NEW DELHI, November 1, 2026 — India’s telecom regulator has proposed a sector-specific framework for the use of artificial intelligence in telecommunications networks and services, asking stakeholders to comment on draft guidelines released on October 30. The proposal would require covered telecom entities to establish internal AI governance, classify systems by risk, maintain an inventory of systems, and create procedures for recording and reporting serious incidents. The consultation is open until November 27, 2026. The guidelines are a draft, not a set of final obligations already in force.

The proposal matters because AI is increasingly used in network planning, traffic management, fraud detection, customer support, service assurance, and cybersecurity. These applications can improve efficiency, but errors can affect connectivity, privacy, billing, or access to services at scale. TRAI’s draft seeks to place responsibility on telecom providers that deploy AI, including when a system is purchased from an outside supplier rather than built internally.

The Telecom Regulatory Authority of India published the draft guidelines on October 30 and invited comments through its consultation process. The document is framed around responsible use of AI in telecommunication networks and the provision of telecommunication services. Its central approach is organizational: covered entities would be expected to establish policies, know which AI systems they use, assess risks before deployment, and maintain processes for responding when a system causes or contributes to harm.

The proposal does not mean every AI tool used by every Indian business would automatically fall within the telecom framework. Its stated scope concerns entities holding a license or authorization for telecommunications services or for establishing, operating, maintaining, or expanding telecom networks, where they use or intend to use AI in those networks or services. The precise scope and final wording may change after stakeholder feedback.

Board-approved policies and a system inventory

Under the draft, a covered entity would need an internal AI policy approved by its board or an equivalent governing body. The policy would set out how the organization identifies, assesses, and manages the risks associated with AI. The draft also proposes a record of AI systems used by the entity, including systems that are active, inactive, or discontinued. An inventory can help an operator identify where a model is deployed, what task it performs, who is responsible for it, and what controls apply.

That record-keeping requirement is important for large telecom groups because AI may be embedded in vendor products, network-management platforms, call-center tools, and security systems. A company may not have trained a model itself, yet its operational choices can still expose customers to its outputs. An inventory is useful only if it is maintained as systems change: replacing a model, changing its purpose, or connecting it to a new dataset can alter its risk profile.

The draft proposes classifying AI systems into high-, medium- and low-risk categories. Risk classification is intended to make oversight proportionate rather than treating every automated function as equally dangerous. A tool that summarizes non-sensitive internal documents does not create the same potential harm as a system that makes consequential decisions affecting network availability, customer access, or the handling of personal information.

The practical challenge is deciding how categories should be applied to systems that serve several purposes. A network optimisation model may ordinarily improve capacity allocation but could also affect emergency traffic or service quality during a disruption. A customer-service assistant may answer routine questions but could create a more serious problem if it provides incorrect information about a complaint, payment, or account restriction. Operators will need documented criteria and a process for reviewing classifications as systems evolve.

TRAI’s proposal also calls for incidents involving AI to be classified by severity, recorded, and investigated. Critical- and high-severity incidents would be reported to the regulator under the proposed mechanism. Such a system can help distinguish a minor output error from an event that causes widespread service disruption, material consumer harm, or a significant security problem. A consistent record can also support root-cause analysis and help prevent the same failure from recurring.

Reporting rules are effective only when organizations understand what counts as an incident, how quickly it must be escalated, and what evidence must be preserved. The draft’s final details will matter: reporting thresholds, deadlines, formats, and coordination with existing telecom security or service-quality requirements will determine how the process works in practice. These are consultation questions, not reasons to assume the proposal already imposes a final deadline or penalty.

Also read: Tata Communications Plans ₹4,350 Crore AI Network

The draft calls for appropriate human oversight and makes the covered entity responsible for outcomes arising from AI systems it uses, whether those systems are developed in-house or procured from a third party. This is a significant operational point. A vendor contract may allocate responsibilities between supplier and customer, but it does not remove the need for the telecom operator to understand how a system is used in its own network or customer services.

