India's telecommunications regulator, Trai, released a draft framework for the responsible use of artificial intelligence (AI) on Friday. According to this draft, licensed entities operating under the Telegraph Act or the Telecom Act must be accountable for the outcomes of the AI systems they implement, regardless of where those systems were developed.
This broad draft, presented for consultation, mandates that companies adopt board-approved AI policies, establish dedicated governance and safety committees, and report serious AI-related incidents to the regulator. Stakeholders have until November 27th to submit comments.
The consultation comes amid the growing integration of AI into networks to enhance efficiency and improve consumer services. Trai warns that implementing AI can introduce new risks if due diligence is not performed before system deployment or if there is insufficient oversight of autonomous learning and system interactions.
The regulator noted that risks such as unintentional bias, which can arise in AI systems during training and use, undesirable model behavior like model drift, and adversarial attacks, could negatively impact the resilience of telecommunication infrastructure, especially its critical components. These risks can be mitigated by adhering to appropriate AI governance practices.
Indian telecom service providers, including Reliance Jio and Bharti Airtel, are already using AI extensively in their systems, primarily for customer identification and fraud prevention. Global network equipment manufacturers, such as Nokia and Ericsson, are also integrating AI into networks, a trend adopted by Indian operators.
Trai's proposals include a requirement for every organization to develop an internal AI policy approved by its board of directors or equivalent governing body. This policy must cover risk classification, deployment permissions, incident management, human oversight, data governance, and consumer complaint resolution. Furthermore, the regulator suggested that all AI systems should be subject to appropriate human control to mitigate risks according to a predefined mechanism.
Telecom companies and authorized organizations using AI must classify their systems into high, medium, and low-risk categories based on their impact on network operations, financial and operational results, and potential consequences for consumers.
A key aspect is that the proposals aim to hold organizations accountable for the outcomes of implemented AI systems, 'regardless of whether the AI systems were developed in-house, procured/outsourced from a third party, or represent a combination of these options.'
AI-related incidents must be classified into critical, high, moderate, and low severity levels, with mandatory reporting required for critical and high-severity incidents. The regulator stated that 'critical and high-severity AI incidents must be reported to TRAI in the prescribed format, order, and timeline.' Although the regulator did not specify what constitutes critical, high, or low severity, or the deadline for mandatory reporting, telecom companies must also maintain centralized databases of AI incidents and consumer complaints related to AI-induced harm, complete with mechanisms for investigation, mitigation, and resolution.
