TRAI proposes board-approved AI policies, risk classification and mandatory incident reporting for telecom operators

New Delhi: The Telecom Regulatory Authority of India (Trai) has proposed that telecom operators and network providers using artificial intelligence (AI) put in place board-approved policies governing its use, classify AI systems according to risk and report critical and high-severity incidents to the regulator.

The proposals form part of Trai's draft guidelines on the responsible use of AI in telecommunication networks and services, which was released on Friday.

The framework will apply to entities holding a telecom service licence or authorisation, as well as those authorised to establish, operate, maintain or expand telecom networks, if they use or intend to use AI.


Under the proposed norms, each entity will have to classify its AI systems as high, medium or low risk, based on their significance to network operations and service delivery, their impact on financial and operational outcomes, and potential implications for consumers.

The use of any AI system will require approval from a designated officer, with the level of approval potentially varying according to its risk classification.

The internal policy will also have to provide for human oversight, data governance, consumer protection and grievance redressal.

AI-related harms reported by users will have to be addressed within a reasonable time frame through a predefined mechanism.

Telecom entities will be required to maintain an up-to-date inventory of all active, inactive and decommissioned AI systems, recording their source, purpose and risk classification. No AI system can be used unless it is included in this inventory.

Before deploying a new AI system or modifying an existing one, companies will have to undertake validation, conformity and impact assessments covering parameters such as accuracy, robustness, explainability, fairness and resilience to model drift.

The draft also proposes a formal mechanism to record, investigate and mitigate AI incidents.

Companies will have to maintain a central database of incidents, classify them by severity and follow predefined standard operating procedures to address disruptions. Critical and high-severity incidents, including material malfunctions and recurring failures, will have to be reported to Trai in a prescribed format and time frame.

To oversee compliance, each entity will have to establish an AI Governance and Safety Committee with board approval.

The committee will include representation from network operations, service delivery, information technology, data management, regulatory affairs and consumer affairs. It will be headed by a senior executive designated as the AI Governance and Safety Officer. The committee will review AI system performance at least once every financial year and identify vulnerabilities, weaknesses in oversight, fairness concerns and emerging risks. Corrective action could include modifying or decommissioning an AI system.

The draft makes the applicable telecom entity accountable for the outcomes of all AI systems it uses, whether developed in-house or procured from third parties.

Internal AI policies and subsequent amendments will have to be filed with Trai within seven working days of coming into effect.