AI can modernise IBM i code, but only under tighter controls

Generative AI is gaining a role in IBM i modernisation, but ARCAD warns that scarce RPG expertise and unreliable automated changes make testing, governance and human review essential.

Generative AI is arriving in IBM i shops as a practical productivity aid, but the message from ARCAD Software is that it should be treated as a bounded tool rather than a substitute for disciplined engineering. Michel Mouchon, ARCAD’s chief technology officer and chief information security officer, argues that the platform’s long-standing skills shortage makes AI attractive, yet the same shortage also makes stronger controls more important, not less. IBM has separately stressed that RPG modernisation is meant to preserve working applications while bringing them into closer alignment with modern systems, APIs and cloud-connected workflows.

That view fits with IBM’s own positioning for its AI coding and modernisation tools. IBM says its Bob Premium Package for IBM i is intended to help teams understand legacy systems, document business logic and validate changes while reducing disruption to day-to-day operations. IBM has also described generative AI as a way to generate, optimise and translate code across the software lifecycle, including for older environments that still power core business processes. In practice, that means AI is being framed less as an autonomous developer than as an assistive layer on top of existing technical knowledge.

Mouchon’s central warning is that speed does not equal comprehension. He says ARCAD uses GenAI where it is useful for finding similar code and spotting redundant logic, but insists that its output must be checked by experienced staff before anything reaches production. That reflects a wider industry concern: AI assistants can accelerate coding, but they can also introduce subtle defects or alter application behaviour if their suggestions are accepted without review. IBM’s own modernisation material acknowledges that the point of these tools is to help developers work more effectively, not to remove human judgement from the process.

The article also highlights a structural limitation in the IBM i world: there is still relatively little RPG code available for model training, which makes language-specific assistance weaker than it is for more widely represented languages. IBM’s modernisation guidance says the aim is to address ageing RPG estates and the shortage of skilled developers, but that does not mean every AI-generated change will be reliable. Mouchon says ARCAD’s testing suggested that AI-produced RPG modernisation work was wrong about half the time and could change programme behaviour, underlining how easily legacy systems can be disturbed when code is refactored too aggressively.

For that reason, he argues that GenAI should be paired with stricter validation, not looser governance. IBM i teams still need unit testing, regression testing, deployment gates and secure DevSecOps workflows, especially if AI is increasing the volume of code produced in a given period. Security researchers and industry analysts have also warned that AI agents can be manipulated or over-privileged if they are deployed without sufficient oversight, including the risk of prompt injection and data exposure. ARCAD’s position is that deterministic controls, test automation and AI should work together: use probabilistic tools where a good-enough answer is acceptable, and keep rule-based systems where precision matters.

That is also how ARCAD says it is structuring its own tools. The company says its long-running deterministic products for analysing RPG code, managing DevOps flows, modernising source and database structures, and testing changes can now expose more context to GenAI and agentic systems through more than 200 MCP services. The aim is to reduce risky recommendations, cut token consumption and make AI usable in a controlled enterprise setting rather than as an open-ended coding engine. In that framing, GenAI becomes one more layer in the modernisation stack, useful only when it is constrained by process, expertise and verification.

Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.