India's telecom regulator publishes draft guidelines that would put licensed operators through an AI policy, inventory and incident-reporting regime, with comments due 27 November 2026

A draft, and what it says about itself

The cover reads 'Draft Guidelines for Consultation', dated 30.10.2026, from the Telecom Regulatory Authority of India. Written comments are invited from stakeholders by 27.11.2026, and TRAI says the comments will be posted on its website.

Paragraph 1.4 of the draft says TRAI is making these guidelines in consideration of the India AI Governance Guidelines and the authority's mandate under the TRAI Act. It names section 11(1)(b)(v), the quality-of-service power. That is the stated hook. Whether a quality-of-service provision can carry an AI governance regime with enforceable consequences is a question the draft does not answer, and we do not answer it either.

The closing line asks stakeholders to give 'detailed input with justification'. That is an invitation to argue, and the draft is open about it.

Who the draft would reach

Paragraph 2.1 applies the draft to any entity that holds a license under the Telegraph Act, 1885 or an authorisation under the Telecommunications Act, 2023 to provide telecommunication services, or an authorisation under the 2023 Act to establish, operate, maintain or expand telecommunication networks, and that is using or intending to use AI systems in networks, services, or both.

Note the words 'intending to use'. An operator that has not yet deployed anything but plans to would be inside the scope of the draft as written.

Equipment vendors and AI suppliers are not addressed directly. They show up through the operator's procurement duties, covered below.

The internal policy, the inventory and the approval gate

Under the draft, each in-scope entity would adopt an internal AI policy approved by its board of directors or equivalent body, review it at least once a financial year, and file it with TRAI for record within seven working days of it taking effect (paragraphs 3.1, 3.3, 3.4).

The policy would have to contain seven things: a high, medium and low risk classification of each AI system; approval by a designated officer before any AI system is used; a four-level incident classification; a mechanism for recording, mitigating, investigating and reporting incidents; human oversight; data governance; and a grievance mechanism for AI-related harm reported by users.

The inventory rule is the bluntest sentence in the draft: no AI system may be used unless it appears in the inventory, which would cover active, inactive and decommissioned systems and record source, purpose and risk class (paragraph 3.5(a)). For an operator with AI embedded in network equipment from several vendors, building that list is the first real piece of work.

Before deploying a new system or modifying an existing one, the draft calls for validation, conformity assessment and impact assessment, with conformity assessment covering accuracy, robustness, explainability, fairness, drift resilience and human oversight. It points to TEC standard 57050:2023 for fairness assessment 'or an applicable international standard', as an example.

Incidents: recorded by everyone, reported on two tiers

Every AI incident, including testing events, would go into a central database, ideally using TEC standard 57090:2025 or an equivalent taxonomy (paragraph 3.5(g)). The draft defines an AI incident as an event where an AI system malfunctions, produces unintended outcomes, or behaves unpredictably, potentially causing harm or violating legal rights.

Only critical-severity and high-severity incidents would be reported to TRAI, and the draft says that the report goes in a 'prescribed form, manner, and timeframe' (paragraph 3.9). It does not prescribe them. The draft also says TRAI may use the information for sector-wide learning, risk assessment, advisories and preventive measures.

Nothing in the text defines what separates a critical incident from a high one, or a high one from a moderate one. The operator would draw those lines in its own policy. Comment on this point could change what ends up in a reporting direction.

Vendors, accountability and the governance committee

On third-party systems the draft is specific. Operators would run due diligence before acquisition, get disclosure of AI embedded in telecom equipment from suppliers at the time of procurement, and put 'enforceable provisions' in supplier agreements covering regulatory compliance, audit and inspection rights, incident management, risk allocation and accountability before deployment (paragraph 3.5(b), (e), (f)).

Paragraph 3.8 then says the entity would be accountable for the outcome of all AI systems it uses, whether developed internally, procured from a third party, or both. Read together, those two paragraphs mean a licensee could not point at its vendor. Whether existing supply contracts already carry audit rights of that kind is a matter for contract review, and we have not seen any.

Oversight would sit with an AI Governance and Safety Committee set up with board approval and drawn from network operations, service delivery, IT, data management, regulatory and consumer affairs, headed by an AI Governance and Safety Officer who is a senior executive. The committee would review deployed systems and incident records at least once a financial year, and the officer would see that corrective action, including decommissioning, is taken (paragraphs 3.6 and 3.7).

Paragraph 3.11 keeps all other law intact. The draft does not create a safe harbour, and a contravention of another law arising from an AI system is dealt with under that law.

What we did not verify

What we opened: the full ten-page draft, the TRAI PDF at trai.gov.in, read in full on 4 November 2026 through a PDF parser. The cover date, the comment deadline, paragraphs 1 to 3 and the definitions were read from that text.

What we did not open: the India AI Governance Guidelines of February 2026, TEC standards 57050:2023 and 57090:2025, the TRAI Act text, and any TRAI consultation web page or press release. We did not check whether comments have been filed, whether the deadline has been extended, or whether any direction on incident reporting format exists.

What we refuse to claim: that any of this is in force, that TRAI has power to enforce it in the form drafted, what penalties would follow, or what the final text will look like. The draft states no sanction of its own.

Related briefings

• India MeitY AI governance guidelines: who carries the liability
• Brazil Anatel: AI in a telecom subsidy call
• Japan MIC study group on frontier AI and telecom data security
• Asia-Pacific AI regulation hub
• AI Regulation News hub