Trai Proposes Mandatory AI Policies and Incident Reporting for Telecom Operators
New draft guidelines mandate risk classification and governance committees for India's telecom AI infrastructure.
1Regulatory Shift for Telecoms
The Telecom Regulatory Authority of India has introduced draft guidelines requiring operators to adopt formal internal AI policies. This initiative aims to address growing concerns regarding cybersecurity, algorithmic bias, and potential system failures within critical digital infrastructure. Stakeholders are invited to submit their formal comments on these proposed regulations by November 27.
2Risk-Based AI Classification
Operators must classify all AI systems into high, medium, or low-risk categories based on their operational impact. This classification considers the system's importance to network functions, financial outcomes, and consumer safety. Every deployment requires approval from a designated officer, ensuring that accountability remains centralized within the organization's governance structure for all systems.
3Mandatory Incident Reporting
The proposal establishes a formal mechanism for recording and investigating AI-related incidents, categorized by four severity levels. Critical and high-severity incidents must be reported to the regulator within a specific timeframe. Companies are further required to maintain a central database tracking all AI-related harms and the subsequent resolution steps taken for consumers.
4Governance and Oversight Committees
Telecom firms must establish an AI Governance and Safety Committee led by a senior executive. This committee includes representatives from IT, network operations, and regulatory affairs to review system performance annually. They are tasked with identifying vulnerabilities, fairness concerns, and emerging risks, ensuring corrective actions are taken to maintain overall network resilience.
5Vendor Accountability Standards
Telecom operators remain fully accountable for all AI outcomes, regardless of whether the technology is developed internally or procured from third-party vendors. Before deployment, companies must conduct due diligence, validation, and impact assessments. This ensures that external software does not introduce unforeseen risks or vulnerabilities into the critical telecommunications network infrastructure.
6Human Oversight Requirements
The draft guidelines emphasize the necessity of human oversight for all AI systems to minimize operational risks. Data lifecycle management must strictly adhere to existing cybersecurity and privacy laws during collection, processing, and disposal. Operators are also required to maintain an updated inventory of all active, inactive, and decommissioned AI systems.
7Light-Touch Regulatory Approach
Industry experts characterize these guidelines as a code of conduct rather than rigid directives. By adopting a light-touch regulatory framework, the authority seeks to guide best practices without stifling innovation. The policy aligns with the broader India AI Governance framework released in February, aiming to balance responsible usage with necessary sector-specific safeguards.
8Strategic Industry Implications
These regulations reflect the increasing reliance on AI for network management, traffic optimization, and predictive maintenance. By formalizing governance, the regulator intends to protect the country's digital ecosystem from adversarial attacks and model drift. Operators must now integrate these compliance measures into their annual fiscal planning to ensure long-term operational stability.