COBOL wasn't supposed to be a 2026 story. The programming language turns 67 this year, most universities stopped teaching it in the 1990s, and for two decades the standard industry take assumed that it would quietly age out. Instead, COBOL’s back in the headlines because the two forces bearing down on it have finally collided: the people who understand COBOL are retiring, and AI has become capable enough to be pointed straight at the code they're leaving behind.
This confluence of factors is driving genuine investment, but most of its coverage is fixated on the wrong angle. Businesses and government agencies alike want to understand whether AI can write and translate COBOL. The harder question, and the one that actually decides whether any of this is viable, is who verifies what the AI produces before, for example, it runs the payroll for a state government or clears a few billion dollars in overnight settlement.
COBOL's comeback is a survival move
This isn't a hype cycle, but rather triage, and the systems in question are load bearing for the economy. According to reporting by Reuters, an estimated $3 trillion in daily commerce flows through COBOL systems, with roughly 220 billion lines of code still running in production. Those figures are order-of-magnitude estimates from 2017, but nobody disputes the shape of it: banks, insurers, airlines, and government agencies like the IRS and the Social Security Administration still run core operations on COBOL. When several U.S. states sought out COBOL developers during the 2020 unemployment surge and couldn't find them, that wasn't a fluke, but instead a preview of what was to follow in the coming years.
The workforce math is central to this problem. The engineers who wrote and maintained these systems are reaching retirement, and the pipeline behind them dried up 30 years ago. Organizations aren't investing in COBOL because it's novel, they're investing because the alternative involves losing the institutional knowledge encoded in millions of lines of code that few engineers fully understand anymore, and that they cannot afford to get wrong. When assigned to COBOL, that's the context AI walked into.
Can AI write and translate COBOL code?
The most valuable thing AI does with COBOL isn't writing new code, it's explaining old code. Business-rule extraction, pointing a model at an undocumented paragraph and getting back a plain-language description of what it does, attacks the exact problem the retirement cliff creates. Knowledge that lives in one senior engineer's head can be surfaced, documented, and preserved before that engineer retires.
From there, AI accelerates the work that historically stalled COBOL modernization:
- Translation — agents can rewrite COBOL business logic into modular components or modern languages like Java, producing a first draft in a fraction of the time that a manual port would take.
- Testing and debugging — models generate test cases against existing behavior and refactor tangled procedures into something more legible.
AI compresses the understanding phase, which is the part that used to make COBOL modernization cost more than it was worth. The shift is monumental, and it's why the market suddenly cares about a language it had once written off.
What are the risks of using AI to modernize COBOL systems?
AI output is often a draft, not a finished product: a translation can look right but behave differently in subtle ways, or quietly reproduce the insecure patterns models pick up from their training data. And agents produce those mistakes at a scale and speed no human review process was designed to absorb. In an ordinary web app, you catch those in staging; in a benefits-disbursement system, you catch them when the checks are wrong.
Now layer another problem on top: the people qualified to catch these mistakes are the same people who are exiting the workforce. The COBOL expertise shortage isn't only a code-writing problem, but also a code-reviewing problem. Every argument in favor of using AI (because human experts are scarce) is also, quietly, an argument that there are fewer humans left to verify what the AI wrote. The shortage doesn't just create the need for automation, it removes the safety net underneath it.
There's a more hopeful reading too, but one which also points toward verification: in the case of COBOL, agents can make good teachers. They help explain unfamiliar code, so a developer who has never before opened a COBOL program can become productive in weeks instead of months. Understandably, however, the developer learning COBOL with an AI agent is not as well equipped to notice when that agent is subtly wrong, and lowering the barrier to writing COBOL merely grows the pool producing it faster than the pool that can vouch for it.
Such are situations where more code is being generated faster, by tools that make subtle errors, headed into systems that genuinely cannot fail, reviewed by a shrinking pool of experts. That gap between how fast code is produced and how fast it can be verified is the real bottleneck in COBOL modernization: not generation, but trust.
SonarQube: the verification layer for COBOL
SonarQube analyzes COBOL directly, with nearly 200 rules covering reliability, security, and maintainability issues across 10 COBOL dialects, reaching into the embedded DB2 SQL and CICS statements where real mainframe logic actually lives. When an issue spans more than one spot in the code, the analyzer highlights each location, and its rules carry remediation guidance, so a fix is legible even to someone who isn't a 30-year COBOL veteran.
SonarQube analysis doesn't care who wrote the code, so a quality gate applies the same pass-or-fail bar to a retiring expert's hand-written paragraph and an agent's freshly translated module. The goal is to verify all code, whether it's first-party, AI-generated, or open source. For COBOL specifically, this neutrality is the point: when there aren’t enough human reviewers to keep up with what your agents produce, a deterministic analysis layer becomes the consistent second set of eyes, except that it doesn't retire, it doesn't skim, and it checks every line the same way, on every commit.
Consider a small, familiar example: an EVALUATE statement with no WHEN OTHER branch silently ignores every value that it wasn't explicitly told to handle. A rushed reviewer scrolls past it, and an AI agent translating a paragraph reproduces the omission without a second thought. Static analysis flags the unhandled case every single time, before it becomes the edge case that only ever lived in an expert’s memory. Multiply that across a modernization program running thousands of files, and the value of an automated bar that never gets tired becomes glaringly obvious.
Practically, the capability spans the products you'd already reach for: COBOL analysis is available in SonarQube Server (Enterprise Edition) and SonarQube Cloud (on an Enterprise plan), with in-editor feedback through SonarQube for IDE in connected mode. You extract the source to a filesystem and analyze it where the rest of your quality checks already live.
Accelerate with AI agents, verify with SonarQube
Strip away the COBOL specifics and you’ll reveal the broader direction of modern software development: agents generate, and an independent layer verifies. It's the pattern Sonar calls the Agent Centric Development Cycle, where verification is mandatory, not optional, and is grounded in deterministic analysis (rather than asking a model to grade its own homework). COBOL represents a vivid proof case: the oldest and (arguably) highest-stakes code in the world, now being touched by the newest tools. AI didn't remove the need for rigor in COBOL; it raised it, and moved it to the verification layer.
If your organization is modernizing COBOL with AI in the loop, the question to answer before you scale it isn't whether the agents are fast and capable, but instead whether every line they produce has to clear the same gate as everything else. That gate is the difference between modernizing with confidence, and shipping expensive surprises into systems that were never allowed to have any.
Where to go next
- SonarQube COBOL analysis — supported dialects, rule coverage, and how COBOL analysis fits your pipeline.
- SonarQube Server COBOL docs and SonarQube Cloud COBOL docs — configuration, dialects, and embedded SQL/CICS setup.
- Verify AI-generated code with Sonar — how the same verification bar applies to AI-generated and developer-written code.
- The future is AC/DC — why an independent verification layer is the center of gravity in agent-driven development.
