India’s telecom regulator proposes a risk register and incident reporting for AI

TRAI published draft responsible-AI guidance for telecom networks and services for consultation.

The Telecom Regulatory Authority of India opened a consultation on October 30 on how authorized telecom entities should govern AI used in networks or service delivery. It is accepting written comments through November 27. The draft applies the national AI governance framework to an industry that carries essential services and emergency communications, where a mistake in a network function can affect many users at once. [TRAI consultation](https://www.trai.gov.in/draft-guidelines-responsible-use-artificial-intelligence-ai-telecommunication-networks-and) · [Ministry of Communications announcement](https://www.pib.gov.in/PressReleaseIframePage.aspx?PRID=2330429&lang=2&reg=48)

Operators would have to know which systems they rely on

The draft covers holders of specified telecom licenses or authorizations that use or plan to use AI in networks, services or both. An operator would need a policy approved by its board or equivalent governing body, and an inventory covering active, inactive and retired systems. Each entry would record the system’s origin, purpose and risk tier. The proposed tiers are high, medium and low, based on how significant the system is to operations and on its potential impact on finances and customers. An appointed officer would approve use, with delegation possible according to risk. [Draft, sections 2 and 3A–B](https://trai.gov.in/sites/default/files/2026-10/Draft_CP_30102026.pdf#page=4)

This approach would put new deployments and material changes in front of reviewers before use. The draft calls for validation and assessments that examine accuracy, robustness, fairness and how a system behaves as inputs or conditions change. Where a supplier embeds AI in equipment or software, the buyer would seek disclosures and put audit, incident-handling and accountability terms in its contract. The authorized entity would remain responsible for the outcomes of systems it uses, including those it buys or outsources. [Draft, sections 3B and 3D](https://trai.gov.in/sites/default/files/2026-10/Draft_CP_30102026.pdf#page=7)

System risk and incident severity serve different purposes

The proposal uses four severity levels for incidents. Operators would record all incidents centrally, including those during testing, and notify TRAI of those rated critical or high. A board-approved governance and safety committee, led by a senior executive, would review performance and incident records and follow up on corrective action. The draft also calls for a process to handle AI-related harm reported by users. [Draft, sections 3A–D](https://trai.gov.in/sites/default/files/2026-10/Draft_CP_30102026.pdf#page=6)

The distinction matters when a tool crosses from advising staff to influencing network operations. The initial risk tier concerns what the system can affect. The incident rating concerns what happened in a particular failure. In a consultation response, an operator or consumer group can use that distinction to test whether the proposed approval, oversight and notification steps are clear enough for real cases. The October document is a proposal under consultation, and TRAI says it will post submitted comments on its website. [TRAI consultation paper](https://trai.gov.in/sites/default/files/2026-10/Draft_CP_30102026.pdf#page=2)