How Ankur Kalohia is using AI-assisted reverse engineering and business-rule recovery to help reduce the risks of mainframe modernization
Mainframe modernization is often described as a technology migration: moving applications to cloud infrastructure, replacing legacy databases, exposing APIs and retiring aging platforms. For Ankur Kalohia, Director of Global Delivery Management at EPAM Systems, the most consequential work begins earlier—with recovering the business knowledge embedded in systems that have been running for decades.
“After years or decades, the code becomes the living record of the business. Before you modernize, you have to recover that meaning.”
— Ankur Kalohia
That idea connects Kalohia’s research and industry work. His work explores how organizations can recover requirements and business behavior from COBOL and PL/I systems, turn those findings into traceable business rules, and use the resulting code intelligence to plan the transition from legacy platforms to cloud-based environments.
Modernization begins with understanding the system
In large financial, insurance, government and logistics environments, business logic is rarely contained in one place. It may be spread across COBOL programs, PL/I modules, copybooks, JCL, database statements, batch controls, message queues, shared utilities and years of exception handling. Documentation may be incomplete or outdated, and the people who originally designed the systems may no longer be available.
That creates a practical barrier to modernization. Without a clear understanding of existing rules, data flows and dependencies, teams may struggle to estimate scope, define service boundaries, sequence migration waves or demonstrate that a new system behaves like the original. A missed condition can affect a customer outcome; an overlooked dependency can delay a cutover; and incomplete data lineage can introduce reporting, reconciliation or regulatory risks.
Kalohia also addressed the business case for modernization in a 2025 EPAM article on return on investment. It compares rehosting, replatforming and refactoring or rearchitecting, considering infrastructure costs, labor, tools, adoption, support and long-term agility.[3]
Turning code into specifications people can review
In his ACL 2026 Industry Track paper, “Leveraging Generative AI for Extracting Business Requirements from Legacy COBOL and PL/I Code,” Kalohia describes a reverse-engineering pipeline that combines deterministic parsing with large language models. Grammar-based parsing, control-flow analysis and data-flow analysis first create an enriched representation of the code. AI generation constrained by a defined schema then uses that evidence to produce business requirements documents, rule catalogs, end-to-end lineage, CRUD matrices and field-level source-to-target mappings, with traceability back to the supporting code.[1]
The paper reports an evaluation involving a financial-industry COBOL estate with more than 3.4 million lines of code, including comments, or approximately 3.2 million lines excluding comments. The pipeline achieved 93% agreement with expert-authored business rules, reduced documentation effort by about 70%, and completed analysis approximately 3.2 to 3.3 times faster than manual approaches, while improving consistency and traceability.[1]
A related EPAM SolutionsHub article, co-authored with Siarhei Liubushak, applies the research to enterprise modernization. It describes how extracted rules, record flows, dependency views and data mappings can give business analysts and architects a structured basis for decisions, rather than relying on a general natural-language summary of legacy code.[4]
“The goal is not to replace human experts. The goal is to give them a better starting point.”
— Ankur Kalohia
Recovering business rules with evidence
For Kalohia, producing a readable description of code is only part of the task. Business-rule recovery for modernization requires a more rigorous standard: each rule should identify the decision being made, the conditions under which it applies, its resulting effect, the technical context needed for execution and the source evidence supporting every clause.
His working manuscript, “Deterministic Identification and Recovery of Business Rules from COBOL Programs,” proposes an evidence-based approach to reconstructing decisions across programs and artifacts. The framework aims to preserve COBOL-specific storage and numeric behavior, distinguish business predicates from technical checks, expose unsupported dependencies and verify recovered rules against observable program behavior. In this approach, generative AI can improve naming and readability, but it does not determine the meaning of the rules.[5]
The distinction is especially important in regulated or high-consequence systems. A fluent explanation can omit a threshold, merge independent conditions or introduce a plausible but unsupported relationship. Deterministic analysis provides repeatability and evidence; human review contributes domain judgment; and constrained AI can make the results easier to use. Kalohia’s work treats these elements as complementary.
Planning the transition, not just the destination
Recovering system knowledge addresses only one part of modernization. Organizations must also determine how to move from the current environment to a target architecture without interrupting critical operations. Kalohia’s IEEE Access article, “Transitional-State Architectures for Hybrid Mainframe to Cloud Modernization With AI-Derived Code Intelligence,” examines the period when legacy and cloud workloads must operate together. Drawing on evidence from two anonymized, multiyear programs, the paper explores how dependency graphs, data flows and domain clusters can inform strangler patterns, carve-out sequencing, integration boundaries and network segmentation.[2]
The research proposes a taxonomy of AI-informed transitional patterns, decision heuristics that connect code-level evidence to architectural choices, and a reusable evaluation framework. It also considers measures of transition health beyond schedule and budget, including cutover risk, batch-window compliance, incident rates and cross-domain coupling—indicators that can help show whether a hybrid environment is becoming safer or more fragile over time.[2]
This creates a link between reverse engineering and architecture. Recovered business rules can become acceptance criteria; dependency graphs can inform migration sequencing; lineage can clarify data ownership; and CRUD analysis can identify which applications control critical records. Generated tests can also help teams compare the behavior of a target system with the legacy application while the original remains available as an operational reference.
“Discovery is no longer just an inventory exercise. The information recovered from the legacy estate can affect transition planning, integration design, migration sequencing and retirement decisions.”
— Ankur Kalohia
Research shaped by delivery realities
Kalohia’s research reflects the constraints that determine whether enterprise AI can be used in practice: security reviews, customer-network restrictions, deployment requirements, programming-dialect and grammar coverage, dead-code handling, traceability, human validation and governance. These considerations help explain why his approach combines deterministic program analysis with AI instead of relying on a general-purpose model to interpret raw code on its own.
The same delivery perspective informs his view of modernization strategy. Rehosting can reduce infrastructure costs while preserving structural limitations. Direct language conversion can move code without recovering a maintainable business design. A full rewrite may create a cleaner future state, but it can be risky when requirements are incomplete. Kalohia’s work focuses on the bridge between these options: recovering evidence from the existing system, turning it into governed specifications and rules, using that knowledge to define transition boundaries, and verifying the new implementation against the behavior that matters.
A broader definition of modernization
Debates about mainframes often focus on whether organizations should remain on the platform or move away from it. Kalohia’s work points to a more immediate question: does the organization understand the business capabilities, decisions and dependencies that the platform currently supports? Without that understanding, either strategy can become expensive and risky.
His research frames modernization as an exercise in preserving knowledge as well as transforming technology. The result is not simply converted code, but a body of evidence—requirements, rules, lineage, dependency models, tests and architectural decision inputs—that can help organizations change platforms without losing institutional knowledge accumulated over time.
For organizations preparing to modernize large legacy environments, the implication is straightforward: the process should not begin with a target programming language or cloud service. It should begin by determining what the current system knows, how reliably that knowledge can be recovered, and how it will be carried through each stage of the transition.
About Ankur Kalohia
Ankur Kalohia is Director of Global Delivery Management at EPAM Systems, an IEEE Senior Member and a technology leader focused on mainframe modernization, AI-assisted software engineering, reverse engineering and hybrid mainframe-to-cloud transformation. He presented his code-to-specification research at the ACL 2026 Industry Track and published his research on transition-state architecture in IEEE Access. He is based in the Greater Pittsburgh region.
