The draft that India’s telecom regulator released on October 30 starts with a person. Before any AI system runs in a licensed or authorised telecom network, an officer the company has designated for that purpose would have to approve it, and that approval would sit in a policy the company’s board signs.
The Telecom Regulatory Authority of India (TRAI) published draft Guidelines on Responsible Use of Artificial Intelligence in Telecommunication Networks and Provision of Telecommunication Services and is taking written comments until November 27, 2026, according to its press release. The draft would apply to any entity licensed or authorised to provide telecom services or run telecom networks that is using or intends to use AI systems in that work. TRAI presents it as the sector’s way of carrying out the national India AI Governance Guidelines with more clarity, predictability, and accountability.
A designated officer approves each AI system before use
Section 3.2 lists what every operator’s internal AI policy must contain, and item (b) reads plainly: “Any AI system shall be used only after approval by an officer of the applicable authorised entity designated for this purpose.” Approval can be delegated to other officers based on the system’s risk class, and the same section requires every system to be classified as high, medium, or low risk according to its significance to the network or service, its financial and operational impact, and its potential implications for consumers.
The approval is one requirement among several. Each operator would need an internal AI policy approved by its board of directors or an equivalent governing body, reviewed at least once a financial year, and filed with TRAI within seven working days of taking effect. Operators would keep an inventory of all active, inactive, and decommissioned AI systems, and the draft says “No AI system shall be used unless it is a part of the inventory.” Before deploying a new system or modifying an existing one, they would complete validation, conformity assessment, and impact assessment, with the conformity assessment covering accuracy, robustness, explainability, fairness, drift resilience, and human oversight.
Buying the model from a vendor doesn’t move the accountability
Section 3.8 places accountability on the operator, which “shall be accountable for the outcome of all AI systems used by it, irrespective of whether the AI systems are developed internally, procured/ outsourced from third party or a combination thereof.” To make that workable, the draft asks for due diligence before acquisition on the supplier’s credibility, the system’s soundness and limitations, and the training data. It also asks for AI disclosures from suppliers at procurement, along with enforceable contract terms covering regulatory compliance, audit and inspection rights, incident management, risk allocation, and accountability before a third-party system goes live.
Under this draft, an AI feature embedded in purchased network equipment or a customer service platform still falls inside the operator’s accountability, so the purchase order cannot settle the question of who answers for the output. The designated officer’s approval becomes the record that someone inside the operator approved the system’s use.
Oversight after deployment is less specific
The draft is strongest at the moment of deployment and less specific after it. Section 3.2(e) says all AI systems “shall be subject to an appropriate human oversight for risk mitigation as per a predefined mechanism,” and Section 3.5(d) ties the level of oversight to each system’s risk assessment, with categorization reviewed at least once a financial year or in response to specific AI incidents. The text leaves the operator to define who exercises that oversight while a system is running and what decision that person records.
The draft does assign oversight above the system level. An AI Governance and Safety Committee, approved by the board and headed by a senior executive serving as AI Governance and Safety Officer, would review deployed systems and incident records at least once a financial year and whenever else a review is necessary, and that officer would ensure corrective measures up to modifying or decommissioning a system. That committee is a real control, yet it still sits at a distance from a network AI system that keeps producing outputs between reviews.
This is the gap between Responsible AI and AI Governance. Responsible AI is machine checking machine, with humans present in the loop, while AI Governance requires a human with authority who is accountable at defined checkpoints. Checkpoint-Based Governance (CBG) treats that checkpoint as the place where the human governor must be present, documented, and accountable, and approving a system for use is not the same act as accepting what it produces. TRAI has written the first checkpoint into the rule, and the comment period is the chance to ask for the second.
Mandatory approval and the national guidance
The national framework TRAI cites tells sectoral regulators to be careful with this kind of requirement. The India AI Governance Guidelines say proposed AI governance frameworks “should avoid compliance-heavy requirements (for example, mandatory approvals, licensing conditions, etc.) unless deemed necessary.” TRAI’s draft requires an internal approval inside each operator rather than a government license, and it does not say it is invoking that exception. Its introduction does describe the telecom sector as critical not only for social, economic, and commercial activity but also for national security and emergency response, and in our reading that description is what would support treating telecom as a case where a required sign-off is necessary.
