On 30 October 2026 the Telecom Regulatory Authority of India published its Draft Guidelines on Responsible Use of Artificial Intelligence in Telecommunication Networks and Provision of Telecommunication Services. Written comments are due by 27 November 2026. The draft is a sensible way to govern a sector where AI already touches network operations and consumer outcomes. Its weak points are details left undefined, not its direction.
The strongest case for the draft
Telecom networks are critical infrastructure. The draft itself says the sector underpins public e-services, trade and emergency response (para 1.2), and warns that bias, model drift and adversarial attacks can degrade resilience (para 1.3). If an operator buys an AI-driven network optimiser or fraud filter from a vendor, a failure still lands on subscribers and on the network. Regulators are right to say the licensee cannot point at the supplier.
The draft says exactly that. Under para 3.8, the authorised entity "shall be accountable for the outcome of all AI systems used by it, irrespective of whether the AI systems are developed internally, procured/outsourced from third party or a combination thereof." That is a sound allocation of responsibility. The licensee holds the licence, the customer relationship and the contracts, so it is best placed to manage the risk.
What the draft actually requires
The draft applies to entities holding a licence under the Telegraph Act, 1885 or an authorisation under the Telecommunications Act, 2023 that use or intend to use AI (para 2.1). It requires:
- A board-approved internal AI policy (para 3.1), filed with TRAI within seven working days of taking effect (para 3.4) and reviewed at least once a financial year.
- Risk classification of every AI system as high, medium or low, based on its materiality, including its financial, operational and consumer impact (para 3.2(a)).
- An inventory of active, inactive and decommissioned systems, with the rule that "no AI system shall be used unless it is a part of the inventory" (para 3.5(a)).
- Pre-deployment validation and conformity assessment covering accuracy, robustness, explainability, fairness and drift resilience (para 3.5(c)).
- Third-party controls: supplier due diligence, disclosure of AI embedded in equipment, and enforceable audit and incident clauses in vendor contracts (paras 3.5(b), (e), (f)).
- Incident handling: a central incident database, four severity tiers, and reporting of critical and high-severity incidents to TRAI "in a prescribed form, manner, and timeframe" (paras 3.2(c)-(d), 3.9).
- An AI Governance and Safety Committee led by a senior executive (paras 3.6-3.7).
The draft creates no new penalty. Para 3.11 says contraventions arising from AI systems are handled under existing law. TRAI is proposing a governance standard, not a licensing bar or a fine schedule.
Why this is better than the alternative TRAI once floated
In July 2023, TRAI recommended a cross-sector framework and an independent statutory body, the Artificial Intelligence and Data Authority of India. MediaNama's report noted the proposal came with "legally binding obligations" for high-risk uses. The 2026 draft is a different instrument. It is sector-specific and risk-tiered, and it ties itself to the February 2026 India AI Governance Guidelines, whose principles include "Innovation over Restraint" (para 1.1). A new regulator would have added cost and delay. Using an existing sector regulator and licence conditions is the proportionate route.
Where the draft needs work
The AI definition is very broad. An AI system is any machine-based system that "infers, from the input it receives, how to generate output such as predictions, content, recommendations, or decisions" (definitions, item 2). Read literally, that could include long-standing statistical traffic-prediction or fault-detection tools. Combined with the rule that nothing runs unless inventoried, a broad definition invites compliance work on low-stakes tools. TRAI should confirm that low-risk systems get a light-touch path, since the tiering only helps if the low tier is actually light.
"Prescribed" details are deferred. Incident reporting timelines, the format of the AI incident record and the "predefined mechanism" for human oversight are all left to later. Operators cannot judge the burden of a reporting duty without knowing the deadline. A 24-hour clock and a 30-day clock are very different obligations. These parameters should be consulted on before the guidelines are finalised, not set afterwards.
Legal status is ambiguous. The text uses "shall" throughout, yet calls itself guidelines and adds no penalty. TRAI grounds them in its Act's quality-of-service mandate (para 1.4). Operators and vendors need to know whether non-compliance is a licence breach, a reputational matter or neither. Binding-in-practice rules without a defined enforcement path are the worst combination for predictability.
Vendor-contract mandates hit smaller players hardest. Large operators can renegotiate supplier agreements for audit rights and risk allocation. Smaller vendors and Indian start-ups may lack the leverage or capacity to accept them. TRAI should consider a proportionate approach for low-risk systems, or recognise existing standards such as the TEC fairness standard the draft already cites, so that compliance is not bespoke for every contract.
What to watch
The first test is whether the final text keeps the principle of operator accountability while narrowing the scope to systems that matter. The second is whether TRAI publishes the incident-reporting format before or alongside the final guidelines. Stakeholders should use the consultation to ask for both, with comments to be sent as requested by 27 November 2026.
The approach has a sound core: clear responsibility, risk-tiered effort and no new penalties. Its value will depend on whether TRAI fills in the remaining blanks with the same restraint.