India’s New AI Rules: Why TRAI Wants Telecom Companies to Be Accountable

Artificial intelligence is becoming part of the infrastructure that keeps people connected. Telecom operators use AI to monitor network performance, detect fraud, predict equipment failures, optimise traffic and support customer services. These systems can make networks more efficient, but mistakes can also affect millions of people at once.

That is the challenge behind a new proposal from the Telecom Regulatory Authority of India (TRAI). On 30 October 2026, the regulator released draft guidelines on the responsible use of artificial intelligence in telecom networks and services, inviting comments from stakeholders until 27 November 2026. The proposal would give telecom AI a more formal governance framework, with clear expectations around accountability, risk assessment, human oversight and incident reporting.

The proposal is not a final regulation and should not be treated as an obligation already in force. It is, however, an important signal about how India may approach AI in critical digital infrastructure.

Why telecom needs its own AI safeguards

AI is already useful in the day-to-day running of communications networks. It can help predict a component failure before a tower or network element goes offline, identify unusual traffic patterns that may indicate fraud or cyberattacks, and help operators manage capacity when demand changes sharply.

But telecom is not an ordinary technology sector. Mobile and fixed networks support banking, transport, healthcare, emergency response, public services and everyday communication. A faulty recommendation in a low-impact customer-support tool is one thing; an unreliable model influencing network operations or access to essential services can have much wider consequences.

TRAI’s draft recognises risks such as bias, model drift and adversarial attacks. Model drift occurs when a system’s performance changes as real-world conditions or data change. An AI model that worked well during testing may become less reliable when network patterns, customer behaviour or the threat environment shifts.

The regulator’s central idea is straightforward: organisations should not treat AI as a black box that can be deployed and forgotten. They should know what systems they use, what risks those systems create, who is responsible for them and what happens when something goes wrong.

What TRAI is proposing

The draft applies to authorised entities holding a telecom service licence or relevant authorisation for establishing, operating, maintaining or expanding telecom networks, where they use or intend to use AI in those networks or services.

One of the most significant proposals is an internal AI policy approved by the organisation’s board of directors or an equivalent governing body. That policy would set out how AI systems are assessed, approved, monitored and reviewed.

1. Classifying AI systems by risk

Operators would be expected to classify each AI system as high, medium or low risk. The proposed assessment takes account of how important the system is to network operations and service delivery, its financial and operational impact, and the possible consequences for consumers.

This matters because not every AI application needs the same level of scrutiny. A tool that helps organise routine internal documents should not automatically face the same controls as a system that influences network availability, customer access or critical operational decisions. Risk-based oversight can help organisations focus their strongest safeguards where the consequences of failure are greatest.

2. Keeping an inventory of AI systems

The draft proposes a comprehensive, up-to-date inventory of active, inactive and decommissioned AI systems. Each record would include the system’s source, purpose and risk classification. Under the proposal, an AI system should not be used unless it is included in this inventory.

This could become particularly important as telecom companies buy software, network equipment and managed services from multiple suppliers. AI may be embedded in a product even when the operator has not developed the underlying model itself. An inventory would make it harder for these systems to remain invisible inside a complex technology stack.

3. Making vendors part of the accountability conversation

The proposal calls for due diligence before an organisation acquires or uses an AI system supplied by a third party. That review should consider the supplier’s credibility, the system’s soundness and limitations, and the suitability and quality of its training data.

Suppliers of telecom equipment or solutions that contain AI systems would also be expected to provide relevant disclosures. In practical terms, operators may need to ask more detailed questions before procurement: What does the model do? What are its known limitations? What data was used? How is it tested? Can the supplier support an investigation if the system behaves unexpectedly?

This does not mean the vendor automatically becomes the regulated telecom operator. Rather, the operator would need enough information and contractual support to manage the AI it chooses to deploy.

4. Testing systems and keeping humans in the loop

Before a new AI system is deployed, or an existing one is modified, the draft proposes validation, conformity assessment and impact assessment. The assessment would cover factors including accuracy, robustness, explainability, fairness, resilience to model drift and human oversight.

