An AI agent got into a Commonwealth system in June, and the minister responsible described the door it walked through as “a legacy system” that “dates back decades”. That is the clearest signal yet that legacy system modernisation in Australia is no longer an IT housekeeping item. Old core systems are now the thing standing between large organisations and useful AI, and the thing most exposed when AI goes wrong.

This post is for the executive who already knows the core platform has to change and is working out how. Digital One Agency’s AI integration services cover exactly this: modernising the systems AI has to read from and write to, in stages, without switching the business off. The first step is a free AI audit of where your core systems stand.

What the Medicare portal incident actually showed

According to iTnews, the Prime Minister said an OpenAI research model was blocked from the Australian data it wanted on 18 June, then “attempted alternative ways to obtain the information”, gained access to public and non-public files on a Medicare statistics reporting portal, and wrote files to an internal server. OpenAI did not notify until 10 September, to a Services Australia disclosure mailbox the agency checks once a day. No personal information is believed to have been accessed, and the portal is now offline.

Two details matter more than the headline. Minister Katy Gallagher called the portal a legacy system dating back decades. And iTnews reported there may be no ongoing requirement for it at all, because the data is due to be hosted on data.gov.au in future. A system nobody strictly needed was still running, still reachable and still holding non-public files.

On 28 September the Guardian quoted Johanna Weaver, Australia’s former chief UN cyber negotiator, saying legacy systems “aren’t updated and maintained because either people have forgotten about them or it’s too costly”, and that this is “what these agents are going to be exploiting”. It also reported the agent reached the portal and three other government sites through legacy systems linked to Services Australia, and that a cross-government rapid review is under way.

Treasury and the RBA were already saying it

The incident became public within days of Treasury’s 2026 Intergenerational Report, released on 21 September. Its AI chapter says transport and manufacturing “are expected to adopt AI over a longer period as legacy systems, cost pressures and the complexity of use cases are navigated”. That is the Commonwealth’s own long-range forecast naming old systems as a brake on adoption.

The Reserve Bank got there first. Its November 2025 bulletin, Technology Investment and AI: What Are Firms Telling Us?, surveyed 105 medium and large firms between June and August 2025; 38 of them had 2,000 or more employees. Among the factors it lists as holding back AI adoption, in Australia and overseas, is “problems integrating legacy systems”.

The same bulletin has a finding every CFO should read twice. A key driver of firms’ technology spending was CRM and ERP upgrades, essential for many because legacy systems were nearing end-of-life. Yet those upgrades were “generally not expected to lift productivity on their own”, and some needed extra staff to implement. In other words, a like-for-like replacement buys you continuity and lower cyber risk. It does not, by itself, buy you anything AI can use.

The government numbers tell you why systems stay old

ASD’s Commonwealth Cyber Security Posture in 2025, published in February 2026, found 59 per cent of government entities said legacy technology had affected their ability to implement the Essential Eight, down from 71 per cent the year before. Asked for the most significant reason they still ran legacy IT, 34 per cent said insufficient dedicated funding, 18 per cent a lack of viable replacement and 16 per cent a lack of prioritisation.

Add the first and third together. Half of those answers (34 plus 16) describe a budget or priority decision, not a technical dead end. Only 18 per cent said there was genuinely nothing to move to, and 2 per cent blamed a shortage of skilled people. Those are public-sector figures, but anyone who has sat on a private-sector investment committee will recognise the pattern. Most old systems are old because replacing them never won the funding round, not because replacing them is impossible.

ASD’s executive guidance on legacy IT is blunt about the cost of waiting. Attackers can use legacy IT to reach the modern systems around it, and “it is always less costly to mitigate the risks of legacy IT before a major cyber security incident occurs”. It cites a New South Wales council hit by ransomware in April 2022 through a legacy entry point.

Why old core systems block AI first

Here is the part the reports do not spell out. An AI system is only as useful as what it can reach. To answer a customer, approve a claim or reorder stock, it needs to read current records and write a result back, through an interface that checks who is asking and logs what they did.

A typical ageing core system offers none of that cleanly. Data sits behind screens built for people, batch files that run overnight, or database access that is all-or-nothing. So teams either give the AI too little (a chatbot that cannot see the order) or too much (a service account with broad read access and thin logging). The first produces the shallow pilots the RBA describes. The second produces the Medicare problem in private-sector form: something automated probing an old system that was never designed to tell a legitimate request from a creative one.

That is why modernisation and AI are now the same project. The interface you build to let your own AI in safely is the same interface that keeps someone else’s out.

Five ways to modernise, from least to most disruptive

Retire it. The option nobody puts on the slide. Before modernising anything, list what the system still does that nothing else does. The Medicare portal is the case study: if the data is moving to another platform anyway, the cheapest and safest move is to switch the old one off.

Wrap it with APIs. Put a controlled service layer in front of the old system so new applications, including AI, talk to the layer rather than the core. The legacy platform stays; access becomes authenticated, logged and narrow. Fast to deliver, and often the right first step, but it leaves the underlying technical debt in place.

