Artificial intelligence is already moving into the systems that keep telecom networks running: traffic optimisation, fraud detection, customer support, network planning, service assurance and security. The next question is no longer whether telecom operators will use AI. It is who is accountable when an AI system makes a consequential decision, behaves unpredictably or affects the reliability of critical infrastructure.
- What TRAI is proposing
- Why telecom is an important test case
- The shift from AI experimentation to AI operations
- What this means for the telecom boardroom
- The supplier relationship is changing too
- What the proposal does not yet establish
- What telecom leaders should do now
- The wider signal: AI governance is becoming an operating discipline
- How the consultation could shape implementation
- Signals that will show whether governance is working
On 30 October 2026, the Telecom Regulatory Authority of India (TRAI) placed draft guidelines on the responsible use of AI in telecommunication networks and services for stakeholder consultation. The consultation closes on 27 November 2026. The proposal is significant because it places organisational accountability at the centre of AI adoption, including a requirement for an internal AI policy approved by the board of directors or an equivalent governing body.
This is a draft, not a final regulation. But the direction is clear: for telecom operators, AI governance is being framed as a management and operating responsibility, not simply a technology policy.
What TRAI is proposing
The draft applies to authorised entities using, or intending to use, AI in telecom networks or in the provision of telecom services. It asks each applicable entity to formulate and implement an internal AI policy, with board-level approval. That policy would set out how AI systems are classified, approved, monitored and governed.
More Read
Among the most consequential provisions are:
- Risk classification: AI systems would be classified as high, medium or low risk based on their materiality to network operations, service delivery, financial and operational outcomes, and potential impact on consumers.
- Approval before use: AI systems could be used only after approval by a designated officer, with delegation calibrated to the system’s risk classification.
- Incident management: Operators would maintain a central record of AI incidents, classify their severity, investigate them and follow predefined mitigation procedures. Critical- and high-severity incidents would be reported to TRAI in the prescribed manner and timeframe.
- Human oversight: Deployed AI systems would remain subject to an appropriate human-oversight mechanism.
- Data governance: Data used or generated throughout the AI lifecycle would need to be handled in accordance with applicable privacy, data-protection, confidentiality and cybersecurity requirements.
- Consumer grievance redressal: Operators would establish a process to resolve AI-related harms reported by users.
The proposal also calls for an AI Governance and Safety Committee approved by the board. It would include representation from relevant functions such as network operations, service delivery, IT, data management, regulatory affairs and consumer affairs. A senior executive, designated as the AI Governance and Safety Officer, would head the committee.
Read the TRAI consultation and draft guidelines alongside the Department of Telecommunications’ public announcement.
Why telecom is an important test case
Telecom is not an ordinary enterprise software environment. Its networks support public communication, commerce, essential digital services, emergency response and parts of the country’s critical information infrastructure. An AI system that changes network configuration, prioritises traffic, flags a subscriber or influences service restoration can have consequences beyond an internal productivity metric.
More Read
Consider a network operations system that uses machine learning to predict congestion and automatically reroute traffic. The benefit may be faster response and better utilisation. But a model trained on incomplete or unrepresentative data could misclassify demand, create new bottlenecks or behave differently after network conditions change. An automated fraud-detection model could reduce losses while also incorrectly restricting legitimate customers. A customer-service agent could resolve routine requests at scale but mishandle a complaint involving service denial or a vulnerable user.
These are not arguments against automation. They are reasons to connect model performance to operational risk, escalation paths and accountable ownership. TRAI’s draft recognises that risks can arise from bias, model drift, unintended behaviour and adversarial attacks, particularly where AI interacts with critical network components.
The shift from AI experimentation to AI operations
Many organisations still govern AI through a patchwork of procurement reviews, information-security checks, data policies and innovation committees. That structure can work for isolated pilots. It becomes harder to manage when AI is embedded in several business-critical workflows and when systems are bought from third parties rather than built internally.
TRAI’s proposed inventory requirement is therefore important. Operators would need an up-to-date record of active, inactive and decommissioned AI systems, including their source, purpose and risk classification. The draft also calls for due diligence on third-party AI systems, including the credibility of suppliers, system limitations and the suitability and quality of training data.
Before deployment, new or modified systems would be subject to validation, conformity assessment and impact assessment. The proposed checks include accuracy, robustness, explainability, fairness, resilience to model drift and human oversight. In practical terms, a procurement team could no longer treat an AI feature as an inconsequential add-on to a network or customer-service product. The operator would need to understand what the feature does, where it can fail and who is responsible for its outcomes.
What this means for the telecom boardroom
The most important change may be organisational rather than technical. A board-approved policy creates a formal line of accountability. The proposed committee brings network, technology, data, regulatory and consumer functions into a common oversight structure. This can force questions that are often left between departments: Who owns the model after procurement? Who approves a high-risk use case? Who can stop an automated process? How quickly must an incident be escalated? Who communicates with affected customers?
Boards will not need to review every model update or operational alert. They will, however, need assurance that the company has a functioning governance system: clear risk thresholds, an accountable executive, documented approvals, incident reporting, periodic reviews and the authority to modify or decommission systems when necessary.