The question of whether a named human belongs in AI governance has come up in standards work too. In a September 22, 2026 post, Basil reported that the Technical Advisory Group representing the United States at ISO/TC 258 had rejected his proposed revision to the AI governance definition in ISO/DIS 21520, and the comment form he published states that human control is desirable but not always required for AI governance to exist. TRAI’s text answers that question for one sector by putting a designated officer’s approval ahead of every deployment.
What to build, and what to ask TRAI for, before November 27
Operators and vendors who expect this draft to become final can start by building the approval record the rule assumes: for each AI system in the inventory, the risk class, the designated officer who approved its use, the date, and the conformity assessment the approval relied on. The incident side needs the same discipline, since the draft requires four severity levels, a central incident database, and reports of critical and high severity incidents to TRAI in a format and timeframe it has not yet prescribed.
Comments go to TRAI’s Advisor (Networks, Spectrum and Licensing) at advmn@trai.gov.in. A useful comment would ask TRAI to define, for high-risk systems, which outputs require a named reviewer’s ruling while the system runs, and to require that ruling to be recorded as accept, modify, or reject. It would also ask that the prescribed incident timeframe be set before the guidelines take effect, so operators aren’t building reporting systems before they know the deadline.
India’s draft sets the right starting requirement by refusing to let any AI system into a network without a person on record who allowed it. What it still has to settle is whether anyone stays on record for the decisions that system makes after the approval is signed.
Sources
- Ministry of Electronics and Information Technology, Government of India. (n.d.). India AI governance guidelines: Enabling safe and trusted AI innovation. Press Information Bureau. https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc2025115685601.pdf
- Telecom Regulatory Authority of India. (2026a, October 30). Draft guidelines on responsible use of artificial intelligence (AI) in telecommunication networks and provision of telecommunication services. https://www.trai.gov.in/sites/default/files/2026-10/Draft_CP_30102026.pdf
- Telecom Regulatory Authority of India. (2026b, October 30). TRAI releases draft ‘Guidelines on Responsible Use of Artificial Intelligence (AI) in Telecommunication Networks and Provision of Telecommunication Services’ for stakeholders’ comments (Press Release No. 145/2026). https://www.trai.gov.in/sites/default/files/2026-10/PR_No145of2026.pdf
FAQ
What did TRAI release on October 30, 2026?
The Telecom Regulatory Authority of India released draft Guidelines on Responsible Use of Artificial Intelligence in Telecommunication Networks and Provision of Telecommunication Services for public comment. Written comments are due by November 27, 2026.
Who would the draft guidelines apply to?
They would apply to entities holding a license or authorisation to provide telecommunication services or to establish, operate, maintain, or expand telecommunication networks, when those entities use or intend to use AI systems in that work.
Does the draft require human approval before an AI system is used?
Yes. Section 3.2(b) makes it a required element of each operator’s internal AI policy that any AI system be used only after approval by an officer the operator has designated for that purpose. That approval can be delegated to suitable officers based on the system’s risk classification.
Is a telecom operator responsible for AI it buys from a vendor?
Under Section 3.8 of the draft, the operator is accountable for the outcome of all AI systems it uses, whether they are developed internally, procured or outsourced from a third party, or a combination of both.
What happens when an AI incident occurs under the draft?
Under the draft, operators would classify every AI incident into one of four severity levels and record it in a central database. Critical and high severity incidents, including material malfunctions, recurring failures, and mitigation measures, would be reported to TRAI in a form, manner, and timeframe TRAI will prescribe.
What is missing from the draft from an AI Governance view?
The draft names a human approver before deployment and a senior officer for periodic review, but it leaves operators to define who rules on a high-risk system’s outputs while it runs and what decision that person records. A comment could ask TRAI to require a named reviewer’s accept, modify, or reject ruling for defined high-risk outputs.
AI disclosure: This column was researched and drafted with AI assistance by HAIA Agents (RAI by GrokBot), using primary sources verified at time of publication. #AIgenerated
Leave a Reply