Trai proposes mandatory AI policies, incident reporting for telcos

The Telecom Regulatory Authority of India (Trai) on Friday proposed that telecom operators adopt internal artificial intelligence (AI) policies, classify AI systems by risk and report critical AI-related incidents.

The proposals are part of the regulator’s draft guidelines for responsible AI use in telecom networks and services, where operators are increasingly deploying the technology for network management, traffic optimization, predictive maintenance and customer services.

It noted that growing reliance on the technology raises concerns over cybersecurity, algorithmic bias and system failures, given the critical role telecom networks play in the country’s digital infrastructure.

The regulation has also gained urgency as AI is increasingly being used both to detect security threats and to enable more sophisticated cyberattacks. Globally, telecom operators are strengthening security measures as they expand their use of AI, amid concerns over data breaches, vulnerabilities in third-party software and network disruptions.

“These risks, including inadvertent biases, which may creep in AI systems during training and usage, unintended model behaviour such as model drift, and adversarial attacks, can adversely affect the resilience of telecommunications infrastructure, particularly in its critical components,” Trai said in its draft guidelines.

Stakeholders can send their comments by 27 November. The guidelines are part of the government’s broader India AI Governance framework released in February, which aims to promote responsible AI use while addressing potential risks. Trai’s proposal seeks to extend that framework to the telecom sector.

Proposed framework

Telecom operators must formulate an internal AI policy that is approved by their respective boards of directors or equivalent governing bodies.

The policy will have to classify AI systems as high-risk, medium-risk or low-risk, depending on their importance to network operations, financial and operational outcomes, and potential impact on consumers. The use of any AI system will require approval from a designated officer within the organization.

The regulator has proposed that telecom operators remain accountable for the outcomes of all AI systems they use, regardless of whether these systems are developed internally or procured from third-party vendors.

Trai defines an AI system as a machine-based system that, for explicit or implicit objectives, infers how to generate output such as predictions, content, recommendations, or decisions that can influence physical or virtual environments, from the input it receives. Different AI systems vary in their levels of autonomy and adaptiveness after deployment.

“The applicable authorized entity shall be accountable for the outcome of all AI systems used by it, irrespective of whether the AI systems are developed internally, procured/outsourced from third-party or a combination thereof,” the draft guidelines said.

Operators will have to file their internal AI policies and any subsequent amendments with Trai within seven working days of their coming into effect. These policies must be reviewed by the operators at least once per fiscal year.

“AI-related harms reported by users shall be resolved within a reasonable timeframe as per a predefined grievance redressal mechanism,” Trai said.

The regulator has also proposed a mechanism for recording, investigating and analyzing AI-related incidents. These will be classified into four categories: critical, high, moderate and low severity. Critical and high-severity incidents must be reported to Trai in a prescribed format and within a specified timeframe.

Operators will also have to maintain a central database of AI incidents and a separate record of AI-related harm reported by consumers, including details of their resolution.

Human oversight

The draft guidelines also call for human oversight of all AI systems to minimize risks. Companies will have to ensure that data used or generated throughout the lifecycle of AI systems is collected, processed, shared, and disposed of in accordance with applicable data protection, privacy, and cybersecurity requirements.

As part of the proposed requirements, telecom operators will have to maintain an updated inventory of all active, inactive and decommissioned AI systems. They will also have to undertake due diligence before procuring AI systems from third-party suppliers and conduct validation, conformity and impact assessments before deploying new AI systems or modifying existing ones.

Operators will also have to establish an AI Governance and Safety Committee, with representation from network operations, service delivery, information technology, data management, regulatory and consumer affairs functions across the company. The committee will be headed by a senior executive designated as the AI governance and safety officer.

The panel will review the performance of deployed AI systems at least once every fiscal year and identify vulnerabilities, fairness concerns and emerging risks. It will also ensure corrective action, including modification or discontinuation of AI systems where necessary.

“These guidelines are more in the nature of guidance rather than mandates or directives. They fall under the category of light-touch regulation, serving more as a code of conduct to guide telecom operators on the best practices they should follow while using AI,” said Satya N. Gupta, former principal adviser at Trai.

Gupta said that enforcing accountability and reporting mechanisms on the regulator’s side would be sufficient at this stage, as it would lead to overregulation. “Operators and all other companies know and are working on protecting their systems against AI-related threats,” he said.