The draft proposes that the internal policy be reviewed at least once in each financial year, and that the policy and amendments be filed with TRAI within seven working days of taking effect. It also proposes periodic review of deployed AI systems by the governance committee. These mechanisms would make governance a recurring operating process rather than a one-time policy document.
The supplier relationship is changing too
Telecom operators rely on a complex ecosystem of network-equipment providers, cloud platforms, software vendors, systems integrators and specialist AI companies. The draft’s approach makes the operator accountable for outcomes irrespective of whether the AI system is developed internally, procured from a third party or assembled through a combination of both.
That matters commercially. Suppliers may be asked to provide clearer documentation about model purpose, training-data quality, limitations, testing, security controls, update practices and incident support. Contracts could increasingly define access to logs, audit rights, notification timelines, responsibility for remediation and the conditions under which a model can be suspended.
For Indian AI vendors, this creates both a compliance burden and an opportunity. Vendors that can demonstrate explainability, robust testing, secure integration and clear operational support may be better positioned to sell into regulated infrastructure. The market could reward vendors that make governance easier, not just those that demonstrate impressive model performance.
What the proposal does not yet establish
There are important limits to what can be concluded today. These are draft guidelines open to consultation, and the final framework may change after stakeholder submissions. The detailed implementation burden will depend on the final text, the regulator’s interpretation and any subsequent standards or directions. It would be premature to describe the proposal as an already-enforced compliance regime.
There will also be practical questions for consultation: how risk categories should be applied to complex systems; how requirements should scale for smaller authorised entities; how incident severity and reporting timelines will be defined; how overlapping obligations under telecom, data-protection and cybersecurity rules will be reconciled; and how operators should demonstrate meaningful human oversight in highly automated environments.
What telecom leaders should do now
Operators do not need to wait for the final guidelines to understand their exposure. A sensible readiness exercise would begin with an inventory of AI systems across network, customer, security and corporate functions. Each system should have a business owner, a technical owner, a documented purpose, a risk rating and a clear escalation path.
Leadership teams should then test whether procurement and vendor-management processes capture the information needed to assess third-party AI. Incident-response teams should decide how AI-related failures would be detected, classified, investigated and communicated. Boards and executive committees should identify who would own the policy and how oversight would be reported.
These steps are useful even if the final rules change. They reduce the risk of discovering, during an incident, that nobody has a complete picture of the AI systems operating inside the organisation.
The wider signal: AI governance is becoming an operating discipline
TRAI’s proposal is sector-specific, but the underlying issue is relevant to banking, healthcare, energy, transport and other industries where AI increasingly influences essential services. The framework links accountability to the organisation deploying the system, rather than allowing responsibility to disappear into a vendor contract or a technical team. The governance challenge also extends to autonomous AI systems, as explored in our analysis of the regulatory fortress around autonomous AI. Defence presents a related institutional test in Sarvam’s framework with HQ IDS.
For FutureIsNow, the signal is not simply that a regulator has published another AI document. It is that AI adoption is beginning to require the same institutional discipline that organisations apply to financial controls, cybersecurity and operational resilience.
The next phase of enterprise AI will not be defined only by what models can do. It will be defined by whether organisations can explain, supervise and take responsibility for what those models do.
What to watch next: stakeholder responses before 27 November 2026, changes in the final guidelines, and whether other Indian sector regulators adopt similarly explicit governance structures.
How the consultation could shape implementation
The consultation period is an opportunity for operators, equipment suppliers, cloud providers, AI developers and consumer groups to test whether the proposed controls are workable in practice. A useful response should move beyond general support for responsible AI and address implementation details. For example, risk classification needs to reflect the actual role of a model in a network, not simply the label attached to the product. A low-risk analytics assistant and an automated system that can alter network behaviour should not be treated alike.
Incident reporting will need similar precision. Operators need a common understanding of what constitutes an AI incident, how severity is determined, when a near miss becomes reportable and how responsibility is divided when several vendors contribute to a system. If reporting thresholds are too vague, organisations may under-report or over-report. If they are too narrow, regulators may miss patterns that emerge across multiple operators.
There is also a question of proportionality. Telecom operators vary in scale, network architecture and use of AI. A governance framework should preserve strong safeguards for critical applications while avoiding a paperwork exercise that consumes resources without improving safety. Templates, standardised disclosures and practical guidance could help smaller entities comply without diluting accountability.
Signals that will show whether governance is working
Once a final framework is issued, the real test will be visible in operational evidence. Are AI systems inventoried and risk-rated? Do senior leaders receive meaningful reports rather than high-level compliance dashboards? Can an operator explain why a model made a consequential recommendation? Are incidents investigated and used to improve controls? Can a human operator intervene when automation behaves unexpectedly?
These questions distinguish governance as a living discipline from governance as documentation. A policy can be approved in a board meeting and still fail if frontline teams do not understand escalation routes or if suppliers cannot provide the information needed to investigate an incident.
Telecom leaders should therefore treat the draft as a prompt to test their current operating model. The strongest organisations will be those that can show a traceable chain from AI inventory and risk assessment to approval, monitoring, incident response and executive oversight. That is the standard the market may increasingly expect, even beyond the telecom sector.
