Congress Wants Federal Agencies to Retire Legacy IT. The Fine Print Matters to Every Government CIO

Governments have been promising to retire their oldest, riskiest IT systems for decades. A bipartisan group of US lawmakers has just introduced another attempt to force the issue, and the history behind that attempt is worth the attention of any technology leader in the public sector, in any country, because the pattern it reveals is not unique to Washington.

What the bill actually requires

The Legacy IT Reduction Act of 2026 (H.R. 8408), introduced in April by Representatives Maxwell Frost, William Timmons, Eric Burlison and Byron Donalds, would require every federal agency’s chief information officer to complete a full inventory of legacy technology still in use within a year of the law taking effect (Congress.gov). Agency heads would then need to produce five year strategic plans covering what to update, modernise, retire or dispose of, including cost estimates, capacity assessments and an analysis of what breaks downstream if a given system is touched. The Office of Management and Budget would issue guidance defining what counts as legacy IT, and the federal CIO would set common templates so agencies are not each inventing their own methodology (FedScoop).

On paper, this is sound structure. Inventory before you plan, plan before you fund, and tie funding to a documented rationale rather than a vague sense that something is old. The difficulty is that this is not the first time Washington has legislated exactly this sequence.

Why the last mandate did not finish the job

In 2019, the Government Accountability Office identified ten critical federal legacy systems most urgently in need of modernisation. By February 2025, six years later, agencies had completed just three of the ten. Of the seven still outstanding, four had a planned completion date within a few years, two were more than five years out, and one had no completion date at all (GAO-25-107795). GAO also found that only three of the eleven agencies responsible for these systems had modernisation plans covering all the key practices needed for success. The rest were missing pieces such as milestones, funding sources or a documented plan altogether.

That gap between identifying the problem and actually closing it is the real story here, more than the new bill itself. Federal agencies spend roughly 80 percent of their annual IT budget, out of more than 100 billion dollars a year, simply operating and maintaining what already exists, which leaves comparatively little for the modernisation work everyone agrees is overdue (GAO). A CIO inventory requirement does not change that arithmetic on its own. It only forces the numbers into the open.

This is not a uniquely American problem. The UK government pushed back its own timeline for gathering a complete picture of legacy technology use to autumn 2026, and a recent review found the number of high risk legacy systems across more than 100 UK public bodies rose by 26 percent between 2023 and 2024 despite prior remediation investment. Any government or large regulated organisation carrying decades old core systems will recognise the same structural bind: the systems are too critical to switch off carelessly, too expensive to properly replace in one budget cycle, and too easy to defer again when the next crisis takes priority.

The cost is not nostalgia, it is risk and opportunity

The case for modernisation is usually made on cost grounds, and the cost case is real. But the more urgent argument is risk. Ageing systems accumulate cybersecurity exposure as vendor support lapses and the pool of people who understand the underlying technology shrinks. They also constrain what an agency or enterprise can realistically do with newer capability, including AI, because most modern tooling assumes a level of integration and data accessibility that a decades old core system was never built to provide.

An inventory tells you what you have. It does not tell you which systems will actually get funded, staffed and finished. That gap is where every legacy modernisation programme has historically failed.

What actually closes the gap

Organisations that succeed at this tend to depart from the standard playbook in a few specific ways.

• Every system on the list gets a single accountable owner, not a committee, with modernisation tied to their performance objectives rather than treated as a side project.
• Sequencing follows risk and dependency, not age. The oldest system is not necessarily the most dangerous one to leave running; the one with the fewest people who understand it, or the widest blast radius if it fails, usually is.
• Funding is secured for the full multi year effort up front, or broken into funded phases with real deliverables, rather than approved a year at a time and vulnerable to the next budget cycle.
• Replacement systems are designed around the business capability, not a copy of the old system’s logic, which is where many modernisation efforts quietly fail even after the money is spent.

Where Jaykan fits

Jaykan works with government agencies and large regulated enterprises on exactly this kind of legacy modernisation, from the initial system inventory and risk assessment through to designing and delivering the replacement architecture, without disrupting the services citizens and customers depend on every day.

If your organisation has legacy systems that keep appearing on the same list year after year without progress, a complimentary, senior led assessment will give you a clear, prioritised view of what to tackle first and a realistic plan to get it done.