Summary

  • TRAI’s 30 October draft makes the authorized telecom entity accountable for AI outcomes even when a third party developed the system.
  • Operators would need board-approved AI policies, system inventories, pre-deployment assessments, an incident database and a senior AI Governance and Safety Officer.
  • TEC 57090:2025 supplies qualitative incident-severity bands and examples; TRAI’s draft also permits an equivalent taxonomy.
  • The draft requires high- and critical-severity incidents to be reported to TRAI, but gives no reporting form or deadline in the consultation text.

The vendor gets a contract. The operator gets the regulator.

The Telecom Regulatory Authority of India’s draft draws a firm line through the supplier relationship. Clause 3.8 says the applicable authorized entity is accountable for the outcome of every AI system it uses, whether the system was developed internally, procured from a third party or assembled from both. The accompanying contract may divide costs or indemnities between buyer and supplier. Under the proposal, it does not move the regulatory label away from the operator.

That is a consequential choice for a sector in which AI can sit inside network operations, service delivery or both. The draft names decisions that can affect financial and operational outcomes and consumers. It applies to entities licensed or authorized to provide telecom services or to establish and operate networks when they use, or plan to use, AI in those functions. It is open for comment until 27 November 2026, so this is a proposal, not a final rule. TRAI’s consultation page and a Ministry of Communications release record the deadline.

TRAI has not written a one-line ban on outsourcing. It has written a control chain. A board or equivalent governing body must approve the operator’s internal AI policy. Each system must receive a high, medium or low risk classification based on materiality to the network or service, including financial and operational effects and possible consumer implications. A designated officer approves its use; approval can be delegated according to that class.

Before a new system is deployed, or an existing one is modified, the entity must validate it, conduct conformity and impact assessments, and address accuracy, explainability, fairness, drift resilience and human oversight. A third-party system requires due diligence on the supplier, the system’s limits and the quality and suitability of training data. The operator must inventory active, inactive and decommissioned systems, record their source, purpose and risk class, and keep unlisted systems out of service. A procurement team can still choose the model. It cannot treat the vendor’s name as the control plan.

The board’s role is not decorative. The draft calls for an AI Governance and Safety Committee with relevant operations, service delivery, IT, data, regulatory and consumer-affairs representation. A senior executive, the AI Governance and Safety Officer, heads it. The committee reviews AI performance and incident records at least once each financial year and can require modification or decommissioning. The policy itself must be reviewed annually and filed with TRAI within seven working days after taking effect.

Two scales, two decisions

The draft uses two classifications that should not be blurred. The first is a risk class for each AI system: high, medium or low. The operator’s board-approved policy sets that class from materiality. The second is an incident-severity class: critical, high, moderate or low. Every incident must be recorded, investigated and analysed. Only the critical and high classes trigger reporting to TRAI under the draft.

TRAI has not left the entire severity vocabulary for each company to invent. The draft points to TEC 57090:2025, or an equivalent taxonomy, for incident records. TEC’s standard gives concrete examples: a major nationwide outage or complete failure is critical; significant disruption or major service degradation is high; regional outages or partial degradation are moderate; minor interruptions and brief slowdowns are low. The standard was later listed among TEC’s gazette-notified standards, with notification dated 24 April 2026. TEC’s notice list makes that status visible.

Those examples give the draft a floor. They do not finish the reporting rule. TEC describes severity through qualitative categories and examples, not a numerical formula. TRAI’s proposal lets an entity use an equivalent taxonomy. Most consequentially, clauses 3.2 and 3.9 say high- and critical-severity events must be reported in a prescribed form, manner and timeframe, while the consultation text supplies no form and no hours-or-days deadline.

That is the open seam. A central database can preserve every incident and test event inside the operator. A separate database must record harm reported by users, and the entity must resolve grievances within a “reasonable timeframe” under its own mechanism. TRAI says incident information may support sector-wide learning, risk assessment and advisories, and it can demand compliance records. The draft does not require operators to publish their databases or TRAI to publish an aggregate. The internal record may be complete while the public still cannot compare how two operators classified similar events.

No public cross-operator incident dataset was available to test whether providers classify comparable events differently; TRAI’s eventual trigger, minimum fields and clock would show whether a high-severity event produces comparable notices.

The right boundary needs a common clock

TRAI’s proposed allocation puts responsibility beside operational control. The operator chooses systems, approves their use, sets internal procedures, contracts with vendors, tests modifications, supervises deployment and keeps the incident record. That is a more useful assignment than asking a regulator or a model supplier to manage a network from outside it.

The national India AI Governance Guidelines identify sector regulators such as TRAI and contemplate sector-specific rules. The TRAI Act, 1997 gives the authority a quality-of-service role and a consumer-protection mandate. The proposed telecom AI framework sits inside that institutional division: the regulator defines the common obligation; the operator builds the working system. The official chronology is unsettled: the TRAI draft and a 30 October 2026 PIB release place the guidelines’ release in February 2026, while a 5 November 2025 PIB release says they were unveiled then and a 15 February 2026 PIB overview describes their release at the AI Impact Summit; a public version history would show whether these dates refer to separate editions.

For the common obligation to travel, TRAI should specify a minimum incident trigger, a reporting deadline measured from a stated event, and a required set of fields. It can keep deployment decisions local: which systems need tighter monitoring, how suppliers are tested, who approves a change and which human team watches an output. Operators need room to fit controls to the network. They do not need ten incompatible answers to when TRAI must be told about a serious failure.

Comments close on 27 November. The final rule will show whether the consultation keeps its sharpest sentence—operator accountability for vendor-built AI—and gives the reporting clause enough detail to make that sentence enforceable in practice.

Sources