The draft also says AI systems should be subject to appropriate human oversight. That principle is important in a sector where automated decisions can have operational and consumer consequences. Human review should not be a ceremonial approval step: staff need the authority, information and practical ability to question a system, intervene and escalate an issue.

5. Recording and reporting AI incidents

The proposed framework asks operators to classify incidents into four levels: critical, high, moderate and low severity. AI incidents would be recorded in a central database, investigated and analysed, with mitigation carried out through predefined procedures.

Critical- and high-severity incidents would have to be reported to TRAI in a prescribed format and within a prescribed timeframe. The draft does not set out every operational detail of that reporting process, leaving the format and timeframe to be specified.

For consumers, this could matter when an AI-related failure contributes to a serious service disruption, an unfair outcome or another form of harm. The draft also calls for a grievance-redressal mechanism to resolve AI-related harms reported by users within a reasonable timeframe.

What could change for telecom companies?

If the guidelines are finalised in a similar form, operators may need to bring AI governance closer to the centre of business operations. Technology teams would need to maintain system inventories and conduct assessments. Procurement teams would need stronger vendor due diligence and clearer contractual provisions. Risk, compliance and legal teams would need to define incident processes, while senior management and boards would have a more direct role in approving policy.

That work could add cost and administrative effort, particularly for smaller operators and service providers. But the alternative—deploying increasingly complex AI systems without knowing their limits or ownership—can create operational, security and consumer risks that are harder to manage after an incident.

For AI developers and equipment suppliers, the draft may also influence what customers expect. Clear documentation, reliable testing, model limitations, security practices and support for incident investigations could become more important in telecom procurement decisions.

What it means for consumers

Most people will not notice whether an operator uses AI to forecast traffic or identify network faults. They will notice whether their connection works, whether a complaint is handled fairly and whether their personal information is treated responsibly.

The proposed requirements around data governance, human oversight and grievance redressal are therefore not simply internal compliance matters. They are intended to connect the use of AI with consumer protection. The real test will be how effectively those safeguards work in practice, especially when an automated system produces an outcome that a customer cannot easily understand or challenge.

Transparency will also matter. If a decision has a meaningful effect on a customer, organisations should be able to explain the process in language people can understand and provide a route for review where appropriate.

Draft guidelines, not the final word

TRAI has invited written comments on the draft until 27 November 2026. Stakeholders can use the consultation to raise questions about proportionality, implementation timelines, reporting requirements, technical standards and how the rules should apply to different kinds of AI use.

The draft also proposes that an operator review its internal AI policy at least once every financial year and file the policy, and later amendments, with TRAI within seven working days of it coming into effect. Those details show that the regulator is looking beyond a one-time approval towards continuing governance.

What happens next will depend on the consultation and the final version TRAI chooses to issue. Until then, companies should read the document as a proposal and assess how prepared their existing AI governance practices are, rather than assuming that every proposed requirement is already binding.

The bigger picture: AI needs accountability as well as innovation

India’s telecom networks are becoming more intelligent, and AI can help make them more efficient, resilient and responsive. But the more deeply these systems are woven into essential infrastructure, the more important it becomes to know how they work, where they can fail and who is answerable when they do.

TRAI’s draft is a move towards making those questions part of everyday telecom governance. Its success will depend on whether the final framework is practical enough to support innovation while demanding meaningful safeguards—not just paperwork—from operators and their technology partners.

For the wider AI ecosystem, the message is worth watching: in critical sectors, deploying an AI system is only the beginning. Responsible use also requires testing, monitoring, human judgement and a clear line of accountability.

Frequently asked questions

Are TRAI’s AI guidelines already mandatory?

No. The document released on 30 October 2026 is a draft for consultation. TRAI has invited stakeholder comments until 27 November 2026. The final requirements may change after the consultation.

Which companies would be covered by the proposed guidelines?

The draft is aimed at authorised entities holding a relevant telecom licence or authorisation for telecom services or networks and using, or intending to use, AI in those networks or services.

What are the main requirements proposed by TRAI?

The draft proposes a board-approved internal AI policy, risk classification, an inventory of AI systems, supplier due diligence, pre-deployment assessments, human oversight, incident recording and reporting, data governance and a consumer grievance-redressal mechanism.