November 2, 2026, (Inside AI) — India's telecom regulator has proposed binding rules that would make telecom operators accountable for AI systems they use, even those built by third parties, and require them to report serious AI-related incidents. The Telecom Regulatory Authority of India (TRAI) issued draft guidelines on responsible AI use in telecommunication networks, opening them for public consultation until November 27. The move follows revelations that autonomous AI agents gained unauthorised access to systems belonging to Indian enterprises, including a Noida-based IT services firm.
The draft, titled 'Guidelines on Responsible Use of Artificial Intelligence in Telecommunication Networks and Provision of Telecommunication Services,' arrives as AI spreads into critical telecom infrastructure. TRAI wants operators to classify AI systems by risk, maintain human oversight, conduct pre-deployment safety assessments, and form internal committees to monitor AI behaviour. The framework builds on the India AI Governance Guidelines released in February 2026, which set principles for responsible AI adoption across industries.
The urgency stems from recent incidents reported by India's cybersecurity agency, CERT-In. In an October 15 advisory, CERT-In disclosed multiple voluntary reports from AI developers whose systems had accessed live infrastructure belonging to Indian organisations during research and evaluation. In one case, an AI agent conducting research for an American company reached sensitive records of a Noida-based IT services firm that had previously done backend work for the American client. In another, AI agents accessed passwords stored in plain text at an Indian enterprise. The AI models involved were developed by OpenAI and Anthropic, according to a senior government official who spoke on condition of anonymity. The incidents largely affected IT services and financial services sectors.
None of the affected Indian organisations detected the unauthorised access themselves. The AI companies identified the breaches during internal reviews and reported them to the government. CERT-In's preliminary assessment suggested limited damage because developers alerted authorities in time. But the episodes exposed gaps in cybersecurity preparedness, especially at smaller firms.
Read: Anthropic Backs Australian Law
Why TRAI Wants Operators To Own Third-Party AI Risks
TRAI's central proposal closes a common accountability gap: telecom operators must remain responsible for AI outcomes regardless of whether systems were developed internally or procured from vendors. The draft requires each AI system to be categorised as high-risk, medium-risk or low-risk based on its importance to network operations, financial outcomes and consumers. Operators would need to maintain inventories of AI systems, including retired ones, and assess new systems for accuracy, robustness, fairness, explainability and resilience against model drift.
The regulator has also proposed dedicated AI Governance and Safety Committees, headed by senior executives, to review systems, investigate vulnerabilities and recommend corrective action, including shutting down problematic systems. Serious AI incidents, such as material malfunctions and recurring failures, would have to be reported to TRAI. Companies would maintain central databases of incidents and consumer complaints. No AI system could be used without approval from a designated officer. Internal AI policies would need annual review and submission to the regulator within seven working days of taking effect.
The draft does not set a fixed reporting deadline for serious AI incidents, leaving the format and timeframe to be determined later. It also says companies must ensure that "AI-related harms reported by users shall be resolved within a reasonable timeframe".
This approach mirrors how financial regulators treat third-party risk: the regulated entity cannot outsource accountability. For telecom operators, that means vendor contracts will need audit clauses and incident notification requirements. Smaller operators may struggle with compliance costs, but the draft's risk-based tiers offer some flexibility. The real test will be enforcement, since TRAI has historically relied on persuasion and penalties rather than real-time monitoring.
CERT-In Findings Add Pressure On MeitY And TRAI
The draft arrives as the Ministry of Electronics and IT (MeitY) separately explores dedicated AI regulation. TRAI's consultation paper warns that unintended changes in AI behaviour, biases introduced during training, and adversarial attacks could threaten telecom resilience. It emphasises that telecom infrastructure underpins national security, emergency response, financial transactions and essential public services.
CERT-In has recommended that enterprises review exposed credentials, strengthen cloud security and deploy systems capable of detecting machine-speed attacks. The advisory noted that AI developers voluntarily disclosed the incidents, but none of the affected Indian organisations independently detected the unauthorised access. That gap suggests many firms lack basic monitoring for AI-driven intrusions.
The draft's human oversight requirement could prove contentious. TRAI says operators must provide appropriate human oversight and establish mechanisms to investigate unexpected AI behaviour. But the guidelines do not specify how many humans, what training they need, or how quickly they must intervene. Those details will likely emerge during consultation.
Read: India Supreme Court Proposes Ban
Industry observers expect telecom operators to push back on the compliance burden, particularly the inventory requirement for retired AI systems and the seven-day submission window for internal policies. Consumer advocates, meanwhile, may argue the draft lacks teeth because it does not prescribe penalties for non-compliance or a fixed incident reporting deadline.
The consultation closes on November 27. TRAI will then finalise the guidelines, which could take effect in early 2027. MeitY's separate AI regulation remains in development, raising questions about overlapping jurisdictions. For now, TRAI's draft sets a precedent: telecom operators cannot blame third-party AI developers for harms. That principle could spread to other critical sectors, from banking to healthcare, as India builds its AI governance stack.
