India's TRAI Proposes Board Approved AI Policies and Serious Incident Reporting for Telcos

India's telecom regulator has moved to turn responsible artificial intelligence from a voluntary aspiration into a formal governance expectation for the companies that run the country's networks. On October 30, 2026, the Telecom Regulatory Authority of India released draft Guidelines on Responsible Use of Artificial Intelligence in Telecommunication Networks and Provision of Telecommunication Services. The draft is open for stakeholder comment until November 27, 2026, and it sets out how operators should govern, document, oversee and report on the AI systems they use.

The backdrop is the India AI Governance Guidelines, which the Government of India released in February 2026. Those guidelines rest on seven guiding sutras: Trust is the Foundation, People First, Innovation over Restraint, Fairness and Equity, Accountability, Understandable by Design, and Safety, Resilience and Sustainability. Part 4 of that document offers practical guidance for industry actors and regulators, with the stated aim of increasing clarity, predictability and accountability.

TRAI frames telecom as a central piece of India's digital infrastructure. It supports public connectivity, the delivery of public and essential e-services, trade and commerce, and the secure functioning of critical information infrastructure. The regulator also links the sector to national security and emergency response, which helps explain why it is treating AI deployment in networks as a governance question rather than a purely commercial one.

AI is already woven into network management, traffic optimisation, predictive maintenance and customer service, according to Mint. That spread creates a practical problem: the same tools that can improve reliability and cut costs can also fail quietly, distort service decisions or harm consumers. The draft tries to address that problem through board level policies, risk classification, designated accountability and incident reporting.

Key Facts

The core obligation is an internal AI policy approved by an operator's board or equivalent governing body. Mint reported on October 30, 2026, that the policy must be filed with TRAI within seven working days of taking effect and reviewed at least once every fiscal year. The policy is expected to cover risk classification, deployment approvals, incident management, human oversight, data governance and consumer grievance redressal.

Operators would have to sort AI systems into three risk tiers: high risk, medium risk and low risk. The classification would depend on the importance of a system to network operations, its effect on financial and operational outcomes, and its potential impact on consumers. Before any AI system is used, a designated officer must approve it. The draft also calls for an updated inventory of active, inactive and decommissioned systems, due diligence before buying third party AI, and validation and impact assessments before deployment.

Accountability is written broadly. The Hindu reported on October 30, 2026, that the authorised entity remains responsible for the outcome of every AI system it uses, irrespective of whether the system is developed internally, procured or outsourced from a third party, or built through a combination of those routes. The same report noted that all AI systems would be subject to appropriate human oversight under a predefined mechanism.

Incident handling is the sharpest operational requirement. The draft creates four severity categories: critical, high, moderate and low. Critical and high severity incidents must be reported to TRAI in a prescribed format, manner and timeframe. Operators must also keep a central database of AI incidents and a separate record of consumer reported AI harm, with mechanisms for investigation, mitigation and resolution.

Governance does not stop at the board. Each operator would need an AI Governance and Safety Committee chaired by a designated AI governance and safety officer. That committee would review deployed systems at least once a fiscal year. The Telecom Regulatory Authority of India said on October 30, 2026, in Press Release No. 145/2026, that written comments may be sent to Shri Akhilesh Kumar Trivedi, Advisor for Networks, Spectrum and Licensing, at [email protected]. The release was signed by Harinder Kumar, Secretary, TRAI.

Analysis

The draft is not a final rule, and its language repeatedly leaves room for consultation. Even so, its direction is clear. What this really means is that India is moving responsible AI in telecom from a principle that operators may adopt at their discretion to a governance obligation that regulators can inspect, question and enforce through disclosure. The combination of board approval, a named officer, a committee, risk tiers and incident reports creates an audit trail that did not previously exist in a standardised form.

The Hindu BusinessLine reported on October 30, 2026, that the regulator is shifting responsible AI deployment toward a formal governance and compliance obligation for the Indian telecom industry. The same report said the draft applies whether models are built internally or outsourced from third party vendors. That choice matters because outsourcing is often treated as a way to transfer operational risk. The draft keeps the accountability with the authorised entity, so a vendor contract cannot become a shield against regulatory scrutiny.

The three tier risk model also gives TRAI a way to prioritise. High risk systems tied to network operations or consumer outcomes would attract more scrutiny, while low risk tools could move with lighter process. The four incident severities do similar work on the reporting side: critical and high severity cases go to the regulator, while moderate and low cases remain in the operator's own records. This is a graduated regime, not a blanket ban, and that design is likely to be central to how operators respond during consultation.

The compliance burden is real. BusinessLine noted that in the medium term the framework could raise compliance expenditure for telecom companies while creating business opportunities for AI governance, cybersecurity, testing, audit and specialised telecom software firms. That trade off is familiar in regulated industries: the largest operators can absorb new documentation, committee and reporting costs, while smaller participants may find the fixed costs harder to carry. The consultation is likely to become a forum for competing claims about how heavy the burden will be.

Why It Matters

Telecom networks sit beneath a large share of everyday digital activity, including phone banking, enterprise services and financial services. The Hindu BusinessLine cited an industry veteran who argued that recent cybersecurity incidents, including exposures involving PHP vulnerabilities, eMudhra certificates and SBI customer data, help explain the regulatory push. The argument is that telcos operate at the backend of many critical services and should be accountable when something goes wrong.

The draft also matters because it converts the India AI Governance Guidelines into sector specific expectations. The seven sutras are broad principles. Board approved policies, risk tiers, human oversight, inventories, grievance channels and incident reporting are the mechanisms that make those principles operational. If the framework survives consultation in roughly its current form, telecom would have a detailed, inspectable AI governance stack.

For consumers, the most visible change may be the grievance route. Operators would have to resolve user reported AI harms through a predefined mechanism and keep a separate record of those complaints. That does not guarantee remedies, and the draft does not set compensation or service level standards. It does, however, create a paper trail that regulators and auditors could use to test whether an operator knew about a problem and what it did next.

Next Up

The immediate next step is the comment window, which closes on November 27, 2026. Operators, vendors, consumer groups and governance specialists are expected to focus on definitions, the boundary between the three risk tiers, the test for a reportable incident and the practical meaning of human oversight. The draft's treatment of third party AI and its seven working day filing requirement are also likely to draw comments, because both create fixed obligations that operators will need to build into procurement and compliance processes.

After the comment period, TRAI will decide whether to revise the draft and how quickly to move toward final guidelines. No final rule has been issued, and no compliance deadline beyond the comment date appears in the materials released on October 30, 2026. For now, the document is a consultation paper with a clear signal: India wants telecom operators to treat AI as a governed system, not an invisible feature.