TRAI Gave Telecom 28 Days to Comment on India's First AI Rulebook — and the Hard Part Is Your Suppliers

Original graphic by Guruji Corporation. Source: TRAI, Draft Guidelines on Responsible Use of AI in Telecommunication Networks and Provision of Telecommunication Services, 30 October 2026.

On 30 October 2026 the Telecom Regulatory Authority of India published a 10-page draft that asks every licensed telecom operator in the country to do something almost none of them has done: write an AI policy, get it approved by the board, and file it with the regulator within seven working days of it taking effect.[1][2]

Comments and counter-comments are both due by 27 November 2026 — 28 days from release — to the Advisor (Networks, Spectrum and Licensing) at advmn@trai.gov.in.[2] If you sell software, networking kit or integration services to an ISP, a data-centre operator or a systems integrator that serves them, this draft is already your problem: two of its implementation clauses land squarely on the supplier contract.

What the draft actually says

Who it binds. The guidelines apply to any entity holding a licence under the Telegraph Act, 1885, or an authorisation under the Telecommunications Act, 2023, to provide telecommunication services — or an authorisation to establish, operate, maintain or expand telecommunication networks — that is using or intends to use AI systems in those networks or services.[2] It is written for operators, not for every company in India that runs a chatbot.

The internal policy. Each such entity must formulate an internal AI policy on telecom, approved by its board or equivalent governing body. The policy must contain, at minimum: a high/medium/low risk classification for every AI system based on its materiality to the network and its consequences for consumers; a rule that no AI system is used before an officer designated for the purpose approves it; four severity classes for AI incidents (critical, high, moderate, low); a mechanism for recording, mitigating, investigating and reporting them; human oversight for all systems; data governance across the life cycle; and a consumer grievance route for AI-related harm.[2] The policy is reviewed at least once a financial year and filed with TRAI within seven working days of coming into effect.[2]

The inventory. Operators must maintain an up-to-date inventory of all active, inactive and decommissioned AI systems, recording each system's source, purpose and risk classification — and "no AI system shall be used unless it is a part of the inventory".[2]

The clause that should worry a vendor. Before procuring telecommunication equipment, systems or solutions with AI embedded, an operator must obtain disclosures from the supplier, and must incorporate enforceable provisions in the supplier agreement covering regulatory compliance, audit and inspection rights, incident management, risk allocation and accountability, before deployment.[2] Due diligence on a third-party AI system must also cover the supplier's credibility, the system's limitations and the suitability and quality of its training data.[2]

Testing, with named standards. Validation, conformity and impact assessment are required before deploying a new AI system or modifying an existing one, covering accuracy, robustness, explainability, fairness, drift resilience and human oversight.[2] The draft points at two Telecom Engineering Centre documents: TEC 57050:2023 for fairness assessment and rating, and TEC 57090:2025 for the schema and taxonomy of an AI incident database in telecommunications and critical digital infrastructure.[2]

The paper trail. Two central databases are mandated — one for AI incidents including testing events, one for user-reported AI harm and its resolution — plus periodic training for the technical, operational, regulatory and business staff who exercise human oversight.[2]

Accountability and oversight. An AI Governance and Safety Committee, approved by the board and headed by a senior executive designated the AI Governance and Safety Officer, must review deployed systems at least annually and can order a system modified or decommissioned.[2] The operator is accountable for the outcome of every AI system it uses "irrespective of whether the AI systems are developed internally, procured/ outsourced from third party or a combination thereof", and critical and high-severity incidents must be reported to TRAI in a prescribed form and timeframe.[2]

What the draft leaves open. It does not set a commencement date, does not attach a schedule of penalties, and defers the incident-report format to a future prescription — three things worth raising in a comment rather than assuming.

Why it matters for Indian SMBs and mid-market teams

Regulation has started arriving through sectoral regulators, not a single AI Act. TRAI builds directly on the India AI Governance Guidelines released on 15 February 2026, which set out seven principles — trust, people first, innovation over restraint, fairness and equity, accountability, understandable by design, and safety, resilience and sustainability — and asked sectoral regulators to apply them in their own domains.[4][5] Telecom went first because connectivity is the country's critical digital infrastructure. Expect the same template, and the same clause list, in the next sector that publishes.

The obligation travels down the supply chain, and it travels by contract. An SMB with forty employees will never hold a telecom licence. It will, however, be asked to sign an agreement that gives a licensed operator audit and inspection rights over its software, commits it to incident reporting in the operator's format, allocates risk for AI-driven failures, and includes an AI disclosure sheet at purchase.[2] Read that clause list now and price it. Retro-fitting audit logs, incident reporting and a system inventory into shipped software costs far more than building them in.

The inventory requirement is the one most firms will fail. "Active, inactive and decommissioned" is stricter than most asset registers, and it is the same discipline that an IT/OT asset portal imposes — except it now covers model versions, prompt chains, third-party APIs and the sandbox someone retired in March. If a system is not on the list, using it is a breach.

Incident reporting is a data problem before it is a compliance problem. Reporting critical and high-severity AI incidents in a prescribed format assumes you can reconstruct what the model saw, what it returned and what a human did next. Teams that log only application errors, not model inputs and outputs, cannot answer that question in the timeframe a regulator will expect.

Comment windows are short and small firms rarely use them. Twenty-eight days, an email address and a PDF is the entire process. Operationally awkward clauses in the final version — a seven-working-day filing deadline, a common closing date for comments and counter-comments, an undefined incident report format — are much easier to flag now than to live with later. Send a short note with two or three specific clauses and a reason for each; that is what the Authority asked for.[2]

If you build AI features for enterprise buyers, this is your compliance horizon. Board-approved policies, system inventories, conformity assessments, fairness testing against a published TEC standard and an incident database are now the expected shape of AI governance in India's most regulated infrastructure sector. The same buyer will ask a software vendor for the same artefacts in 2027.

Where Guruji Corporation fits in

We do not practice law, we cannot advise on whether a specific clause binds you, and we have no view on how TRAI should regulate. What we do is the documentation and systems work this draft assumes already exists: an asset and system inventory that survives an audit, AI-system records with source, purpose and risk class attached, procurement files where supplier disclosure and audit terms are actually written down, and an incident log that can be reconstructed months later.

That is our IT/OT asset portal work applied to AI systems, and it is the part a small team can finish in weeks rather than quarters. If a licensed operator, an ISP or a vendor agreement has just put this on your desk, start with a short project brief and we will scope the inventory and the evidence trail before you sign anything.

Sources

TRAI Gave Telecom 28 Days to Comment on India's First AI Rulebook — and the Hard Part Is Your Suppliers

What the draft actually says

Why it matters for Indian SMBs and mid-market teams

Where Guruji Corporation fits in

Want to see how we can build your project?