catch.

Risk 2: tests that certify the wrong answer

The natural reflex is “we’ll cover it with tests.” But in an AI-only flow, the tests are generated too, and if the same model wrote the code and the tests from the same understanding of the system, they agree with each other and both miss the same truth. A green suite results, certifying behavior that the legacy system never had.

This is worse than no tests, because a passing suite is precisely the artifact a team uses to stop worrying. False confidence at scale is more dangerous than acknowledged uncertainty, because it ends the scrutiny exactly when scrutiny was still needed. A test only proves the code matches the test. It cannot prove the test matches the world. Generated tests checked against generated assumptions prove nothing about the real system.

Risk 3: business rules that were never in the code

A legacy system’s most valuable content is the behavior it encodes, and some of the most important behavior is not fully in the code at all. It lives half in the source and half in context the model cannot see: a contractual obligation, a regulatory requirement, a workaround everyone knows about and no one wrote down. AI reads the code exhaustively. It does not read the contract, attend the meeting, or carry the institutional memory.

An AI-only migration drops what it cannot see. The rule that existed because of a 2014 incident, the rebate for one large customer, the sequence that must hold for a reason external to the system, these vanish silently, and the gap surfaces as a stream of “bugs” after cutover, each one a piece of business logic that was never captured. The deeper the system’s history, the worse this gets, because age is precisely how much undocumented context accumulates.

Risk 4: security and edge cases nobody enumerated

A model generates code to satisfy the behavior it can infer. It does not, on its own, enumerate the malformed inputs, the hostile inputs, or the authorization rules that the legacy code enforced implicitly through how it was structured. Those protections are often the least documented and the easiest to drop, because they show up as the absence of a bad outcome rather than the presence of a feature.

The result is a system that handles the happy path and quietly loses a validation check, a bounds test, or a permission gate the old code enforced without ever naming it. Nothing fails in review, because the missing case is a case no one wrote down to check. This is the same silent-divergence problem as Risk 1, aimed at the part of the system where a silent gap is most expensive: the edge the attacker or the bad record finds first.

Risk 5: output nobody on your team understands

Suppose the code were correct. An AI-only migration still hands you a modernized system that no engineer on your team reasoned through. The point of modernization is not only newer code. It is a system your people can change safely for the next decade. Code generated wholesale, unread and unexplained, trades a legacy system nobody understands for a modern one nobody understands, which is a smaller improvement than it looks.

Worse, the institutional knowledge the migration was a chance to recover, the rules, the reasons, the map of what depends on what, is never captured, because nothing forced a human to write it down. A migration that could have turned tacit knowledge into living specs instead throws it away a second time. A modern stack you cannot confidently modify is a new legacy system with a younger date on it.

Risk 6: the autonomous big-bang

Even if the code were perfect, the shape of an AI-only migration is dangerous. Generating an entire modernized system end to end and switching to it is a big-bang cutover, the single most reliable way modernization programs fail, and the subject of its own article. Big-bangs fail because they concentrate every risk onto one distant date: no early signal, no delivered value until the end, and rollback that is expensive or impossible once the old system is gone.

AI does not fix this. It accelerates it. Reaching a concentrated, unproven bet faster is not a safety improvement. The structural cure is unchanged by AI: modernize slice by slice behind a strangler facade, prove each slice against the legacy before it carries traffic, and keep rollback one flag-flip away. Speed applied to the wrong shape just buys an earlier failure.

The pattern behind the risks

Risk	Why AI-only hits it	What closes the gap
Silent behavioral divergence	Plausible code with nothing checking it against the real system	Parity gate on real traffic, reconciled against the legacy
Tests certify wrong behavior	Code and tests share one model’s assumption	Validate against the legacy system, not against a generated spec
Lost business rules	The rules live outside the code, where the model cannot read them	Human discovery with SMEs, rules captured as living specs
Security and edge-case gaps	No one enumerated the malformed inputs or the implicit authorization rules	Explicit threat and edge-case review by senior engineers
Output nobody can maintain	Code generated wholesale that no engineer reasoned through	Human-authored specs and reviewed code the team actually owns
Autonomous big-bang	All risk concentrated on one distant, unproven cutover	Slice by slice behind a strangler facade, rollback one flag away

Read the right column and the cure is one idea wearing six hats: anchor the work to reality, one reversible step at a time, with a human deciding what reality is. Every risk in this catalog is what happens when AI’s output is trusted instead of proven. None of them is an argument against AI. Each is an argument for the loop and the gate.

Where AI genuinely earns its place

This catalog is an argument against AI-only migration, not against AI. Drop the only and AI becomes the most valuable tool in the work. It reads an entire legacy codebase, the source, the data, the configs, far faster than any human team can, and it surfaces the dependencies, the dead code, and the duplicated logic that would take weeks to find by hand. Analysis that runs twelve weeks by manual review can run in about two. It drafts the specifications that capture what each slice does, and it proposes a slice plan grounded in the actual code rather than a whiteboard guess.

The difference between that and the failure catalog above is one word: review. AI does the reading and the drafting at machine speed, and senior engineers decide what is right, fill in the rules the model could not see, and gate every slice on proven parity with the legacy before it carries live work. That is the whole design. AI supplies the speed. The human supplies the judgment and the proof. It is how ModernLift delivers, and it is the shape every one of these risks points toward.

When AI-only is actually fine

Honesty cuts both ways, so here is the case for AI-only work, narrowly. When the stakes are low and verification is cheap, full oversight is wasted ceremony. A throwaway script, a prototype you will rebuild, a small utility with a fully-tested surface and a wrong answer that costs nothing to catch: generate it, glance at it, move on. The risks in this article all scale with two things, blast radius and the cost of a silent error. Where both are small, AI-only is not reckless. It is efficient. The judgment is knowing which system you are in. A production system that runs the business is not that system.

Two limits on the alarm

First, these risks are about AI-only migration, AI with no human judgment and no validation. They are not arguments against AI in migration, which would be its own expensive mistake. Refusing AI leaves months of avoidable manual analysis on the table. The target is the only, not the AI. Second, the loop and the gate reduce these risks. They do not zero them. A reviewer can miss a rule, and a parity gate only proves what the traffic exercised. The honest claim is bounded: human-in-the-loop, parity-validated delivery removes the structural causes of these failures, the ones that account for the expensive surprises. It does not promise perfection, and a vendor who promises perfection has just demonstrated the overconfidence this whole article is about.

Where this leads

Knowing the risks tells you what to demand from any AI in your migration. The market is now full of tools promising to deliver exactly this work, and they vary enormously in which of these risks they address and which they quietly leave to you. Part 8, GenAI Modernization Tools Compared, maps the tool landscape against this catalog: what each category does well, where it stops, and the questions to ask before you trust one with a system that runs your business. If you would rather walk your own estate with someone who does this for a living, a 30-minute discovery call is the place to start, or reach the team at sales@modernlift.ai.