Telecom regulatory body wants companies to report serious AI failures to the regulator

The Telecom Regulatory Authority of India (TRAI) has proposed that telecom companies such as Airtel, Jio, Vodafone, others be held directly answerable for anything that goes wrong with the artificial intelligence (AI) they use in their networks and services, including AI they buy from vendors.

In draft guidelines released on Friday, TRAI also said that serious AI failures would have to be reported to the regulator.

TRAI had in 2023 recommended an independent AI regulator, but the government has not acted on it. The latest draft applies to anyone holding a licence under the Telegraph Act, 1885, or an authorisation under the Telecommunications Act, 2023, that uses or plans to use AI. Comments from stakeholders are invited by November 27.

Reporting serious failures

Companies would have to report critical and high-severity incidents, including major malfunctions and repeated failures, to TRAI. TRAI said it may use this information for advisories, risk assessment and “other lawful regulatory purposes.”

Telecom operators are already using AI in their networks and services. Airtel says it runs an AI-based system on its network to flag spam calls and messages. Its latest annual report adds an AI tool that blocks malicious links across SMS, OTT apps, email and browsers, along with AI-based protection against OTP fraud. Jio says its in-house AI platform, JioBrain, is built into its network operations to help with things like fault prediction, capacity allocation and real-time network optimisation. Vodafone Idea (Vi) uses AI to flag spam calls and SMSes and, under its “Vi Protect” initiative, runs an AI-driven system to detect and respond to cyber threats on its core network.

Each company’s board would have to approve an internal AI policy and file it with TRAI within seven working days, the guidelines propose. The policy must cover how AI systems are rated as high, medium or low risk, who approves their use, how incidents are graded, human oversight, data handling and how users’ AI-related complaints are resolved. It must be reviewed at least once a year.

Companies would also have to set up an AI Governance and Safety Committee with members from network, IT, regulatory and consumer affairs teams. It would be headed by a senior executive designated as AI Governance and Safety Officer.

No AI system could be used unless it is on the company’s inventory of AI systems. Companies must also get details of AI embedded in equipment they buy, and put audit and accountability clauses in supplier contracts. Before deploying any new AI, they must check its accuracy, robustness, fairness and explainability. TRAI points to two standards of the Telecommunication Engineering Centre, one on fairness testing and one on recording AI incidents.

MeitY consultation paper next month

India currently has no law on AI and relies on a patchwork of existing laws, from the IT Act, 2000 and the Digital Personal Data Protection Act, 2023 to consumer protection and criminal laws. TRAI’s guidelines comes as the Ministry of Electronics and Information Technology (MeitY) is expected to come out with a consultation paper on AI regulation by the first week of November. The paper is expected to form the base for AI regulation in India.

TRAI’s draft says that other laws remain applicable and that violations will be dealt with under them.