TRAI Draft AI Guidelines for Telecom Licensees: Risk Classes, a Board Policy and Supplier Accountability
A licensee that buys an AI system from a vendor would remain answerable for what it does. That is the organising idea of the TRAI draft AI guidelines, released for consultation on October 30, 2026 with comments due on November 27. They are a draft, they are not in force, and they create no obligation as they stand.
What Was Released, and What It Is Not
The Telecom Regulatory Authority of India released the Draft Guidelines on Responsible Use of Artificial Intelligence in Telecommunication Networks and Provision of Telecommunication Services, dated October 30, 2026. Written comments are invited by November 27, 2026, addressed to the Advisor dealing with networks, spectrum and licensing. The document sets no counter-comment date.
It is a consultation draft. It has not been notified, it is not in force, and the obligations described below are proposals. The draft also sets no penalty of its own: where conduct breaches another law, a licence condition or another binding requirement, that instrument governs, and the draft expressly does not limit those.
Who Would Be Covered
The draft would apply to an entity holding a licence under the Indian Telegraph Act, 1885, or an authorisation under the Telecommunications Act, 2023, to provide telecom services, or an authorisation to establish, operate, maintain or expand telecom networks, where that entity uses or plans to use AI systems.
The phrase plans to use is worth noticing. The governance obligations would attach before deployment rather than on it, which means an entity still evaluating a system would already be inside the framework.
Three Risk Classes, Set by Materiality
Each AI system would be classified as high, medium or low risk according to its materiality. The criteria are its significance to networks and services, its effect on financial and operational outcomes, and its potential consequences for consumers.
Two features follow from that. The classification is about what the system does to the network and to subscribers rather than about the technology used, so a simple model in a critical path can outrank a sophisticated one in a back office. And the consumer limb means a customer-facing system is not low risk merely because the network would survive its failure.
A Board Approved Policy, Filed With the Regulator
An entity would have to adopt an internal AI policy approved by its board or an equivalent body, reviewed at least once a year and whenever otherwise necessary. The policy and every amendment to it would have to be filed with TRAI for record within seven working days of taking effect.
The filing obligation is the operative novelty. A governance policy that exists only internally can be written loosely without consequence. One that is filed with the regulator within a week of taking effect becomes a document the regulator can read back against conduct, which changes how it should be drafted.
An Inventory, and a Bar on Using What Is Not Listed
Entities would maintain an up to date inventory of AI systems, covering active, inactive and decommissioned systems and recording each system's source, purpose and risk class. A system not on the inventory could not be used.
Deployment would also require approval by a designated officer, with the approval authority delegable according to risk class, and validation, conformity assessment and impact assessment would be required before a system is deployed or modified. The modification limb is the one most likely to be missed, because a model update is not usually treated as a deployment event.
Accountability Would Not Travel With the Procurement
An entity would remain accountable for AI system outcomes whether the system was built in-house, outsourced, or developed jointly. Before acquiring one it would have to assess the supplier's credibility, the soundness and limitations of the system, and the quality of the training data.
Supplier contracts would have to carry enforceable terms on regulatory compliance, audit and inspection rights, incident management, and risk allocation and accountability. For anyone negotiating telecom AI supply agreements, that list is the practical content of the draft, because those four terms are among the hardest to negotiate and harder still to obtain after signature.
Incidents, Conformity, and the Standards It Points To
Incidents would be classified as critical, high, moderate or low severity and recorded in a central incident database, using TEC standard 57090:2025 or an equivalent taxonomy. Critical and high severity incidents would be reported to TRAI in a prescribed format and timeframe, with reports covering material malfunctions, recurring failures and mitigation steps.
Conformity assessment would cover accuracy, robustness, explainability, fairness, drift resilience and human oversight, which is itself required under a predefined mechanism at a level set by the risk assessment. TEC standard 57050:2023 is offered for fairness assessment where appropriate. Pointing to published technical standards rather than describing the tests in the text is a drafting choice that makes the obligation testable.
Governance and Consumer Harm
An AI Governance and Safety Committee, headed by a senior executive designated the AI Governance and Safety Officer, would oversee implementation and review the performance of AI systems at least once a year.
On the consumer side, AI-related harms reported by users would have to be resolved within a reasonable timeframe under a predefined grievance mechanism, and a central database would record those reports and their resolution. Compliance records would be produced to TRAI when required.
Key Takeaways
It is a draft, not law: Released on October 30, 2026 for consultation, with comments due November 27, 2026, and no penalty of its own.
Coverage attaches to the licence and to the plan: Entities holding a telecom licence or authorisation that use or plan to use AI systems.
Three risk classes, set by materiality: Significance to networks and services, effect on financial and operational outcomes, and potential consequences for consumers.
The AI policy goes to the board and then to the regulator: Board approved, reviewed at least yearly, and filed with TRAI for record within seven working days of taking effect.
An unlisted system could not be used: The inventory covers active, inactive and decommissioned systems with source, purpose and risk class.
Modification triggers the assessments, not just deployment: Validation, conformity assessment and impact assessment before a system is deployed or modified.
Procurement would not shift accountability: The licensee answers for outcomes whether the system is built, bought or jointly developed, after due diligence on supplier, system and training data.
Four contract terms carry the draft: Regulatory compliance, audit and inspection rights, incident management, and risk allocation and accountability.
Key Statutory Provisions
Draft Guidelines on Responsible Use of Artificial Intelligence in Telecommunication Networks and Provision of Telecommunication Services, dated October 30, 2026: Issued by the Telecom Regulatory Authority of India for consultation, with comments due November 27, 2026. A draft. It proposes a three class risk classification by materiality, a board approved AI policy filed with the regulator within seven working days, an AI system inventory with a bar on using unlisted systems, pre-deployment approval and assessments, accountability for procured systems with prescribed supplier contract terms, a four class incident severity taxonomy with reporting of critical and high severity incidents, conformity assessment against named technical standards, human oversight, a governance committee and officer, and a consumer grievance mechanism with a central database. It prescribes no penalty.
The Indian Telegraph Act, 1885 and the Telecommunications Act, 2023: The sources of the licence or authorisation that would bring an entity within the draft's scope, as the draft's applicability clause describes it.
Sources and References
Report of the release, with the document name and the comment date
Draft Guidelines on Responsible Use of Artificial Intelligence in Telecommunication Networks and Provision of Telecommunication Services, dated October 30, 2026
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.
Comments