Human oversight should be meaningful rather than a nominal sign-off. Staff need the authority, information, and time to challenge an automated recommendation, suspend a faulty deployment, or escalate an unusual result. For high-impact functions, organizations may also need fallback procedures so that a model failure does not leave staff without a safe way to continue essential operations. The final guidelines will determine how specific those expectations become.

What the proposal could mean for customers

For consumers, the intended benefit is stronger accountability when AI is used in services they rely on every day. Better governance may reduce the chance that a faulty model causes persistent service problems, mishandles complaints, or produces harmful automated decisions. However, the draft does not itself guarantee that every AI error will be prevented or that every complaint will be resolved in a particular period. Those outcomes depend on the final rules, enforcement, and the quality of implementation.

Customers should continue to use official operator channels to report billing errors, service outages, suspected fraud, or incorrect automated decisions. They should retain complaint numbers and relevant dates. If an issue involves personal information or account access, customers should avoid sharing passwords or one-time codes with anyone claiming to investigate an AI incident. A regulatory consultation does not change the need for ordinary account-security precautions.

India has been developing AI policy through a mix of general governance guidance and sector-specific oversight. Telecom networks have their own operational characteristics: they carry emergency and everyday communications, depend on complex infrastructure, and can affect large numbers of users when a central system fails. A sector-specific proposal can translate general principles such as accountability, safety, and human oversight into procedures for licensed operators.

The relationship between the proposed telecom guidelines and other legal duties will need to be clear in the final version. Telecom providers already operate within licensing, security, consumer protection, and data protection frameworks. Companies will need to understand how any new AI policy, incident log, or reporting channel fits with existing compliance processes, rather than treating a new framework as a replacement for all other obligations.

Stakeholders have until November 27, 2026, to submit comments through TRAI’s consultation process. Telecom operators, equipment suppliers, cloud and AI vendors, consumer groups, researchers, and civil-society organizations may have different views on the costs, definitions, and safeguards needed. Practical submissions can help identify where rules need more precision—for example, how to classify systems used for multiple purposes, what qualifies as a serious incident, and how to protect confidential security information while maintaining accountability.

The next milestones to watch are TRAI’s handling of stakeholder submissions, any clarifications or revised draft text, and the eventual form and commencement date of final guidelines. Until then, organizations should describe the document accurately as a proposal. They may choose to review their AI inventories and governance processes in anticipation, but the proposed requirements should not be presented as already-final law.

The central question is whether the final framework can create reliable oversight without making routine network operations unnecessarily cumbersome. Clear risk definitions, workable reporting thresholds, and practical human-review procedures will be essential. For customers, the value of the proposal will ultimately be judged not by the number of policies written, but by whether AI-assisted telecom services remain reliable, explainable, and accountable when something goes wrong.

Telecom companies preparing for the consultation can map where AI already touches customer-facing and network functions, identify which teams own each deployment, and check whether incident logs contain enough information to reconstruct an event. That exercise is useful even before a final rule is issued. It can expose gaps between the network team, customer-service unit, cybersecurity function, procurement team, and legal staff, particularly where a vendor operates part of a service on the company’s behalf.

Procurement contracts may also need clearer language on model updates, access to audit records, incident notification, data handling and support during an investigation. A provider may not be able to disclose every detail of a proprietary model, but an operator still needs enough information to assess operational risk and explain how it responded to a failure. The consultation is an opportunity to ask how regulators expect accountability to work when a telecom service depends on several suppliers and cloud systems.

Implementation costs will vary with the size of the network, the number of systems in use and the maturity of existing controls. Smaller authorised providers may have fewer specialist staff than national operators, while larger firms may have more complex legacy infrastructure. Clear, proportionate definitions and practical templates could make compliance more consistent without reducing the expectation that an operator remains responsible for the services it offers.