The Telecom Regulatory Authority of India (TRAI) released draft Guidelines on Responsible Use of Artificial Intelligence (AI) in Telecommunication Networks and Provision of Telecommunication Services on October 30, 2026. Every licensed telecom operator that uses AI would need a board-approved internal AI policy, an inventory of all its AI systems, a high, medium or low risk rating for each, and a central log of AI incidents, with critical and high-severity incidents reported to TRAI. Comments are due by November 27, 2026.
The duties fall on the operator. The reason this matters to a small software company is clause 3.5: the operator has to vet you before buying, collect AI disclosures from you, and write audit rights and incident terms into your contract. If you sell an AI feature into an Indian telco, this draft is the questionnaire you will get next year.
Event date: October 30, 2026 (draft and Press Release No. 145/2026). First report: TRAI's own press release the same day. Comments close November 27, 2026.
Screenshot: TRAI draft guidelines, cover page, trai.gov.in. Captured November 2, 2026.
What TRAI published on October 30
The draft runs to ten numbered pages. TRAI says it is turning the national India AI Governance Guidelines into rules for one sector, because "AI is increasingly being integrated into telecommunication networks and provision of telecommunication services." It names the risks it has in mind: biases that "creep in AI systems during training and usage", model drift, and adversarial attacks, which "can adversely affect the resilience of telecommunications infrastructure."
The text has four parts: an internal AI policy (A), how the operator implements it (B), a committee that oversees it (C), and enforcement (D). The obligations are written as "shall"; "should" appears only twice, for what supplier due diligence includes and for using the TEC 57090 incident schema. The draft does not set a start date, a transition period, or penalties. Its last clause says it does not limit any other law, licence condition or binding direction.
Who it applies to
The draft covers any entity that holds an Indian telecom licence or authorisation, either to provide telecom services or to run telecom networks, and "is using or intending to use AI system(s)" in those networks or services. "Intending to use" matters: an operator that is only piloting an AI tool is in scope.
Vendors are not named as a regulated party. They come in through procurement. Clause 3.8 makes the operator "accountable for the outcome of all AI systems used by it, irrespective of whether the AI systems are developed internally, procured/ outsourced from third party or a combination thereof." An operator that carries the risk for your model will want evidence before it buys and contract terms it can enforce after.
The internal AI policy, clause by clause
The policy must be approved by the operator's board, reviewed at least once a financial year, and filed with TRAI within seven working days of taking effect. It has to cover these items:
| Clause | What the policy must contain | What it means in practice |
|---|---|---|
| 3.2(a) | Risk class for every AI system: high, medium or low, by materiality | Rating turns on impact on "financial and operational outcomes" and on consumers |
| 3.2(b) | Use only after approval by a designated officer | Approval can be delegated by risk class |
| 3.2(c) | Four incident severity levels | Critical, high, moderate, low |
| 3.2(d) | Recording, mitigation, investigation and reporting of incidents | Central database, a written SOP per severity, critical and high incidents to TRAI |
| 3.2(e) | Human oversight for all AI systems | "As per a predefined mechanism" |
| 3.2(f) | Data governance over the whole lifecycle | Collection, use, sharing and disposal under data protection, privacy and cybersecurity law |
| 3.2(g) | Consumer grievance route for AI harms | Resolved "within a reasonable timeframe"; no number given |
Screenshot: TRAI draft guidelines, page 3, clauses 3.1 and 3.2(a). Captured November 2, 2026.
Oversight sits with an AI Governance and Safety Committee (AGSC), set up with board approval and headed by an AI Governance and Safety Officer (AGSO) "who shall be a senior executive." The committee reviews AI performance and incident records at least once a financial year and the officer makes sure fixes, including decommissioning, happen.
What a vendor will be asked for
Clause 3.5 turns the policy into tasks. Four of them land on suppliers:
- Due diligence before purchase (3.5(b)). The operator should check "credibility of the supplier, soundness of the AI system and its limitations, and the suitability and quality of data used for training." Expect questions about training data you may never have documented.
- Disclosures at procurement (3.5(e)). The operator must "obtain disclosures of AI systems along with necessary details from suppliers/ prospective suppliers" when it buys equipment, a system or a solution "embedded with AI system(s)." That reaches network gear with AI features, not only software sold as AI.
