On 2 November 2026 the Telecom Regulatory Authority of India issued the Telecom Consumers Complaint Redressal (Fourth Amendment) Regulations, 2026. The regulator's own press release, No. 146/2026, says complaint-centre support must run round the clock, instead of the existing 16-hour arrangement. It may be delivered through "human representatives, automated systems, AI agents, other customer-centric technological solutions, or a combination thereof." Humans must be available for at least 16 hours daily, and technology-based solutions "shall function with appropriate human oversight."
The direction is right. Two gaps are worth fixing before the rules bed in: what "oversight" means, and how complaint-handling AI should treat subscribers' personal data.
The case for the rules
The strongest argument for TRAI's approach is that it responds to a real consumer problem. A subscriber whose connection fails at 2 a.m. gets nothing from a complaint centre that opens at 8. TRAI also did not write the amendment in a hurry. According to the press release, it published a draft on 7 May 2026, received 32 comments and 24 counter-comments, and held an open house discussion on 17 July. Making round-the-clock availability the floor, while letting operators decide how to staff it, is the kind of outcome-based rule this publication favours. It does not dictate a technology, and it does not freeze headcount.
The package goes beyond AI. Appeals must now be filed within 15 days instead of 30. The Advisory Committee stage is scrapped, and the Appellate Authority must decide within 15 days. Operators must run a five-point feedback survey after each resolved complaint and publish the results quarterly. They must also put a quarterly report before their CEO or board and set up a Consumer Grievance Redressal Oversight Committee with consumer-organisation representatives. TRAI may audit records and impose financial disincentives for non-compliant disposals. The rules apply to ISPs with more than 10,000 subscribers at the end of the previous financial year. The old alternative test of turnover above ₹5 crore is dropped.
Where the rules are thin
"Appropriate human oversight" is undefined. MediaNama's reading is that it is unclear whether a human must review each AI decision, sample conversations, or step in only on escalation. Those are very different compliance burdens. A cautious operator may over-build review and give up the savings that justified automation. A less careful one may treat a nominal supervisor as enough. The 16-hour human-availability rule is measurable. The oversight rule is not, and neither operators nor auditors can tell what a passing record looks like.
The personal-data question is not addressed in the features TRAI lists. A complaint is rarely just a ticket. It carries a name, a number, a billing address, usage records and sometimes identity documents. An AI agent that handles it will process, and probably store, all of that. The Digital Personal Data Protection Act, 2023, already assigns responsibility. Section 8(1) makes a Data Fiduciary responsible for compliance "irrespective of any agreement to the contrary", including for processing by its Data Processor. Section 8(5) requires "reasonable security safeguards" over data handled by it or on its behalf. Section 8(3) requires completeness, accuracy and consistency where data is likely to be used to make a decision affecting the individual. That wording plainly fits an AI agent that decides whether a complaint is resolved. But the Act sets no human-review standard, and the amendment does not link the two regimes.
Timing matters too. According to MediaNama's explainer, the DPDP Rules were published on 13 November 2025. The main fiduciary obligations, under Rules 3, 5 to 16, 22 and 23, take effect 18 months after publication, which MediaNama's arithmetic puts at around May 2027. Operators will therefore be deploying complaint-handling AI before the full duties apply. Contracts with AI vendors, retention periods for call transcripts and breach processes are being set now, and nobody can yet say how a regulator will read them.
What a proportionate fix looks like
There is no need to reopen the regulations or add a licensing regime for complaint bots. Three light-touch steps would help.
- Publish an oversight standard. TRAI can issue a short clarification, or use its audit power, to say what evidence of oversight it will accept. Examples are escalation rates, sampled-transcript reviews and a named accountable officer. Defining outcomes keeps the rule technology-neutral.
- Cross-reference the Act. One sentence confirming that complaint-handling AI is covered by the Section 8 duties would add no new obligation. It would remove the doubt about whether telecom rules and data-protection law operate separately.
- Use the audit window. The new Regulatory Review lets TRAI inspect records and analyse quarterly performance reports. Asking operators to report AI-handled versus human-handled resolution rates, alongside the feedback scores, would give regulators evidence on whether automation helps or hurts consumers.
This is also a separate matter from TRAI's 30 October draft on AI accountability in telecom networks. The complaint rules are final and in force, while the draft is still being consulted on.
The bottom line
Allowing AI agents in customer support, subject to a human-availability floor, is a pragmatic way to deliver 24x7 service without pushing up costs. The risk is the usual one with outcome-based rules: ambiguity. Without a workable meaning for "oversight" and a clear link to the DPDP Act, operators will guess, and consumers will find out what the guess was only after a data incident. A short clarification from TRAI now would protect both the innovation and the subscribers.