Summary

  • TRAI’s 30 October draft keeps the authorised telecom entity accountable for AI outcomes whether it builds a system or procures it.
  • The proposed control chain runs through board approval, risk classification, an AI inventory, supplier disclosures, contract rights and incident reporting.

The procurement order can change hands. The result cannot. TRAI’s 30 October draft says an authorised telecom entity remains accountable for the outcome of every AI system it uses, whether the system is built in-house, bought from a supplier or assembled from both (§3.8). The proposal puts the operator at the end of the chain—and leaves it there.

The draft applies to entities holding the specified telecom licence or authorisation that use, or intend to use, AI in telecom networks or services. That includes network and service operations, not every AI company merely because it sells a model to the sector (§2.1). The obligation starts with the authorised entity’s board: it must approve an internal AI policy, classify each system by materiality and consumer impact, and designate an officer to approve its use (§§3.1–3.2).

TRAI then makes the policy operational. A covered entity must inventory active, inactive and decommissioned AI systems, with each entry recording the system’s source, purpose and risk class. An unlisted system cannot be used. Before deployment—or a change to an existing system—the entity must validate it and assess accuracy, explainability, fairness, drift resilience and human oversight (§3.5).

Buying the technology adds a second set of duties. The operator must examine the supplier’s credibility, the system’s soundness and limits, and the suitability and quality of training data. Suppliers must disclose details of AI embedded in telecom equipment or systems. Supplier agreements must give the operator enforceable provisions for compliance, audit and inspection, incident management, risk allocation and accountability (§3.5(b), (e)–(f)). These terms are how the draft expects responsibility to travel upstream without leaving the operator’s desk.

A board-approved AI Governance and Safety Committee, led by a senior executive, would review performance, incident records, vulnerabilities and oversight weaknesses at least annually. The draft also calls for central incident records, investigation and mitigation procedures, a record of consumer harm and its resolution, and reports to TRAI for critical and high-severity incidents (§§3.2, 3.6–3.10). A new or amended internal policy must be filed within seven working days of taking effect.

One consequential part is still unfinished: the paper leaves the format, manner and timeframe for high- and critical-severity incident reports to a later prescription (§§3.2(d), 3.9). The consultation is open until 27 November 2026. The standard TRAI sets for those reports will determine how quickly an operator’s private incident ledger becomes a regulator’s usable record.

Sources