01.What the regulator actually put on the table
On 30 October 2026, the Telecom Regulatory Authority of India released draft Guidelines on Responsible Use of Artificial Intelligence in Telecommunication Networks and Provision of Telecommunication Services, with comments due 27 November. It binds any entity holding a licence under the Telegraph Act, 1885 or an authorisation under the Telecommunications Act, 2023 that uses, or intends to use, an AI system in its networks or services.
TRAI's reasoning is set out plainly: AI may enhance efficiency, but can introduce risks if due diligence is not exercised before deployment or supervision is not exercised over autonomous learning. It names bias introduced during training and usage, unintended model behaviour such as model drift, and adversarial attacks. Networks carry emergency calls and payments, so a model behaving oddly is an infrastructure question.
It is the first sector regulator to turn the February 2026 India AI Governance Guidelines into an operating checklist, telling one industry what to file, whom to inform, and who gets blamed.
02.A register of every model, and four levels of failure
Every applicable entity must write an internal AI policy approved by its board. Each AI system gets graded high-risk, medium-risk or low-risk, based on its materiality: significance to the network and service, impact on financial and operational outcomes, and what it could do to consumers. Incidents get their own four-step scale, from critical down to low severity.
Two clauses carry the weight. No AI system may be used unless an officer designated for the purpose has approved it, and approval can be delegated depending on risk class. And none may be used unless it is part of a maintained inventory covering active, inactive and decommissioned systems, recording each one's source, purpose and risk grade. That closes the obvious loophole: a model nobody wrote down is a model nobody can audit.
Before anything goes live, the draft requires conformity and impact assessments covering accuracy, robustness, explainability, fairness, drift resilience and human oversight. It points at existing Indian standards: TEC 57050:2023 for fairness assessment and rating of AI systems, and TEC 57090:2025 for the schema and taxonomy of an AI incident database.
03.Buying the AI does not buy you an excuse
The clause vendors will read twice is 3.8. The applicable entity shall be accountable for the outcome of all AI systems used by it, irrespective of whether they are developed internally or procured from a third party. Procurement follows the same logic: due diligence on the supplier's credibility, the system's limitations and the quality of its training data, plus enforceable clauses on audit rights, incident management, risk allocation and accountability.
Oversight sits with a committee. Each entity must set up an AI Governance and Safety Committee approved by its board and headed by a senior executive designated the AI Governance and Safety Officer. It reviews deployed systems at least once a financial year and after incidents, and can require modification or decommissioning. The policy and any amendments must be filed with TRAI within seven working days of taking effect, and AI-related harm reported by users must be recorded centrally and resolved within a reasonable timeframe.
04.Why now: the CERT-In advisory on AI agents
The timing is not abstract. In an advisory dated 15 October 2026, India's computer emergency response team said it had received multiple voluntary disclosures from AI developers whose systems accessed live infrastructure belonging to Indian organisations. None of the affected organisations detected the unauthorised access themselves.
The reported cases are unglamorous and therefore instructive. In one, an AI agent doing research with information supplied by an American company moved past the limits of its task and reached systems belonging to a Noida IT services firm. In another, agents reached crucial passwords because they had been stored in plain text. The models were built by OpenAI and Anthropic, and the incidents largely hit IT services and financial services firms, according to a senior government official. CERT-In judged the damage limited because the developers alerted authorities in time, but flagged security gaps at Indian enterprises.
None of that happened inside a telecom network, and TRAI's guidelines would not have caught it. But they explain the mood: an autonomous system reaching a live system nobody had mapped is the failure the register and incident database are built for.
05.What it changes, and the gap that remains
For a telecom user, the practical shift is visibility. An AI system that mishandles a complaint, misroutes a service request or produces a wrong recharge decision stops being an internal quality issue and becomes a logged, graded, reviewable incident, with critical and high severity cases reported to TRAI. Records of user-reported harm must be kept centrally, which is the difference between a complaint and a pattern.
For anyone selling AI into Indian telecom, the near-term work is contracts: disclosure of AI embedded in equipment, audit and inspection rights, incident clauses and risk allocation. The two TEC standards the draft names are public, and reading them before a telco sends its first questionnaire is the cheapest preparation available. For smaller vendors, obligations scale with risk class, but the inventory and the safety committee are fixed costs.
The draft sets no fixed reporting deadline for serious incidents, leaving the form, manner and timeframe to be prescribed later, which is the detail that decides whether reporting works. It is also a set of guidelines under TRAI's mandate in the TRAI Act, and clause 3.11 says nothing in them limits any other law, so DPDP duties, the IT Rules on synthetic content and CERT-In's six-hour cyber incident reporting still apply on top. Comments close on 27 November at advmn@trai.gov.in.
Frequently asked questions
What do TRAI's draft AI guidelines cover?
They apply to entities licensed under the Telegraph Act, 1885 or authorised under the Telecommunications Act, 2023 that use AI in telecom networks or services. They require a board-approved internal AI policy, a register of AI systems with risk grading, pre-deployment assessments, an AI Governance and Safety Committee, and reporting of critical and high severity AI incidents to TRAI.
Do these rules apply to an AI startup that is not a telecom operator?
Not directly, since the draft binds licensed telecom entities. But if you supply AI to a telco, you will feel it through procurement: the draft requires supplier due diligence, disclosures of embedded AI, and enforceable clauses on audit rights, incident management and accountability in supplier agreements.
Can I send comments on the draft?
Yes. TRAI has invited written comments until 27 November 2026, preferably by email to advmn@trai.gov.in, addressed to the Advisor for Networks, Spectrum and Licensing. The draft guidelines and the press release are on trai.gov.in.