TRAI releases draft guidelines on responsible use of AI in telecom

NEW DELHI: Every algorithm on the network will need an owner. The Telecom Regulatory Authority of India (TRAI) has put out its draft “Guidelines on Responsible Use of Artificial Intelligence (AI) in Telecommunication Networks and Provision of Telecommunication Services” for consultation, and the message to operators is blunt: if you use AI, you answer for it.

The draft is rooted in the “India AI Governance Guidelines” released by the government of India in February 2026. Those guidelines aim to harness the transformative potential of artificial intelligence for inclusive development and global competitiveness, while addressing risks to individuals and society, and rest on seven sutras: Trust is the Foundation, People First, Innovation over Restraint, Fairness & Equity, Accountability, Understandable by Design, and Safety, Resilience & Sustainability. TRAI’s guidelines are meant to ensure consistent and responsible implementation of that framework in the telecom sector, and to bring clarity, predictability and accountability to the ecosystem.

The case for acting is sound. Telecom is a significant part of India’s digital infrastructure. It supports public connectivity, public and essential e-services, trade and commerce, and the secure and resilient functioning of the country’s critical information infrastructure. It also matters for national security and emergency response. The draft notes that AI is increasingly being integrated into networks and services, and that while it is likely to significantly enhance efficiency, it may also introduce new risks if due diligence is lacking before deployment or if autonomous learning and systemic interactions go unsupervised. Those risks include inadvertent biases that creep in during training and use, unintended model behaviour such as model drift, and adversarial attacks. The draft adds that such risks can be mitigated if suitable AI governance practices are followed. In other words, the regulator is not against AI. It wants the benefits with the guard rails fitted.

TRAI’s authority comes from the TRAI Act, 1997. The draft points to the section 11(1)(b)(v) mandate to lay down quality of service standards and protect consumers, and issues the guidelines in consideration of the India AI Governance Guidelines and that mandate.

Who is covered? Any entity holding a licence under the Telegraph Act, 1885, or an authorisation under the Telecommunications Act, 2023, for providing telecommunication services, or an authorisation under the 2023 Act for establishing, operating, maintaining or expanding telecommunication networks, and which is using or intends to use AI systems in networks, services or both. That is a wide net, and it includes plans, not just present use.

The core duty is an internal AI policy, approved by the board of directors or an equivalent governing body. The policy must contain, among other things:

Risk classification: each AI system to be classed as high, medium or low risk, based on its materiality, including its impact on financial and operational outcomes and its potential implications for consumers.

Approval for use: an AI system may be used only after approval by a designated officer, with approvals delegable according to risk class.

Incident classification: AI incidents to be graded critical, high, moderate or low severity.

Incident handling: incidents to be recorded in a central database in a predefined format, mitigated under a standard operating procedure (SOP), and investigated and analysed. Critical and high severity incidents are to be reported to TRAI in a prescribed format, manner and timeframe.

Human oversight: all AI systems to be subject to appropriate human oversight under a predefined mechanism.

Data governance: data across the lifecycle of deployed AI systems to be lawfully and securely collected, used, shared and disposed of, in line with data protection, privacy, confidentiality and cybersecurity requirements.

Consumer protection: AI-related harms reported by users to be resolved within a reasonable timeframe under a predefined grievance redressal mechanism.

The policy is to be reviewed at least once in a financial year, and whenever necessary, and filed with TRAI for record within seven working days of coming into effect, along with any amendments.

Implementation is where the detail bites. Operators must maintain a comprehensive, up-to-date inventory of all active, inactive and decommissioned AI systems, recording source, purpose and risk class, and no AI system may be used unless it is in the inventory. They must carry out due diligence before acquiring AI from third parties, covering the credibility of the supplier, the soundness and limitations of the system and the quality of training data. Before deploying any new AI system, or modifying an existing one, they must ensure validation, conformity assessment and impact assessment. Conformity assessment covers accuracy, robustness, explainability, fairness, drift resilience and human oversight. For fairness, the draft cites the most recent version of Telecommunication Engineering Centre (TEC) standard 57050:2023 for Fairness Assessment and Rating of Artificial Intelligence Systems, or an applicable international standard, where appropriate.

The draft also reaches into the supply chain. Operators must obtain disclosures from suppliers when buying equipment, systems or solutions with embedded AI, and write enforceable provisions into supplier agreements on regulatory compliance, audit and inspection rights, incident management, risk allocation and accountability. Incidents, including testing events, are to be recorded using TEC standard 57090:2025 on Schema and Taxonomy of an AI Incident Database in Telecommunications and Critical Digital Infrastructure, or an equivalent taxonomy. Operators must also keep a central database of AI-related harm reported by users and how it was resolved, and run periodic AI training for technical, operational, regulatory and business staff involved in human oversight.

Oversight sits at the top. Each operator must set up an AI Governance and Safety Committee (AGSC) with board approval, drawing members from network operation, service delivery, information technology, data management, regulatory, consumer affairs and other relevant functions, and headed by an AI Governance and Safety Officer (AGSO), who must be a senior executive. The AGSC reviews the performance of deployed AI systems, including incident records, at least once a financial year, to identify vulnerabilities, oversight weaknesses, fairness concerns and emerging or systemic risks. The AGSO must then ensure corrective measures, including modification or decommissioning of systems where necessary.

On enforcement, the key line is accountability. The operator is accountable for the outcome of all AI systems it uses, whether developed internally, procured or outsourced from a third party, or a mix. Critical and high severity incidents, including material malfunctions, recurring failures and mitigation measures, must be reported to TRAI, which says the information may be used for sector-wide learning, risk assessment, advisories and preventive measures. Operators must keep adequate records to show compliance and furnish them to TRAI on request. The guidelines do not limit any other law, rule, licence condition or binding requirement, and any contravention in the development, procurement, integration, testing, deployment, operation, use, modification or decommissioning of an AI system will be dealt with under the relevant law.

The draft ends with a set of definitions, covering artificial intelligence, AI system, AI incident, accuracy, accountability, explainability, fairness, risk, robustness, resilient AI system and validation. Stakeholders are asked to provide detailed input with justification.

The take is positive. By setting out a clear, practical framework before problems arise, and by consulting the industry first, TRAI is giving operators a chance to shape the rules and to build trust in AI-led networks from the start.