TRAI Draft AI Telecom Guidelines: What India’s Proposal Means

What TRAI is proposing for telecom AI

The Telecom Regulatory Authority of India wants covered telecom entities to take responsibility for the AI they use throughout its lifecycle. Its draft combines internal policies, technical assessments, supplier contracts and incident records rather than treating an AI system as safe simply because somebody approved its purchase. [2]

The Ministry of Communications says the consultation seeks to apply the India AI Governance Guidelines to telecommunications. The sector-specific concern is practical: connectivity supports essential services, commerce and emergency response, so unreliable automation can have consequences beyond one app or chatbot. TRAI identifies risks including biased systems, changing model behaviour and adversarial attacks alongside AI’s potential efficiency benefits. [2] [3]

For Indian subscribers, the significance is clearer responsibility when AI contributes to a service problem. The proposal is not a promise of faster mobile data, cheaper plans or error-free customer support. Whether it improves everyday service would depend on the final requirements and how effectively operators implement them.

Which entities would be covered?

The proposed scope depends on telecom licensing or authorisation, not simply on whether a business develops AI. It includes entities holding a Telegraph Act, 1885 licence or a Telecommunications Act, 2023 authorisation to provide telecom services. It also includes entities authorised under the 2023 Act to establish, operate, maintain or expand telecom networks. In either case, the entity must be using or intending to use AI in telecom networks or service provision. [2]

That does not make this a blanket framework for every Indian AI startup, software developer or phone user. A technology supplier could nevertheless face more detailed questions from a covered telecom customer because the draft asks that customer to examine third-party AI and secure contractual safeguards. Those procurement effects are different from declaring every supplier directly covered by the draft. [2]

The draft’s definition of an AI system also extends beyond generative chatbots. It covers systems producing predictions, content, recommendations or decisions. Readers should therefore think about network operations and automated service decisions as well as customer-facing conversational tools. [2]

Board-approved policies would make responsibility explicit

TRAI proposes an internal telecom AI policy approved by the board of directors or an equivalent governing body. Each AI system would be classified as high, medium or low risk according to its importance to networks or services, its financial and operational impact, and its potential implications for consumers. Use would require approval by a designated officer, with delegation permitted according to risk. [2]

This is a risk-based approach, not a statement that every automated tool needs identical controls. A useful policy would connect each system’s consequences to the level of scrutiny it receives. The draft does not assign specific products to risk bands, so it would be premature to label a particular operator’s tool high-risk without an assessment.

An inventory would record active, inactive and decommissioned AI systems, including their source, purpose and risk classification. No system could be used outside that inventory under the proposal. This matters because an organisation cannot meaningfully supervise automation it has not identified. [2]

The proposed AI Governance and Safety Committee would bring together relevant functions such as network operations, IT, data management, regulatory affairs and consumer affairs. A senior executive serving as AI Governance and Safety Officer would lead it. Its review would cover deployed-system performance, incident records, vulnerabilities and fairness concerns, with corrective measures potentially including modification or decommissioning. [2]

Human oversight would need testing and operational support

The draft calls for appropriate human oversight of every AI system, with oversight informed by risk assessment. It also proposes validation, conformity assessment and impact assessment before a new system is deployed or an existing one is modified. These assessments would examine accuracy, robustness, explainability, fairness, resistance to model drift and human oversight. [2]

Model drift describes the problem of performance changing as the data or operating environment changes. A model that worked acceptably during an initial assessment may not remain reliable indefinitely. TRAI’s proposed reviews and incident analysis would help keep attention on behaviour after deployment, not only on a supplier’s original demonstration. [2]

The text does not say a person must approve every individual AI output. It asks for an appropriate, predefined oversight mechanism and periodic training for relevant staff. In practice, meaningful oversight would require people to understand a system’s limits and know when corrective action is necessary; a named committee alone would not establish that capability.

On data governance, the proposal requires lawful and secure handling of data used or generated across the deployed AI lifecycle, in line with applicable privacy, confidentiality, cybersecurity and other statutory requirements. It should not be read as permission to collect additional subscriber data merely because an AI system could use it. [2]

Buying AI would not outsource the operator’s accountability

One of the clearest proposals is that the applicable authorised entity would remain accountable for the outcomes of all AI systems it uses. That would apply whether the technology was developed internally, procured from a third party, outsourced or assembled through a combination of those arrangements. [2]

Before acquiring or using third-party AI, the entity would undertake due diligence covering supplier credibility, system soundness and limitations, and the suitability and quality of training data. It would also seek disclosures about AI embedded in telecom equipment, systems or solutions. This addresses the possibility that AI arrives inside a larger purchase rather than as a separately labelled product. [2]

Supplier agreements would need enforceable provisions covering regulatory compliance, audit and inspection rights, incident management, risk allocation and accountability before deployment. For vendors, the likely practical implication is a stronger need to explain limitations and support investigations. The draft does not establish that every supplier must publish its source code or reveal every model detail to the public. [2]

Incident reporting and complaints would become part of AI governance

TRAI proposes four incident-severity categories: critical, high, moderate and low. All AI incidents, including those arising during testing, would be recorded in a central database. Entities would mitigate disruptions through predefined procedures, investigate incidents and share the analysis with relevant internal teams. Critical- and high-severity incidents would be reported to TRAI. [2]

The reporting proposal includes material malfunctions, recurring failures and mitigation measures. However, the draft refers to a prescribed form, manner and timeframe without stating a numerical reporting deadline. A claim that it introduces a specific number of hours for reporting would go beyond the available text. [2]

For consumers, it proposes a predefined grievance mechanism to resolve reported AI-related harms within a reasonable timeframe, alongside a central record of those reports and their resolution. It does not specify an automatic compensation amount or a fixed number of days for every complaint. Nor should subscribers assume that this consultation has already created a new, operational AI complaint channel. [2]

The useful principle is that AI harm should not disappear into a vague explanation that a system made the decision. Recording what happened and how it was resolved would give the organisation a basis for identifying repeat problems, while preserving a route for human accountability.