South Africa: AI Legacy Systems Compliance Risk Rises With Outdated IT

• Integrating AI with legacy IT systems exposes significant compliance risks due to fragmented and undocumented data sources.
• Technical debt, traditionally an IT issue, transforms into a regulatory concern when AI is layered on top, incurring "regulatory interest."
• McKinsey's research indicates 10-20% of new product tech budgets are diverted to technical debt, which represents 20-40% of a tech estate's value.
• The core legal challenge involves an organization's inability to prove data provenance, consent, retention, modification history, and movement.
• The EU AI Act, particularly Article 11 and Annex IV, mandates detailed technical documentation and data provenance for high-risk AI systems.

Beyond the financial drain, the core legal challenge isn't just the potential for system failure; it's the organization's inability to substantiate crucial data attributes.

Many organizations grapple with deeply entrenched, outdated IT systems that are rarely scrutinized or updated due to their critical, yet fragile, nature. These "legacy systems" often form the foundational infrastructure upon which ambitious new artificial intelligence initiatives are built. However, integrating cutting-edge AI with such antiquated backends frequently unearths a host of hidden problems, transforming what appears to be a technological leap into a complex challenge of AI legacy systems compliance risk.

The promise of a unified "single source of truth" often dissolves when AI systems attempt to access data from these older platforms. Instead, organizations discover their data is fragmented across multiple sources, including numerous databases, disparate spreadsheets, an abandoned server, and even the institutional knowledge of former employees. A notable example involves a business-critical nightly batch job, whose intricacies were understood solely by an employee named Trevor, who departed in 2019, leaving no documentation behind. This lack of proper record-keeping and reliance on individual expertise highlights a significant vulnerability in legacy IT data compliance when attempting to modernize with AI.

Traditionally, technical debt has been framed as an internal IT challenge, encompassing issues like outdated code, cumbersome architecture, and costly maintenance for systems deemed too vital to decommission. This perspective often keeps the problem confined to technical departments. However, the landscape shifts dramatically when artificial intelligence applications are layered onto these existing, often fragile, infrastructures. At this juncture, technical debt ceases to be merely an operational burden and begins to accrue substantial regulatory interest, a form of liability that, unlike conventional financial interest, typically manifests through official correspondence and legal scrutiny.

McKinsey's research underscores the significant financial implications of this technical debt, revealing that Chief Information Officers estimate between 10% and 20% of their technology budgets, initially earmarked for new product development, are instead diverted to address these underlying issues. Furthermore, the total value of this technical debt can represent 20% to 40% of the technology estate's worth before depreciation. Beyond the financial drain, the core legal challenge isn't just the potential for system failure; it's the organization's inability to substantiate crucial data attributes. This includes proving the origin of data, confirming that consent covers its current use, determining appropriate retention periods, tracking who made modifications, and tracing its movement across systems. Feeding such uncertain data into automated decision-making processes can result in outputs that appear precise but are built upon foundations as unstable as those from the era of BlackBerry devices.

Effective AI governance is fundamentally predicated on robust data provenance, which demands a clear understanding of where data originated, how it has been processed, and whether it remains lawful and suitable for its intended purpose. This seemingly straightforward requirement becomes immensely complicated when an organization's history includes multiple corporate acquisitions. For instance, a scenario where Company A acquires Company B, which previously acquired Company C, and Company C had migrated customer records from an undocumented platform with corrupted PDF archives, creates a convoluted data lineage. An AI tool, however, perceives only rows and columns, proceeding with its analysis without inherent awareness of this complex corporate genealogy.

The increasing stringency of global regulations, such as the EU AI Act, makes ignoring this data lineage progressively more difficult. Specifically, for high-risk AI systems, Article 11 of the Act mandates comprehensive and up-to-date technical documentation that explicitly demonstrates compliance. Moreover, Annex IV delves into granular details, requiring information on system architecture, third-party tools, various versions, interfaces, and critically, the provenance and characteristics of the datasets utilized. This regulatory framework demands far more than a superficial policy; it necessitates a detailed "family tree" of data, including all its historical complexities. The UK Information Commissioner’s Office also plays a role in shaping AI-related compliance expectations, further emphasizing the need for meticulous data management.

Lawyers and compliance officers must advise clients on the significant legal and regulatory risks arising from integrating AI with legacy IT systems, particularly concerning data provenance, consent, retention, and auditability. Proactive due diligence on existing data infrastructure and robust technical documentation are crucial to mitigate exposure under evolving AI regulations.

Source: Original reporting via industry insights.