What would India’s draft AI rules require from telecom operators? Inventories, testing and incident reports
TRAI’s consultation would make authorised telecom entities catalogue every AI system, assess it before deployment and report serious incidents. The framework is detailed, but it remains a draft and contains no evidence that operators already comply.
The short version
- What happened
- The draft applies to authorised entities using or planning to use AI in telecom networks or services; comments close on 27 November 2026.
- Who it affects
- People rely on telecom networks for ordinary communication, payments and access to public and emergency services. A documented complaint and incident process could make automated failures easier to trace, but only final rules, accessible redress and published outcomes will show whether users receive faster or fairer resolutions.
- What remains unproven
- Draft consultation
Keep in mind
Draft consultation
Not final rules
No implementation denominator
No incident count
No compliance audit
Reporting form and timeframe not yet specified
No measured consumer outcome
Source analysis · 2 linked sources. Primary analysed source date: 30 October 2026.
Read the full report · 4 min The evidence, methods, implications and limitations
Every AI system would have to be visible before it is used
India’s Telecom Regulatory Authority has opened a consultation on a sector-wide governance framework for AI used in telecom networks and customer services. It would cover authorised entities that use—or intend to use—AI in network operation, service delivery or both. Each operator would need a board-approved internal AI policy, classify systems as high, medium or low risk, and keep an inventory covering active, inactive and decommissioned systems. An AI system could not be used unless it appeared in that inventory, making undeclared deployments non-compliant with the proposed framework.
The proposal matters because telecom networks support emergency response, public services, commerce and other critical infrastructure. Before deploying or modifying a system, an operator would be expected to perform validation, conformity and impact assessments covering accuracy, robustness, explainability, fairness, resilience to model drift and human oversight. Third-party systems would not transfer responsibility: suppliers would face due diligence and contractual audit requirements, while the authorised operator would remain accountable for outcomes.[1][2]
Serious failures would create a regulatory reporting trail
The draft separates AI-system risk from incident severity. Operators would record every AI incident in a central database, investigate it and apply a predefined mitigation process. Critical and high-severity incidents—including material malfunctions and recurring failures—would have to be reported to TRAI. A separate database would track reports of AI-related harm to telecom users and how complaints were resolved. The regulator could then use incident information for sector-wide learning, risk assessment and preventive measures.
Oversight would sit with an AI Governance and Safety Committee led by a senior executive and spanning network operations, service delivery, IT, data, regulation and consumer affairs. At least annually, the committee would review system performance, incidents, fairness concerns and vulnerabilities, with power to recommend modification or retirement. Staff involved in human oversight would also need periodic training. For users, the practical promise is a clearer route from an automated failure to a record, investigation and remedy.[1]
The distinction that matters
From an AI system to regulatory accountability
The draft assigns different controls before deployment, during operation and after a failure.
Before use
Inventory, classify and assess
Board policy and named approval make the system visible
During use
Monitor, train and review
Human oversight and annual governance checks remain active
After failure
Record, investigate and report
Serious incidents reach TRAI and user harms enter a complaint record
The consultation leaves enforcement details and outcomes open
The document is a draft, not a completed regulation or an audit of present practice. It says policies should be filed with TRAI within seven working days of taking effect and that operators must retain evidence of compliance, but it does not yet specify the form or deadline for serious-incident reports. Nor does it provide a denominator for how many telecom AI systems exist, how many incidents have occurred, or how much compliance would cost. Comments close on 27 November.
The strongest next evidence would be a final instrument with defined reporting thresholds, dates and enforcement consequences, followed by public data on inventories, assessments, incidents and complaint resolution. Until then, the framework shows the controls India’s telecom regulator wants, not whether those controls work in live networks. Comparisons with other countries also need care: licensing powers, incident definitions and telecom-market structures differ, even when policy language sounds similar.[1][2]