Summary

  • India’s September 2026 amendment turns provider-side AI/ML spam flags into shared investigative signals, then requires complaint corroboration and staged checks before escalating action against senders.
  • The rules create an accountability chain, but published administrative totals do not show model error rates, appeal reversals or whether consumers experienced less unwanted traffic.

Analysis

A flagged number is an opening fact

India’s Telecom Commercial Communications Customer Preference Regulations already required access providers to operate systems for detecting bulk unsolicited commercial communications. TRAI’s February direction changed what those systems were expected to do. Instead of stopping at an alert on a recipient’s screen, a provider that flags a calling-line identity must share it with the originating provider through the DLT platform, immediately and within two hours. The originating provider then tells the sender, resolves the sender’s KYC identity, and coordinates a search for other numbers associated with that sender.

That sequence matters because a number is not the same thing as a sender, and a traffic pattern is not the same thing as a finding of misuse. TRAI’s direction says providers need not disclose proprietary algorithms, source code, model architecture or internal risk scores. It describes behavioral inputs such as call and message volume, velocity, diversity, duration and timing, but leaves the providers’ scoring implementation private. Cross-provider sharing and KYC reconciliation make the signal travel farther; they do not, by themselves, make the underlying inference independently reproducible.

The February direction therefore puts a second threshold between flag and sanction. Five or more flagged numbers mapped to one sender during ten days lead to investigation. The first occurrence calls for KYC re-verification; a second calls for physical verification; subsequent cases add physical checks and action when identity records do not match or resources are found to be misused. This is a graduated process, not an automatic penalty for one classifier output.

The September amendment adds another route. Three or more unique consumer complaints within ten days can trigger action when the sender’s number is also flagged by the AI/ML system. The two inputs play different roles: a complaint reports a recipient’s experience; the network model looks for patterns across traffic. Joining them can move a case sooner than the older five-complaint threshold, while requiring both forms of evidence. Consumers may appeal the resolution of a UCC complaint within 15 days through the listed channels.

Other provisions define which communications the system should recognise. Automated A2P calls must be declared in advance with the numbers to be used; undeclared A2P calls are treated as UCC. A customer inquiry can support follow-up commercial communication for seven days if the inquiry is written or digital and retained in verifiable form. Legacy consent is accepted only if it can be verified and registered on a provider’s digital platform. Number ranges 140xx, 1600xx and 1601xx receive protection from blanket spam labelling, while individual consumers remain free to block calls on their own devices.

The reported termination charge of up to INR 0.05 per minute is charged between access providers, not to the called customer.

The evidence chain is the public safeguard

TRAI’s own 2025 release reports 31.09 lakh UCC complaints, 7,31,120 notices to unregistered telemarketers, 4,73,075 one-month communication restrictions, 89,936 six-month caps for repeat offenders and 1,84,482 telecom resources disconnected during the year. Those figures show the scale of recorded activity. They do not show how many alerts were wrong, how often a sanction was reversed, how many unique people complained, or whether unwanted calls fell because of the rules. Enforcement volume is not an accuracy measure.

Using Note 64’s distinction between a common signal and a verifiable state only as an editorial test—not as a description of TRAI or Indian law—the question is what a recipient, sender or reviewer can check after a flag. The rule need not publish a provider’s model code to make a case auditable. It can still require a dated reason code, the numbers mapped to the same sender, the complaint and consent records considered, the KYC result, the step taken, and the route to challenge a mistake. The official summaries spell out a consumer appeal, but do not fully describe a sender’s model-level correction process.

That is a disclosure question, not proof that no other remedy exists.

Sources