TRAI Drafts AI Disclosure Rules for Telecom Network Vendors

If you run a telecom network in India and you're about to buy new equipment, TRAI wants you to start asking an uncomfortable question first: what AI is built into this box, and what happens when it gets something wrong?

What TRAI is actually proposing

The Telecom Regulatory Authority of India put out draft guidelines on October 30 on what it's calling responsible AI in telecom networks, and it's taking public comments until November 27. Nothing here is law yet, but the direction is clear. The core idea: when a telecom operator buys network equipment, software, or services that have AI quietly built in, known as embedded AI, meaning the AI ships as part of the product rather than being something the operator built itself, the operator has to get a proper disclosure from the vendor about what that AI does, what data it touches, and how it can fail. The draft also wants enforceable contract terms with suppliers covering compliance, audit rights, and how incidents get handled.

Who answers when it breaks

The more interesting part is accountability. Under the draft, the operator running the network answers for what its AI does, whether that AI was built in-house or bought off a vendor's shelf. That closes off a familiar excuse: a telco can't just point at a supplier and say it's not our problem. Critical and high-severity incidents, think recurring malfunctions or failures that actually affect service, would have to be reported to TRAI, and operators would need a board-approved internal AI policy with records to show they're actually following it.

What the draft doesn't yet nail down is just as telling. It doesn't define what counts as critical versus high severity, doesn't set a reporting deadline or format, and doesn't lay out what an operator can do if a vendor simply refuses to accept liability or open its systems to audit.

A rulebook that tells an operator to audit someone else's AI, but is silent on what happens when that audit finds a real problem, is only half a rulebook.

Regulation by sector, not by statute

What makes this worth watching is how it's happening. India still doesn't have a dedicated AI law. Instead of one umbrella act, like the EU's AI Act, which sorts AI systems into risk tiers and attaches specific obligations to each tier, India keeps handing the job to whichever regulator oversees that slice of the economy. We've already covered how India's rules on labelling AI-generated content already go further than what the EU requires from chatbot makers. Now it's TRAI's turn, aiming squarely at telecom infrastructure.

• EU AI Act: one comprehensive law, AI systems classified by risk level with matching obligations
• India so far: sector-by-sector rules, TRAI for telecom AI, separate IT rules and MeitY advisories for AI content labelling, no single AI statute
• TRAI's draft: open for public comment until November 27, 2026, still subject to change
• No penalty framework spelled out yet for operators that ignore the rules

What it means if you're an Indian telecom user

This sounds abstract until you realise how much AI already quietly runs India's networks. Spam and fraud-call filtering, the kind of system behind TRAI's own push earlier this month to get Truecaller sharing its spam data with telcos, network optimisation that decides which tower picks up your call, SIM-swap fraud detection, all of it runs on models an operator usually didn't build itself. When one of those systems misfires at scale, wrongly flags a number as spam, drops calls during a flood, misroutes an emergency line, Indian subscribers are the ones who feel it, not the vendor halfway around the world who wrote the code. Making operators actually understand, document, and audit that AI gives regulators someone concrete to hold responsible instead of a shrug and a reference to "the algorithm." It also raises the bar for India's own network-software vendors feeding Reliance Jio, Airtel, Vodafone Idea, and BSNL, since selling into the world's second-largest telecom market will increasingly mean being able to answer TRAI's questions, not just the operator's.

The draft won't have teeth until the comment window closes and TRAI decides what, if anything, happens to an operator that ignores it. But the signal is already out: in Indian telecom, "our vendor's AI did it" is not going to be an answer regulators accept much longer.