India proposes strict AI governance rules for telecom providers

The proposed framework

The Telecom Regulatory Authority of India (TRAI) has released a draft framework for the responsible use of artificial intelligence in telecommunication networks. This move comes as AI becomes increasingly integrated into how companies provide services and manage their infrastructure. The regulator wants to ensure that these technologies are implemented with consistent oversight and clear accountability.

According to the draft, telecom operators must create internal AI policies that are approved by their board of directors. These policies must cover several key areas, including how the company handles risk classification, deployment approvals, and data governance. The rules also require a specific plan for managing incidents and addressing consumer grievances related to AI.

TRAI noted that the goal is to increase clarity and predictability within the ecosystem. By establishing these rules, the regulator hopes to mitigate risks like unintended model behavior, biases, and adversarial attacks. These issues could potentially threaten the resilience of critical national infrastructure if left unmanaged.

Risk classification and reporting

Under the new guidelines, telecom providers are required to categorize their AI systems into high, medium, and low-risk groups. This classification is based on how significant the AI is to network operations, its impact on financial outcomes, and its potential consequences for everyday consumers. No AI system is allowed to be used unless it is officially listed in a comprehensive inventory.

The inventory must include details on the source, purpose, and risk level of every active, inactive, and decommissioned AI system. This means companies cannot hide the use of third-party tools; they are held responsible for the outcomes of AI systems regardless of whether they were developed internally or outsourced. This creates a strict chain of accountability for the technology used in the network.

Furthermore, the framework introduces a specific reporting structure for when things go wrong. AI-related incidents will be divided into four severity levels: critical, high, moderate, and low. Telecom companies will be required to report all critical and high-severity incidents to TRAI in a prescribed format and timeframe. They must also maintain central databases to track these incidents and any complaints from consumers regarding AI-related harm.

Human oversight and committees

A major pillar of the TRAI proposal is the requirement for human oversight to mitigate risks. The consultation paper states that all AI systems must be subject to appropriate human oversight based on a predefined mechanism. This ensures that automated decisions are not left entirely to machines without a human being able to intervene or provide a check.

To manage this, the draft mandates the creation of an AI Governance and Safety Committee (AGSC). This committee must be led by a senior executive who is designated as the AI Governance and Safety Officer. The primary role of this group is to oversee AI deployment, identify vulnerabilities, and look for emerging systemic risks or fairness concerns.

The AGSC is required to review the performance of deployed AI systems at least once every financial year. During these reviews, the committee must examine incident records and other relevant data to identify weaknesses. If a system is found to be problematic, the officer must ensure that corrective measures are taken, which could include modifying the software or decommissioning the system entirely.

Validation and impact assessments

Before any new AI system can be deployed or an existing one modified, telecom entities must conduct mandatory validation and impact assessments. These assessments are designed to check the accuracy, robustness, and explainability of the AI. They also need to test for resilience against model drift, which is when an AI's performance degrades over time as it encounters new data.

The regulator also wants to ensure that these systems are fair and do not produce biased results. By requiring these assessments upfront, the guidelines aim to prevent companies from deploying

Who is affected by the rules

The proposed guidelines are not just for the major telecom giants. They are intended to apply to any entity that holds a license under the Telegraph Act of 1885 or an authorization under the Telecommunications Act of 2023. This includes any organization that provides telecom services or establishes and operates communications networks.

Essentially, any company that intends to use AI systems in their networks or services will fall under these rules. This broad scope ensures that as the industry evolves, the safety standards remain consistent across all providers. The regulator is seeking stakeholder comments on these draft guidelines until November 27 to refine the rules before they are finalized.

By creating a standardized set of rules, TRAI aims to provide a predictable environment for companies to innovate. While the rules impose new requirements for inventories and committees, they also provide a clear roadmap for how to use AI responsibly. This balance is intended to help the sector grow while protecting the public from the risks of unmonitored automated systems.