TRAI proposes board-level AI oversight for telcos

Under draft guidelines released on Friday, operators will have to put in place board-approved AI policies, establish dedicated governance committees and introduce mechanisms to monitor and report AI-related incidents. The proposals seek to bring greater accountability to the use of AI in a sector that forms a critical part of the country's digital infrastructure. 8% to Rs 1,541 crore, revenue jumps 26.5% Trai has cautioned that while integrating AI into telecom networks could significantly improve efficiency, it may also introduce new risks if due diligence is not exercised before deployment of AI systems.

The regulator has flagged risks such as biases creeping into AI systems during training and usage, unintended model behaviour, including model drift, and adversarial attacks that could affect the resilience of telecom infrastructure, particularly its critical components. A key provision of the draft is that telecom operators will remain responsible for the outcomes of AI systems irrespective of where they are developed.

“The applicable authorised entity shall be accountable for the outcome of all AI systems used by it, irrespective of whether the AI systems are developed internally, procured/ outsourced from third party or a combination thereof,” the draft states. This could have implications for operators increasingly relying on external technology providers for AI-powered network management, customer services and security solutions.

Companies will also have to classify their AI systems into high-, medium- and low-risk categories, based on their significance to network operations, financial and operational outcomes, and potential impact on consumers. The regulator has proposed that every applicable telecom entity formulate an internal AI policy, approved by its board of directors or equivalent governing body. Operators will also have to establish an AI Governance and Safety Committee, headed by a senior executive designated as the AI Governance and Safety Officer.

The committee will include representatives from network operations, service delivery, information technology, data management, regulatory affairs and consumer affairs. It will review AI system performance, incident records and vulnerabilities at least once every financial year and recommend corrective action, including modification or decommissioning of systems where necessary. Critical- and high-severity incidents will have to be reported to Trai within prescribed timelines.

Operators will have to maintain a comprehensive inventory of all active, inactive and decommissioned AI systems, with the regulator specifying that no AI system shall be used unless it is a part of the inventory. They will also have to undertake due diligence before procuring AI systems from third parties, covering supplier credibility, system limitations and training data quality. Supplier agreements must provide for regulatory compliance, audit and inspection rights, incident management and accountability. Trai has invited stakeholder comments on the draft by November 27.