TRAI Proposes AI Oversight Rules for Telecom Operators

Telecom entities would need internal artificial intelligence policies, system assessments and incident-reporting procedures under draft guidelines from the Telecom Regulatory Authority of India (TRAI). The regulator published the proposal for consultation on October 30, 2026; its consultation page lists November 27, 2026, as the deadline for stakeholder comments.

Under the draft, coverage would depend on both telecom authorisation and AI use. Entities licensed under the Telegraph Act, 1885, or authorised under the Telecommunications Act, 2023, would be covered if they use or plan to use AI to provide services or establish, operate, maintain or expand networks.

The proposal would place responsibility for AI outcomes on covered telecom entities regardless of whether systems come from internal development, external suppliers or a mixture of both. Each entity would need an internal AI policy approved by its board or equivalent governing body, with a designated officer approving AI use.

For individual systems, the draft proposes three risk ratings: low, medium and high. Classification would consider the system’s importance to networks or services, its financial and operational effects, and possible implications for consumers. Before deployment, new or modified systems would undergo validation, impact assessment and conformity assessment. The conformity review would examine fairness, explainability, accuracy, robustness, resilience to model drift and human oversight.

According to the proposal, appropriate human oversight and lawful, secure data handling would be required throughout deployed systems’ lifecycles. Entities would also need an established procedure for resolving harms reported by users within a reasonable timeframe.

The draft defines an AI incident as a malfunction, unintended outcome or unpredictable system behaviour capable of causing harm or breaching legal rights. It proposes four severity levels: low, moderate, high and critical. Entities would have to document, investigate and analyse incidents, follow predetermined harm-mitigation procedures and maintain a central incident database that also includes testing events. Notification to TRAI would be required for high- and critical-severity incidents, with reporting deadlines and format to be prescribed.

For organisational oversight, the draft would require an AI Governance and Safety Committee authorised by the board or equivalent body. A senior executive designated as AI Governance and Safety Officer would lead it. Reviews of deployed systems would take place at least annually, and the committee could require changes or decommissioning where necessary.

The proposed inventory requirement would encompass systems in operation, inactive systems and those decommissioned, with unlisted systems barred from use. Supplier provisions would require third-party due diligence and enforceable contract terms addressing compliance, inspection and audit rights, incident handling, allocation of risk and accountability.

In its risk assessment, TRAI’s draft identifies bias, adversarial attacks and unintended behaviour, including model drift, as potential problems where checks before deployment or oversight are inadequate. It states that these risks could affect the resilience of telecom infrastructure, especially critical components.

The draft places the telecom proposal within the broader India AI Governance Guidelines, which it says the government released in February 2026. It describes the proposed telecom framework as a sector-specific application of those guidelines. For violations involving AI systems, the draft refers to applicable law rather than specifying a new penalty.

* This article is based on publicly available information at the time of writing.