TRAI's Draft AI Rules Would Make Indian Telcos Answerable for Vendors' AI and Require Them to Report Serious AI Incidents
The Telecom Regulatory Authority of India published draft guidelines on October 30 that would require telecom operators and other authorised entities using AI to adopt a board-approved AI policy, classify AI systems by risk, keep an inventory and an incident database, set up an AI governance committee, and report critical and high-severity AI incidents to TRAI. Operators would be accountable for AI outcomes whether systems are built in-house or bought from suppliers. Comments are due by November 27.
India's telecom regulator has turned the government's AI governance guidelines into proposed obligations for one sector, and its sharpest clause is about suppliers. Draft guidelines published by the Telecom Regulatory Authority of India (TRAI) on October 30 say telecom operators "shall be accountable for the outcome of all AI systems used by it, irrespective of whether the AI systems are developed internally, procured/ outsourced from third party or a combination thereof." The draft would push that accountability back to vendors through contracts and due diligence. Written comments are due by November 27.
Who it covers#
The draft applies to any entity that holds a licence under the Telegraph Act, 1885, or an authorisation under the Telecommunications Act, 2023, to provide telecom services or run telecom networks, and that uses or intends to use AI in those networks or services. TRAI says the guidelines implement the India AI Governance Guidelines that the government released in February 2026.
What operators would have to do#
Each operator would need an internal AI policy approved by its board or equivalent governing body. The policy would have to:
- classify every AI system as high, medium or low risk, based on its significance to the network and services, its financial and operational impact, and its implications for consumers;
- allow AI systems to be used only after approval by a designated officer;
- sort AI incidents into critical, high, moderate and low severity;
- record, investigate and mitigate incidents under predefined procedures, and report critical and high-severity incidents to TRAI "in a prescribed format, manner and timeframe";
- provide human oversight, data governance and a grievance process for AI-related harms reported by users.
The policy and any amendments would be filed with TRAI within seven working days of taking effect and reviewed at least once a financial year. Operators would also keep an inventory of all active, inactive and decommissioned AI systems; no system could be used unless it is listed. Before deployment, new or modified systems would need validation, a conformity assessment covering accuracy, robustness, explainability, fairness, drift resilience and human oversight, and an impact assessment. TRAI points to the Telecommunication Engineering Centre's standard 57050:2023 for fairness and its 57090:2025 incident-database taxonomy as possible references.
An AI Governance and Safety Committee, headed by a senior executive designated as the AI Governance and Safety Officer, would review deployed systems at least once a financial year and order fixes or decommissioning where needed.
The vendor clause#
Operators would have to run due diligence before buying third-party AI, covering the supplier's credibility, the soundness and limits of the system, and the quality of its training data. They would have to obtain AI disclosures from suppliers when buying equipment with embedded AI, and write enforceable provisions on compliance, audit and inspection rights, incident management and accountability into supplier agreements before deployment. By our reading, network-equipment makers and AI vendors selling into Indian telecom would face audit rights and incident duties written into their contracts at the regulator's direction, even though the draft does not apply to them directly.
The Hindu, carrying a PTI report, described the draft as a comprehensive framework. It arrives as the IT ministry prepares a consultation paper on a broader AI law, and after CERT-In reported that AI agents under test had exceeded their tasks on Indian organisations' live systems.
Limits#
- This is a consultation draft. Its wording, scope and obligations may change after comments.
- The draft leaves the format, manner and timeframe for incident reports to be prescribed later, and says contraventions will be dealt with under existing law rather than setting new penalties.
- The draft does not say when final guidelines would take effect.