There’s a number that tends to get quietly skipped over in conversations about public sector technology. Ninety-seven percent.

That’s the share of the annual policing technology budget in England and Wales that goes on maintaining existing systems, according to the National Audit Office. Not on transformation. Not on AI. Just on keeping the lights on.

It would be easy to read that as a policing problem. It isn’t. Across public services more broadly, major departments spend as much as 75 to 80% of their technology budgets on upkeep rather than modernisation.

The pattern repeats itself at every level of government. Scotland has articulated a clear ambition for where it wants to get to – a public sector that takes a system-wide view, delivers shared digital services designed around the people who use them, and moves away from the isolated, siloed approaches that have defined much of the last two decades. That aspiration is the right one. The question is what it takes to get there from where most organisations actually are and whether they have an honest picture of that before they start.

Legacy is a risk profile, not a backlog

Legacy technology is rarely described accurately. It tends to get framed as a backlog, something that accumulated through neglect or short-term thinking, that can be addressed given enough time and budget. That framing is too forgiving. Legacy is better understood as a risk profile. It’s operational fragility – systems that can’t be changed quickly when services need to adapt. It’s cyber exposure – end-of-life platforms that represent known vulnerabilities in critical infrastructure. And it’s friction – the drag that makes every new initiative harder, slower and more expensive than it should be.

What makes legacy application migration specifically difficult is that this friction isn’t only technical. Legacy persists because of procurement constraints and long-running contracts that make change legally and commercially complicated.

It persists because of:

  • Data – decades of information stored in formats that were never designed to be portable.
  • Skills – the people who understand these systems most deeply are often approaching the end of their careers and that knowledge isn’t always documented anywhere it can be found.
  • Shadow IT – the locally-built tools and unsanctioned applications that teams have quietly come to depend on, which often don’t appear in the formal estate at all.

Until you have an honest picture of all of that, legacy application migration tends to go wrong in predictable ways.

Why wholesale replacement rarely works

The instinct to replace, to draw a line under the past and start again, is understandable. But in live public service environments wholesale replacement is rarely viable. The systems being replaced are usually the ones that people depend on, often continuously. There is no quiet period. It’s like rebuilding a ship while it’s still at sea.

The approach that actually works looks quite different. Rather than replacing legacy, the more practical path is to integrate, isolate and increment.

  • Integrate – build the connective tissue, APIs and middleware, that allows newer capabilities to work alongside existing systems rather than waiting for those systems to be gone.
  • Isolate – identify the components that carry the most risk and contain them in a way that limits the damage if something fails.
  • Increment – change in stages, validating at each step, preserving continuity while steadily reducing the technical debt that makes everything harder.

This isn’t a counsel of caution. It’s a recognition that in complex service environments, the risk isn’t only in the legacy. It’s in how you approach changing it.

AI raises the stakes

None of this would matter quite so much if the conversation had stayed where it was five years ago. But it hasn’t. Public sector organisations across Scotland and the rest of the UK are now being asked, often urgently, to deliver on AI. However, AI in a live service environment is only as good as the foundations it sits on.

This is where the legacy application migration question and the AI question converge, and where the stakes get higher. The pattern we see most often is what might be called the ‘pilot trap’. An AI initiative is stood up with enough resourcing and careful scoping to demonstrate genuine value. The demonstration succeeds. The work of scaling it into a live service environment begins, and then it encounters the estate that the pilot was designed not to engage with. The result, more often than it should be, is an initiative that works in theory and stalls in practice.

The data quality problem sits at the heart of this. Legacy systems are frequently the custodians of decades of institutional knowledge, but that knowledge is stored in ways that reflect the technology and practices of the time it was captured. Fields that mean different things in different systems. Records that were never reconciled when organisations merged or restructured. Teaching a model to work with data in this condition produces outputs in the same condition, if not worse.

There’s a governance dimension that deserves equal attention. AI in public services isn’t a back-office efficiency question. It involves decisions that affect people’s lives, often people who are already in difficult circumstances.

Getting the human oversight right, building audit trails and ensuring accountability – these shouldn’t be constraints on AI adoption. They’re the conditions under which it can be trusted.

Innovation depends on foundations

What this adds up to is a reframing that I think is more useful than the one that dominates most technology conversations.

Productivity and innovation in public services are systems problems, not technology problems. The blockers, weak digital foundations, innovation that can’t get beyond the pilot stage, delivery that’s fragmented across teams, aren’t solved by a better model or a more ambitious strategy.

They’re solved by the patient, precise work of understanding what you have, reducing the risk it carries and building the integration layer that allows new capabilities to operate in the real world.

The organisations that have done that foundational work are the ones where the pilots are starting to become programmes. The potential is real. The question is whether the foundations exist to catch it when it scales.

Scotland’s digital ambition is achievable. But the path to a system-wide, citizen-centred public sector runs directly through the legacy estate, not around it.