Summary:
TRAI has proposed draft guidelines requiring telecom operators to disclose and maintain records of AI systems used in their networks and services, including those integrated into equipment supplied by third-party vendors. The framework calls for board-approved AI policies, risk classification, supplier assessments, system validation and dedicated governance committees, while making operators accountable for all AI-related outcomes. It also proposes mandatory reporting of critical and high-severity AI incidents and a mechanism to address customer complaints. TRAI has invited stakeholder feedback until November 27, although the draft leaves certain reporting requirements and risk-classification thresholds undefined.
Telecom equipment providers supplying products to the Indian market may be required to disclose how and where artificial intelligence is integrated into their offerings under draft guidelines proposed by the Telecom Regulatory Authority of India (TRAI). The proposed rules would make telecom operators responsible for every AI system they use, regardless of whether it is developed internally or sourced from an external vendor.
The draft AI guidelines, issued by TRAI on October 30, outline the governance requirements for AI used across licensed operators’ networks and services. These include board-approved policies, risk categorisation and mandatory reporting of significant AI-related incidents to the regulator. TRAI has invited written feedback from stakeholders until November 27.
According to TRAI, the proposed framework adapts the India AI Governance Guidelines, released by the government in February 2026, for the telecommunications industry. The regulator noted that AI is increasingly becoming part of telecom networks and services, offering potential efficiency gains while also creating risks such as training-related bias, model drift and adversarial attacks that could compromise the resilience of critical telecom infrastructure.
Disclosure requirements for equipment suppliers
Telecom operators procuring equipment, systems or solutions that incorporate AI would be required to obtain relevant information about those AI components from existing or potential suppliers during the procurement process. Before purchasing or deploying an AI system from an external provider, operators would also need to assess the supplier’s reliability, the system’s technical integrity and limitations, and the relevance and quality of its training data.
Contracts with suppliers would have to include legally enforceable conditions covering regulatory compliance, audit and inspection access, incident handling, allocation of risks and accountability for individual AI systems. These provisions would need to be established before deployment. Operators would also be required to maintain an inventory of every AI system in use, including details of its origin. The draft makes operators responsible for the results produced by all such systems, irrespective of whether they are developed internally, purchased from vendors or created through a combination of both approaches.
Entities covered by the TRAI AI framework
The proposed guidelines would cover companies holding licences under the Telegraph Act, 1885, or authorisations under the Telecommunications Act, 2023, to provide telecom services or establish and operate telecom networks, provided they use or intend to introduce AI into their operations. This includes major Indian telecom companies such as Reliance Jio, Bharti Airtel, Vodafone Idea and state-owned BSNL. TRAI’s latest subscription figures show that India had approximately 1.37 billion telephone subscribers at the end of September.
Governance measures operators would need to introduce
Every operator would be required to formulate an internal AI policy and secure board approval. The policy would have to be submitted to TRAI within seven working days of becoming effective and reviewed at least annually. It would also need to classify each AI system as high, medium or low risk, taking into account its importance to network and service operations, along with its financial, operational and consumer-related implications.
Operators would have to maintain a regularly updated register covering all AI systems, including those currently operational, inactive or withdrawn from service. The register would record each system’s origin, intended function and risk category. The draft explicitly states that an AI system cannot be deployed unless it has been included in this inventory.
Before introducing a new or modified AI system, operators would need to conduct validation, conformity checks and impact assessments. These evaluations would examine factors such as accuracy, reliability, explainability, fairness, resistance to model drift and the availability of human supervision. For fairness assessments, the draft refers to the Telecommunication Engineering Centre’s TEC 57050:2023 standard or an equivalent international benchmark. Each AI system would also require clearance from an authorised officer before deployment.
An AI Governance and Safety Committee, established with board approval, would oversee these activities. Its membership would include representatives from network operations, IT, data, regulatory affairs and consumer affairs. The committee would be led by a senior executive appointed as the AI Governance and Safety Officer, who would oversee remedial measures and ensure that AI systems are withdrawn when necessary.
Procedures for managing AI-related incidents
Under the draft, an AI incident refers to an occurrence in which a system fails, generates unintended results or operates unpredictably, potentially resulting in harm or infringement of legal rights. Operators would be required to classify such events into four severity levels — critical, high, moderate and low — and record them in a central database. The classification would follow the incident framework outlined in TEC standard 57090:2025 or an equivalent standard.
Incidents categorised as critical or high severity, including significant system failures and repeated malfunctions, would need to be reported to TRAI, along with details of the steps taken to address them. The regulator said these reports could support industry-wide learning, risk evaluation and the issuance of advisories. Operators would additionally have to maintain a separate record of AI-related harm complaints received from customers and establish a grievance mechanism to address them within a reasonable period.
Areas not clearly defined in the proposal
Although the draft requires operators to report serious AI incidents within a specified format, process and timeframe, it does not provide details of these requirements. It also allows individual operators to establish their own definitions of high-risk AI systems and critical incidents through internal policies, rather than introducing uniform thresholds across the telecom sector.