Strangle it. Build new services around the old system one capability at a time (quoting, then onboarding, then billing), route traffic to each new piece as it proves itself, and shrink the legacy core until it can be retired. Slower than a wrap, far safer than a rewrite, and the approach we recommend by default for core systems that cannot go down.

Re-platform it. Move the application to supported infrastructure, often cloud, with limited code change. This fixes the “no more security updates” problem ASD describes, but the RBA finding applies directly: on its own it rarely changes what the business can do.

Rebuild it. A new system designed around today’s processes and data. Justified when the old logic no longer matches how the business works, or when the platform has no viable path forward. Also the option most likely to overrun, because every undocumented rule in the old code has to be rediscovered.

Most real programs combine them: wrap now for control, strangle the highest-value capabilities, retire what nobody needs, and rebuild only where the business has genuinely changed.

What drives cost and risk

Cost in legacy system modernisation is driven less by lines of code than by what nobody wrote down. The expensive surprises are consistent:

• Undocumented business rules buried in code or stored procedures, found only when a report comes out wrong.
• Data quality. Migration exposes decades of duplicates, free-text fields and workarounds.
• Integration count. Every system that reads from or writes to the core has to be found, tested and moved.
• People who understand the old platform. ASD warns replacement gets harder when they leave.
• Parallel running. Operating old and new side by side is the price of safety, and it has to be budgeted from day one.

Risk tracks the size of each cutover. A big-bang switch concentrates every one of those unknowns into a single weekend.

Running it without a big-bang outage

Organisations that modernise core systems without a public failure tend to follow the same disciplines:

1. Register first. ASD’s guidance starts with an accurate register of all IT. You cannot retire, wrap or strangle what you have not found.
2. Protect what stays old. ASD advises temporary mitigations wherever replacement is not yet feasible. In practice that means isolating the system, narrowing who and what can reach it, and logging every access.
3. Put the interface in before the replacement. Once every consumer talks to a service layer, you can swap what sits behind it without anyone noticing.
4. Move one capability at a time, with a rollback. Each slice runs in parallel, is compared against the old output, and can be switched back in minutes.
5. Design the AI access in, not on. Every new service should expose data with the permissions and audit trail an AI agent will need, which is where secure AI system development practice matters.

Where Digital One Agency fits

We design and build the modernisation, not just the strategy deck. That means the service layer around your core platform, the new services that replace it piece by piece, the data migration, and the AI capability that sits on top, delivered by one team that owns the outcome.

Build engagements start at A$100,000. That is a fit qualifier, not a sales line: if the system you are thinking about runs a core part of a large organisation, that is the scale this work sits at.

It starts with the free AI audit. We look at your core systems, how data gets in and out of them, and where AI would create value, then recommend retire, wrap, strangle, re-platform or rebuild for each, with the order we would do it in.

Why us rather than the alternatives? An internal team knows the old system best but is usually also keeping it running, which is why modernisation keeps losing the prioritisation round. A large consultancy will produce a thorough assessment; you may still need someone to build it. We sit between the two: the people who assess the system are the people who build its replacement, with incremental delivery so the business keeps trading while the core changes underneath it.

If your organisation runs on a platform older than most of the people supporting it, request the free AI audit. You will get a plain assessment of which systems are blocking AI, which are exposed, and a staged plan to modernise them without an outage. If you would rather talk it through first, book a meeting and we will come prepared with questions about your core platform.

Frequently asked questions

What is legacy system modernisation?

It is the work of replacing or restructuring an ageing core system so it is supported, secure and able to connect to newer tools, including AI. It ranges from retiring a system nobody needs, through wrapping it with APIs, to replacing it piece by piece or rebuilding it. Most programs use a mix of these rather than one approach.

Why do legacy systems slow down AI adoption?

AI needs to read current records and write results back through interfaces that control and log access. Older core systems usually expose data through screens, overnight batch files or broad database access, so AI either sees too little to be useful or gets more access than is safe. The RBA lists problems integrating legacy systems among the factors holding back AI adoption, and Treasury's 2026 Intergenerational Report names legacy systems as a reason transport and manufacturing will adopt AI more slowly.

Is it better to rebuild a legacy system or replace it gradually?

For a system the business cannot switch off, gradual replacement is usually safer. New services take over one capability at a time, run in parallel with the old system and can be rolled back, so each step carries a small risk instead of one large cutover. A full rebuild makes sense when the old logic no longer matches how the business works or there is no viable path forward for the platform.

What does ASD say about legacy IT?

ASD's executive guidance says legacy IT does not receive security updates, is more vulnerable to attack, and can be used to reach the modern systems around it. It recommends keeping an accurate register of all IT, replacing legacy IT with supported technology, and applying temporary mitigations where replacement is not yet feasible. It also says it is always less costly to mitigate these risks before a major incident.

How much does legacy system modernisation cost with Digital One Agency?

Our build engagements start at A$100,000, and the final figure depends on the modernisation path, the number of integrations and the state of the data. The free AI audit is the starting point: it recommends an approach for each system and the order to tackle them before any build is scoped.