Merit Data & Technology

Tharun Mathew

Data Architecture Advisor

There is a conversation happening in almost every boardroom right now that rarely gets challenged directly. It goes like this: we need an agentic AI strategy, so let us find the right agents and get them deployed. The infrastructure question gets asked later, if it gets asked at all.

In my experience working with organisations across data engineering, legacy modernisation and AI deployment, this is where most agentic AI programmes quietly start to fail. Not the model. Not at the use case. At the foundation nobody stopped to check first.

The research backs up what I see on the ground. A recent Forrester study found that 94 percent of IT leaders rank modernisation as a top priority for their AI strategy, yet only 43 percent of their application portfolios have been modernised on average and just 32 percent are considered genuinely AI-ready. That gap between ambition and readiness is not a rounding error. It is the majority of the enterprise technology estate.

Built for a job that no longer exists

What I see consistently when I trace the root cause is that legacy infrastructure was built for a different job entirely. Databases designed for predictable, human-paced transactions. Application layers built to serve one system at a time. Batch pipelines that update overnight rather than in real time. None of this was wrong for its original purpose. None of it was built to support an autonomous agent that needs to reason across live, connected data and take an action based on what it finds.

The financial case for fixing this is no longer theoretical. McKinsey estimates technical debt now accounts for 20 percent  to 40percent  of total technology estates at large enterprises, with another 10 percent  to 20 percent of new product budgets consumed by legacy-related remediation. IDC research found that 47 percent  of IT leaders point to technical debt as a major driver of cloud and infrastructure overspend. Forrester's Q1 2026 modernisation survey went further, finding that 35 percent  of modernisation projects stall specifically because of legacy constraints and 65 percent  cite security and compliance as the biggest blocker of all. Technical debt does not sit quietly on a roadmap. It compounds every quarter it is left unaddressed. 

Why GenAI forgave your infrastructure and agentic AI will not

This is the distinction most strategies still miss and it is the reason the same infrastructure that quietly supported generative AI is now the thing quietly breaking agentic AI.

Generative AI was, structurally, a forgiving guest. A chatbot pulling answers from a document store operates in a single direction: read, retrieve, respond. It could tolerate a messy schema, a stale table, an inconsistent permission model underneath it, because the worst outcome was an imperfect answer that a human would read and sanity-check before acting on it. The infrastructure never had to be correct. It only had to be available.

"The constraint has moved from which model to use to which foundation can actually support one."

Agentic AI inverts that entirely. It reads, reasons and then acts, updating a record, triggering a workflow, coordinating across systems, without a human in the loop at each step. That single shift changes everything it needs from the infrastructure beneath it:

• Structure, not just storage. A GenAI chatbot can retrieve a loosely-labelled document and still produce a passable answer. An agent deciding whether to trigger a workflow needs to know, unambiguously, what a field means, what system owns it and whether it is current or it acts on the wrong version of the truth.

• Permissioning at the point of action, not just the point of access. Read access to a system is not the same as safe write access to it. Legacy permission models were built around who could view data, not around what an autonomous process is allowed to change and that gap is where agentic deployments quietly create risk nobody signed off on.

• Real-time state, not overnight batches. An agent reasoning over data that is twelve hours stale will confidently act on a version of reality that no longer exists. GenAI could absorb that lag. Agentic AI cannot, because the action it takes lands in the live system immediately.

There is no longer a human buffer between a bad answer and a bad outcome. Deloitte's research makes the shift explicit: nearly 60 percent  of AI leaders now name legacy-system integration as the primary barrier to agentic AI adoption, ahead of talent, budget or even model choice. The constraint has moved from which model to use to which foundation can actually support one.

The five-step blueprint: how modernisation-ready CIOs are sequencing this

The organisations I have seen close this gap successfully share a pattern. They do not attempt a full infrastructure replacement in one move. They sequence modernisation deliberately, starting with the systems agentic workloads will actually touch first.

1. Audit before you migrate.
A structured audit comes before any migration decision. Mapping technical debt, application dependencies, security gaps and data quality is what allows a CIO to prioritise, rather than modernising everything at once and hoping the important parts get covered. Skip this step and modernisation becomes guesswork dressed up as strategy.

2. Fix the data layer before the agent layer.
Legacy systems often lack the semantic metadata an agent needs to understand intent rather than just retrieve a record. That is a data engineering problem and it has to be solved before an agent goes live, not after something goes wrong. An agent deployed on top of an unfixed data layer will look like it is working right up until it acts on the wrong record.

3. Build governance into the modernisation, not on top of it afterward.
Given that security and compliance is the top modernisation blocker, infrastructure work should produce auditable, traceable data lineage from day one. Retrofitting governance later means re-auditing everything the agent has already touched.

4. Phase the rollout around your highest-value workloads.
McKinsey's research shows enterprises that paired technical debt reduction with targeted modernisation saw operational overhead drop 30 to 50 percent, with materially faster development cycles. The organisations seeing returns are not modernising everywhere at once. They are sequencing investment around the specific processes agentic AI will touch first, so early wins fund and justify the phases that follow.

5. Design the architecture for reuse.
Modernisation done application by application, without a shared data and governance layer underneath it, just recreates the same fragmentation one level up. A reusable architecture means the second and third agentic use cases are faster to deploy than the first, not equally slow.

Where the foundation actually gets built

This is where our work at Merit Data & Technology sits. We approach legacy modernisation as the foundation agentic AI depends on, not a separate workstream running alongside it.

Our data engineering work is built to establish the structured, governed layer that agentic systems actually need. Three capabilities sit underneath everything else we do here:

Clean ingestion pipelines that turn fragmented, legacy-format data into a consistent, semantically-labelled layer an agent can actually reason over, so the "structure, not just storage" problem above gets solved before an agent is ever deployed on top of it.

Auditable lineage that traces every record back to its source and every transformation it went through, so when an agent takes an action, that action can be reconstructed and defended, not just observed after the fact.

Deterministic orchestration across multiple models, so agentic execution is repeatable and accountable rather than a black box that behaves differently run to run.

None of these are add-ons applied after modernisation. They are what modernisation has to produce if it is going to hold an agent safely. An agent running on infrastructure that is modernised but ungoverned does not remove the original risk. It just relocates it, from a legacy system that failed slowly and visibly to an autonomous one that can fail fast and invisibly. And where an enterprise's modernisation effort also touches outreach or contact data, a live-researched approach removes the need to maintain a static, ageing dataset that eventually becomes its own modernisation problem.

The question every CIO should actually be asking

I have seen both halves of this go wrong independently. Infrastructure modernised without governance produces agents that act quickly and unaccountably. Infrastructure governed without being modernised produces agents that are safe but too constrained by what is underneath them to be genuinely useful. A real roadmap closes both gaps at the same time, not one after the other.

For any CIO reviewing their agentic AI strategy right now, the most useful question is not which agents to deploy first. It is whether the infrastructure underneath them was ever built to hold one.