The draft in plain terms
On 30 October 2026 TRAI released draft Guidelines on Responsible Use of Artificial Intelligence in Telecommunication Networks and Provision of Telecommunication Services, with written comments due by 27 November 2026. The press note says the aim is consistent implementation of the India AI Governance Guidelines in the telecom sector. The draft itself runs to ten pages, so read it before the commentary.
It asks each applicable authorised entity to adopt a board-approved internal AI policy (paragraph 3.1) and to classify every AI system as high, medium or low risk on materiality (3.2(a)). It asks for an inventory of active, inactive and decommissioned systems, with source, purpose and risk class recorded for each, and no system in use unless it is on that inventory (3.5(a)). It also asks for human oversight of every system (3.2(e)), an AI Governance and Safety Committee headed by a senior executive (3.6), and a central database of AI incidents (3.5(g)).
Critical and high-severity incidents go to TRAI in a prescribed format, manner and timeframe (3.9). Two gaps, noted by ThePrint and visible in the text: the draft leaves the severity classes to each entity’s own internal policy (3.2(c)), and it names no reporting deadline. Treat both as unknown until the final text appears.
A hypothetical from the review room
Picture an ordinary vendor review in a network operations team. A fault-prediction model arrives inside a supplier’s platform, the supplier’s assurance report sits on file, and the AI register lists the model as “vendor-managed”. Nobody on the buyer’s side can say what the model was last trained on, or who approved its latest update.
That register entry is where the draft bites. Paragraph 3.8 makes the entity accountable for the outcome of every AI system it uses, whether built in-house, procured or outsourced, or a mix of the three. “Vendor-managed” stops being an answer and becomes a question: managed by whom, approved by whom, tested against what?
The same pattern shows up in ordinary IT general controls: a cloud platform gets its SOC report read once a year, and the change log behind the report is never opened. AI makes that gap more expensive, because a model update can change a decision without anyone filing a change ticket.
Three features likely to survive the rewrite
Drafts soften in consultation, and this one may too. In my judgment, three features are likely to survive most rewrites: the inventory, the risk tier and the named owner. Each is a document an auditor can ask for on a Monday morning.
The inventory comes first. A register that lists only systems the company built has a scope gap, and the draft closes it by covering bought-in and decommissioned systems too (3.5(a)). In many companies, the evidence of what a switched-off model did sits nowhere except in that retired entry.
The risk tier comes second. The draft ties the class to significance for network operations, financial and operational outcomes, and consumer impact (3.2(a)). That is a materiality judgment, and materiality judgments are what audit committees minute. A tier nobody can defend is a weak control, however tidy the spreadsheet looks.
The incident taxonomy comes third. The draft points to TEC standard 57090:2025 for recording incidents, or an equivalent taxonomy (3.5(g)). TEC’s own summary says the standard classifies incidents by type, affected system, severity, failure cause and harm. Ask your own team whether anyone has opened it.
The objection, and the forwardable answer
A reasonable CFO will say this is a telecom rule and it does not touch her. For licensing in New Delhi, that is correct today. The draft applies to entities holding a licence under the Telegraph Act, 1885 or an authorisation under the Telecommunications Act, 2023, and only where they use or intend to use AI (2.1).
Outsourcing the model has never outsourced the accountability, and a draft from New Delhi now says so in writing. Many registers carry the vendor’s name where the owner’s name should be. That is a forwarding address, not a control. A board that cannot name who approved each AI system holds a list of suppliers, and calls it a list of risks.
For groups working across the Indonesia–India–Singapore corridor, the draft binds only India-licensed entities. Jakarta and Singapore have their own instruments. Check your local standard before carrying the Indian logic across a border.
Monday test
Open your AI or automation register and filter the owner column. Count the entries where the owner is a supplier name instead of a named employee, and take that count to your CFO.
Pick one AI-enabled platform and open its supplier file. Test the contract against ISO/IEC 27001:2022 A.5.19 and against the draft’s own list for supplier agreements: regulatory compliance, audit and inspection rights, incident management, risk allocation and accountability (3.5(f)). Does it say who is told, and how fast, when the model changes or misbehaves? Ask the buyer-side owner for the change log of the last model update.
Ask your CISO for the record of the last time an automated decision was reversed. If it lives in an email thread and not in a database, you have the gap the draft describes.
Also this week
AU Small Finance Bank. The bank told MediaNama it is investigating a potential data leak on a Salesforce-hosted SaaS platform holding limited vehicle-loan customer data, after a hacking group claimed the breach on the dark web. The group’s listing claims far more, including Aadhaar and PAN details and employee records, and MediaNama could not verify that the group holds any original data. Treat the scale as unverified.
RBI cyber checks. Reuters, citing three people familiar with the matter, reports that the RBI has asked banks for proof of compliance with existing cyber rules, a check on API weaknesses, and details of their readiness for AI-related risks. No RBI circular on this is public yet. Quote it as reported, and read CERT-In’s 9 October advisory on stolen API credentials alongside it.
Every household knows whose pickle jar it is, because the name is on the lid. Put a name on your AI register as well. Reply and tell me which column in yours is emptiest.
Lift as you Rise.