- Contract terms before deployment (3.5(f)). Supplier agreements must carry "enforceable provisions" on "regulatory compliance, audit and inspection rights, incident management, risk allocation and accountability" for each AI system bought from a third party.
- Pre-deployment testing (3.5(c)). Validation, conformity assessment and impact assessment before any new system goes live and before any change to an existing one. The conformity assessment covers "accuracy, robustness, explainability, fairness, drift resilience and human oversight." For fairness, the draft points to the Telecommunication Engineering Centre's TEC 57050:2023 standard or an applicable international one.
Screenshot: TRAI draft guidelines, page 5, clauses 3.4 and 3.5(a) to (e). Captured November 2, 2026.
The "modification" trigger in 3.5(c) is the one to plan for. The draft doesn't define "modification", but if your product ships a new model version every few weeks, each release would likely count as one that the operator has to validate before deployment. Agree early on what counts as a modification and what evidence you will hand over with each release.
The inventory rule in 3.5(a) is strict too: "No AI system shall be used unless it is a part of the inventory." Each entry records the system's source, purpose and risk class, and the inventory includes inactive and decommissioned systems. An AI feature switched on inside a product the operator already licenses would likely need its own entry.
Incident reporting: set in principle, not in detail
The operator must keep a central database of AI incidents, "including testing events", and classify them by severity. The draft says incidents "should be recorded" using TEC 57090:2025, the TEC's schema and taxonomy for an AI incident database in telecom and critical digital infrastructure, "or an equivalent taxonomy."
Under 3.9, critical and high-severity incidents, "including material malfunctions, recurring failures, and mitigation measures", go to TRAI "in a prescribed form, manner, and timeframe." The draft does not prescribe any of the three. TRAI says it may use the reports for "sector-wide learning, risk assessment, advisories, preventive measures, and other lawful regulatory purposes."
An AI incident is defined as an event where an AI system "malfunctions, produces unintended outcomes, or behaves unpredictably, potentially causing harm or violating legal rights." That is broad: a chatbot giving a customer a wrong tariff could qualify. For a vendor, the practical question is how fast you tell the operator, because its own reporting clock will start from what it knows.
Screenshot: TRAI draft guidelines, page 6, clauses 3.5(e) to (k) and 3.6. Captured November 2, 2026.
How to comment before November 27
TRAI asks for written comments by November 27, 2026, preferably by email to [email protected], addressed to the Advisor (Networks, Spectrum and Licensing). The draft says comments "will be posted on TRAI's website", so write as if a competitor will read it. The closing line asks stakeholders for "detailed input with justification."
Points a supplier might raise, based on the text: what counts as a "modification" under 3.5(c); whether the disclosure list in 3.5(e) will be standardised or left to each operator; and what the reporting timeframe under 3.9 will be, since vendor contracts will copy it.
What to do now if you sell into Indian telecom
- List every product or feature you supply to an Indian operator that uses AI, including features inside equipment.
- Write a one-page disclosure for each: purpose, model source, training data and its limits, known failure modes, how you test for drift and bias.
- Map your incident severity levels to the draft's four: critical, high, moderate, low.
- Decide what audit and inspection access you can offer, and at what notice, before the operator's lawyers propose it.
- Read TEC 57090:2025 and check whether your incident logs can export to its fields.
Our take
This draft looks more like a bank supervisor's model-risk rulebook than a telecom quality rule: board approval, an inventory, materiality tiers, a named senior officer, incident reporting. The operator carries the policy, the committee and the reporting. For a small supplier, the cost is documentation it may not have written yet, and a validation step before every release.
We would not wait for the final text to start the disclosure pack. The operator's obligations in 3.5(b), (e) and (f) only work if suppliers can answer, and the supplier that already has the answers written down is the easier one to buy from.
What we could not confirm
The draft and the press release say the Government released the India AI Governance Guidelines "in February 2026." The Press Information Bureau release announcing that MeitY "unveiled the India AI Governance Guidelines" is dated November 5, 2025. We could not find which February 2026 event TRAI is referring to.
The two TRAI documents give different phone numbers for the same advisor: the draft lists +91-11-23210481 and the press release lists +91-11-20907758. Email avoids the question.
We found no statement on when the final guidelines would take effect, whether there will be a transition period, or what follows a breach. We also found no published reaction from Indian operators or industry groups as of November 2, 2026.
