How Do I Inventory My Legacy Systems Before Deciding?

You inventory your legacy systems with one page per system answering 7 questions: owner, users, data and whether it includes personal data, connections, what stops if it stops, license renewal dates, and the technology and its end of support. Then you give each system one of 5 decisions: keep, retire, replace with a ready-made product, move as is to the cloud, or rebuild, a simplified version of the 7 strategies in Amazon's official migration guide. AI speeds up the technical half, but it cannot tell you who owns a system.

In part 2 you scored each system out of 8. The score shows the risk; the inventory gives you what you need to decide.

What goes on each system's page

You do not need special software to start. A simple table is enough, as long as it answers these questions for every system:

• Owner: one named person who decides about the system on the business side, not the IT department. If you cannot find one, that is the first finding of your inventory.
• Users: which departments use it, roughly how many people, and whether customers or suppliers outside the company use it too.
• Data: what it stores, whether that includes personal data about customers or staff, and where it actually lives: a server in the office or a cloud, and in which country.
• Connections: where its data comes from and where it goes: invoicing, the bank, the online store, payroll, an Excel file exported every week.
• Impact of an outage: what happens if it stops for a full day: do sales stop, is payroll late, or does nobody notice?
• Licenses and contracts: who you pay, when the contract renews, and whether there is a notice deadline before renewal. The renewal date often sets when your decision must be ready.
• Technology and support: the programming language, database and operating system, and when support for each ends, as we saw in part 2.

If the inventory shows that some of your real systems are spreadsheets the daily work depends on, we explained how to inventory them in which sheet is the system.

The data question: do not skip it

The personal data column matters more than any other, because it changes the decision. A system that stores customer names and phone numbers or employee records falls under the Personal Data Protection Law, overseen by the Saudi Data and AI Authority (SDAIA), and moving or processing that data outside the Kingdom during modernization needs a review before it starts. We covered the practical obligations in our PDPL guide for businesses.

This touches the modernization tools themselves. For example, the official Regions page for AWS Transform lists 9 Regions where workspaces can be created, none of them in the Middle East, and warns that data may be processed in a Region other than the one you work from. According to the Saudi Press Agency on 1 September 2026, Amazon announced that its first cloud Region in the Kingdom is on track to launch in December 2026. So write down where each system's data sits today, so you know which tools can read it without a problem.

How AI speeds up the inventory, and what it cannot know

The technical half of an inventory used to take weeks of checking servers and reading code by hand. Today's tools read servers and code and map the connections between them automatically. One example among many: Amazon says on the AWS Transform page that its agents automate migration from discovery and wave planning through to cutover, and that its mainframe assessment compresses months of discovery into hours. That is Amazon's claim, not a guaranteed result. Its pricing page currently lists assessment among the free agents.

Amazon's migration guide also gives practical signals for spotting systems you can retire, using the data from the discovery tool itself:

• A system whose average CPU and memory use is below 5 percent is what the guide calls a zombie application.
• A system using between 5 and 20 percent over 90 days is what it calls an idle application.
• A system with no inbound connection in the last 90 days is a candidate for retirement.

But the tool does not know who owns the system, when its contract renews, that the one employee who understands it retires next year, or that a single annual zakat report comes out of it. That comes from a short interview with each system's owner and users. The machine fills the technical columns; people fill the business columns.

The five decisions for each system

After the inventory you give each system one decision. This is a simplified view of the seven strategies in Amazon's guide:

The guide warns that rebuilding is the most complex and costly option, and for large migrations it recommends moving the system first and modernizing it after the move is complete. If your decision is the cloud, start with our guide to moving to the cloud for Saudi businesses.

The Origami view

We build systems, connect them and modernize old ones, and still we start every modernization project with the inventory, not the code. A system whose connections you do not know can break something you cannot see until a customer complains, and the inventory often shows that the right decision for many systems is to keep or retire them, not rebuild.

So we use AI tools to read servers and code and map the connections quickly, then sit with each system's owner to fill in what the tool cannot know, and come out with one decision per system and a clear order to start. If you want to see how we work, take a look at our services.

This week's exercise: one page per system

Take the systems that scored 6 out of 8 or more in part 2's exercise, and fill in this table for each one on a single page:

Write the decision in pencil. It stays provisional until you know which rules live inside the system, and that is the subject of the next part.

Coming next

You now have an inventory and a provisional decision for each system. But the systems you decided to rebuild hide their most valuable asset: the real business rules for discounts, prices, late fees and approvals, buried in the code and in people's heads. In part 4 we explain how AI extracts those rules from your old system and writes them as clear specifications, and why the person who owns each process must confirm every rule before any new code is written.

Sources

• AWS Prescriptive Guidance: the seven migration strategies — retain, retire, repurchase, rehost, relocate, replatform and refactor, and the 5 percent, 20 percent and 90-day signals.
• AWS Transform: official service page — discovery, wave planning and mainframe assessment.
• AWS Transform: pricing — assessment currently listed among the free agents.
• AWS Transform: supported Regions — 9 Regions; data may be processed in another Region.
• Saudi Press Agency: AWS Region in the Kingdom in December 2026.
• SDAIA: Personal Data Protection.