TRAI proposes AI rules for telecom operators: risk ratings, an AI inventory and failure reporting

India's telecom regulator wants every operator to keep a list of the AI systems running in its network, rate each one by risk, and tell TRAI when one fails badly. That is the core of draft guidelines TRAI released on 30 October 2026 for public comment.¹² Comments are due by 27 November.¹²

These would be TRAI's first AI rules. They apply only to companies it already regulates: licence holders under the Indian Telegraph Act, 1885, and companies authorised under the Telecommunications Act, 2023, wherever they use or plan to use AI.²

The rules operators would have to follow

The heaviest part of the draft is record-keeping. No AI system could go live unless it sits on a central inventory and a designated officer has cleared it.² Each system gets a high, medium or low risk rating, based on how important it is to the network, how it affects money and operations, and what it means for customers.²

Before a system is deployed or changed, the operator would test it for accuracy, robustness, explainability and fairness, plus how it holds up as the model drifts over time.² Policies and risk ratings would be reviewed at least once every financial year.²

Governance gets its own layer. Each operator would set up an AI Governance and Safety Committee led by a senior executive, adopt a board-approved AI policy, and file that policy with TRAI within seven working days of it taking effect.²

Operators answer for their vendors' AI too

This is the clause that will matter most to the big three operators. The draft says an operator "shall be accountable for the outcome of all AI systems used by it", whether it built the system, bought it, or mixed the two.²

So supplier contracts would change. Operators would have to check a vendor's credibility and the quality of its training data, get disclosures about AI built into equipment, and write audit rights and incident rules into contracts.² ThePrint notes that Indian operators rely heavily on foreign equipment makers, which makes those clauses harder to negotiate than they sound.²

Reporting failures, with details still to come

Operators would report critical and high-severity AI failures to TRAI, including recurring problems and what they did to fix them.² But the draft leaves the reporting format, the deadline and even the definitions of "critical" and "high" to be set later.²

Customers get a complaints route for harm caused by AI, and operators would keep a central database of those complaints. They must resolve them within a "reasonable timeframe", which the draft does not define.²

Guidelines without a new law

India has no AI law, and the draft has no penalty clause of its own. Breaches would be handled under existing laws and licence terms.² TRAI points to its power under the TRAI Act, 1997, to set quality-of-service standards.²

The Tribune reports that the draft follows the India AI Governance Guidelines released in February 2026 and is built around seven principles, starting with "Trust is the Foundation" and "People First".¹

There is some history here. In July 2023, TRAI recommended a statutory regulator for AI and data with binding rules for high-risk uses. The government chose not to create one, leaving sector regulators to act, ThePrint reports.² These guidelines are what that looks like in practice.

What operators and vendors should do before 27 November

For an operator's legal and network teams, the practical first step is an honest inventory: which systems already use AI, from spam filters to network tuning tools. ThePrint uses Airtel's AI spam detection system as an example of a tool that would fall in scope.²

Equipment and software vendors selling into Indian telecom should expect new contract questions about training data and incident reporting. The open items, especially severity definitions and deadlines, are where comments are most likely to shape the final rules.

Dates to watch

• 27 November 2026: public comments close.¹²
• Any TRAI note setting the incident reporting format and deadlines.

Related: one hacker's use of AI agents against 100+ websites and India's AI regulation consultation paper.