India's telecom regulator proposes AI risk policies for operators

The push for responsible AI

The Telecom Regulatory Authority of India (Trai) recently released draft guidelines aimed at governing how telecom operators use artificial intelligence. As these companies increasingly rely on AI for tasks like traffic optimization, predictive maintenance, and customer service, the regulator wants to ensure these tools are used safely. The proposal seeks to extend the government's broader India AI Governance framework into the specific telecom sector.

Trai noted that the rapid adoption of AI brings significant risks to the country's digital infrastructure. Because telecom networks are critical to national connectivity, the regulator is concerned about potential cybersecurity threats, system failures, and algorithmic bias. AI is now a double-edged sword, being used both to defend against security threats and to launch more sophisticated cyberattacks.

The draft guidelines highlight specific technical risks that could harm network resilience. These include 'model drift,' which is when an AI's behavior changes over time in unintended ways, and adversarial attacks intended to trick the system. Trai wants to ensure that these issues do not disrupt the core components of telecommunications infrastructure.

New rules for operator accountability

Under the proposed rules, every telecom operator would need to create an internal AI policy that is officially approved by its board of directors. This policy must categorize every AI system used by the company into three risk levels: high, medium, or low. These categories are determined by how much the system affects financial outcomes, network operations, and the general consumer experience.

A key feature of the proposal is the principle of strict accountability. Trai stated that operators will be responsible for the outcomes of all AI systems they use, regardless of whether the company built the software internally or bought it from a third-party vendor. This means a company cannot shift the blame to a software supplier if an AI tool causes a service disruption or a data breach.

To manage these systems, operators must appoint a designated officer to approve the use of any AI tool. They are also required to file their internal policies with Trai within seven working days of them going into effect. Furthermore, these policies cannot remain static; they must be reviewed by the company at least once every fiscal year to stay current with new technology.

Incident reporting and oversight

The regulator is proposing a structured way to record and analyze AI-related incidents. These incidents would be sorted into four categories based on severity: critical, high, moderate, and low. Any incident deemed critical or high-severity would have to be reported to Trai in a specific format within a set timeframe.

Beyond reporting, telecom companies would need to keep a central database of all AI incidents. They must also maintain a separate record specifically for harms reported by consumers, including a log of how those issues were resolved. Trai wants to ensure that any AI-related harms reported by users are addressed within a reasonable timeframe using a predefined grievance redressal mechanism.

To facilitate this, companies would be required to establish an AI Governance and Safety Committee. This committee must include representatives from various departments, such as network operations, IT, data management, and consumer affairs. It would be led by a senior executive who serves as the AI governance and safety officer to oversee the entire lifecycle of the company's AI tools.

Data integrity and due diligence

The guidelines place a heavy emphasis on data protection and transparency. Operators must ensure that any data used to train or run AI systems is collected, shared, and disposed of according to existing privacy and cybersecurity laws. This includes maintaining an updated inventory of all AI systems, whether they are currently active, inactive, or have been decommissioned.

Before bringing in new technology, telecom companies would be required to perform due diligence on third-party suppliers. They must also conduct validation, conformity, and impact assessments before they deploy a new AI system or make significant changes to an existing one. This proactive approach is designed to catch vulnerabilities before they can affect the public.

While these rules sound strict, some officials describe them as 'light-touch regulation.' Satya N. Gupta, a former principal adviser at Trai, noted that the guidelines are more of a code of conduct than a set of mandates. The goal is to provide best practices for operators who are already working to protect their systems against AI-related threats without creating excessive red tape.