GAO's 2025 report on federal legacy systems (GAO-25-107795) checked on the 10 most critical federal IT systems it identified for modernization in June 2019. As of February 2025, three had been modernized, four were expected to be replaced within a few years, and two still needed five or more years — with one having no firm completion date at all. GAO found lackluster modernization planning for most of the remaining systems and recommended that Congress require agencies to maintain funded modernization plans.
Why does legacy IT persist?
The systems in question are not ordinary office software. They include platforms the IRS uses to process returns, systems at the departments of Veterans Affairs and Education, and other infrastructure that runs in programming languages such as COBOL, some of it decades old and operated by staff who are retiring faster than they are replaced. Agencies spend the largest share of their IT budgets — federal IT spending exceeds $100 billion a year — operating and maintaining these old systems rather than building replacements, because keeping the lights on is mandatory and modernization can be deferred.
GAO has also tracked the federal government's attempts to fund fixes directly: the Technology Modernization Fund had invested about $1.03 billion in 68 projects as of June 2025, though GAO noted the savings achieved have been small relative to that investment so far.
Related stories: Auditors to FAA: the air traffic upgrade is moving, but not fast enough · GAO found the Education Department scaled back oversight of its loan servicers.
What are the risks?
Aging systems raise three kinds of problems. Operationally, they fail more often and are expensive to patch. Security-wise, old software often no longer receives vendor updates, enlarging the attack surface GAO has flagged in its cybersecurity high-risk work. And practically, dependencies between systems mean one agency's modernization can stall waiting for another's — a recurring reason the same systems reappear in GAO reports year after year.
What happens next?
GAO wants Congress to require agencies to produce and maintain modernization plans with costs and schedules for critical legacy systems, and it continues annual reviews of agency IT budgets and the modernization fund. Agencies defending their budget requests now face direct questions about which systems remain on GAO's critical list and what their replacement timelines actually are.
What it means for you
Legacy IT is one reason online government services lag the private sector: delayed tax processing, pension calculation backlogs, and benefit portals that go down all trace back, in part, to decades-old systems. Each modernization project that finishes means faster processing and fewer manual fixes for the records that affect your taxes, benefits, and refunds. GAO's reports are the public scoreboard for whether those projects are actually moving.