TRAI draft requires telecom operators to bear responsibility for the consequences of third-party AI systems; Anthropic prospectus says AI liability law is unsettled

The Telecom Regulatory Authority of India (TRAI) has proposed that telecom operators be held accountable for the outcomes of every artificial intelligence (AI) system they use, including systems bought from outside vendors.

“The applicable authorised entity shall be accountable for the outcome of all AI systems used by it, irrespective of whether the AI systems are developed internally, procured/ outsourced from third party or a combination thereof,” TRAI said in its draft guidelines on responsible use of AI in telecom networks and services.

TRAI released the draft on October 30, 2026 and is accepting comments until November 27. The guidelines would apply to licensed telecom service providers and network operators that use, or plan to use, AI systems.

What would telecom operators have to do?

Board-approved AI policy: Each operator must adopt an internal AI policy approved by its board, review it at least once a year, and file it with TRAI within seven working days of it taking effect.

Risk ratings: Each AI system must be classified as high, medium or low risk, based on how important it is to the network or service, its financial and operational impact and its “potential implications for consumers.”

Approval and inventory: A designated officer must approve every AI system before use. Operators must keep a list of all their AI systems, and “no AI system shall be used unless it is a part of the inventory.”

Testing before launch: Operators must check each system for accuracy, robustness, explainability and fairness before deploying it. Robustness means it keeps working reliably in different conditions. Explainability means people can understand why it produced a result. Operators must also check for “drift,” where a system’s performance worsens over time as real-world data changes.

Incident reporting: Operators must classify AI-related incidents into four severity levels, record every one in a central database, and report the two most serious levels to TRAI. The draft doesn’t set a deadline. It says only that reports must come “in a prescribed format, manner and timeframe.” The draft states that TRAI may use these reports for “sector-wide learning, risk assessment, advisories, preventive measures, and other lawful regulatory purposes.”

Human oversight: People must supervise every AI system.

Consumer complaints: Operators must resolve “AI-related harms reported by users” within a reasonable time.

Governance committee: Each operator must set up an AI Governance and Safety Committee, led by a senior executive. The committee would review AI systems at least once a year and can order a system changed or shut down.

How would operators answer for AI they didn’t build?

Through checks and contracts. Before buying an AI system, operators must check “credibility of the supplier, soundness of the AI system and its limitations, and the suitability and quality of data used for training.”

Operators must also write enforceable terms into supplier contracts covering “regulatory compliance, audit and inspection rights, incident management, risk allocation and accountability.” Risk allocation decides who pays when something goes wrong. Equipment suppliers must also disclose any AI built into what they sell.

This would include AI that TRAI already requires. In 2023, TRAI made operators deploy AI-based spam filters for calls and SMS. Under the draft, operators would be accountable when these filters make mistakes.

What do AI companies say about their own liability?

AI makers say the law on who pays for AI harms is unsettled, and that their own contract terms may not hold up. Anthropic, which makes the Claude models, filed to list its shares in the US on October 26. Its registration statement with the Securities and Exchange Commission (SEC) is the document a company must file before an initial public offering (IPO), setting out its business and risks.

A warranty disclaimer says the company doesn’t guarantee its product works as expected. A limitation-of-liability clause caps the amount a company may have to pay if something goes wrong.

The filing flags seven risks for companies that rely on AI vendors:

Unsettled law on AI agents: AI agents are systems that take actions on their own, such as sending emails or changing software. “The legal frameworks governing liability for actions taken autonomously by AI systems, including our agentic products, are unsettled and could expose us to significant and unpredictable legal claims,” the filing said. Existing laws on negligence and product liability “have not been authoritatively applied to autonomous AI systems,” it added.

Customers may share the blame: “We may face claims from customers, their end users, or third parties alleging that we are liable for harm caused by our agents’ autonomous actions, even where the customer configured, deployed, or supervised the agent,” the filing said.

Errors can compound: When an AI agent carries out a multistep task, “an error or unintended action at any individual step may propagate through subsequent steps, compounding the severity of harm before detection or correction,” the filing said.

Human oversight may not keep up: TRAI’s draft requires human oversight of every AI system. Anthropic said, “the pace and volume of autonomous execution, particularly in enterprise deployments, may also exceed the capacity of human reviewers to meaningfully understand and evaluate whether each action is appropriate.”

A service, not a product: Product liability laws can hold makers responsible for defective products. Anthropic said it believes its AI is “considered a ‘service’ in the context of legal frameworks addressing product liability, but courts and regulators may reach different conclusions across jurisdictions.” By calling its AI a service, Anthropic argues those laws shouldn’t apply to it.

Insurance gaps: In a catastrophic AI incident, “no single insurer, and potentially the insurance industry in the aggregate, may have sufficient capacity or expertise to underwrite insurance commensurate with such exposure,” the filing said.

Could AI vendors help operators report incidents?

Not always. TRAI’s draft requires operators to investigate and report AI failures. Anthropic said keeping full records of what its AI agents do is hard. “Any inability to provide adequate audit trails could impair our ability to investigate incidents, respond to regulatory inquiries, or defend against liability claims,” the filing said.

For a substantial portion of its traffic, Anthropic keeps no record of the conversations at all. “A substantial portion of our traffic is subject to Zero Data Retention (‘ZDR’) terms under which we retain only classifier scores, not prompts or outputs,” the filing said.

Under these terms, Anthropic deletes what customers type in and what its AI replies, keeping only automated safety ratings. “ZDR may also prevent us from producing records for subpoenas, regulatory examinations, or incident-reporting obligations,” it said.

Enterprise customers in regulated sectors expect these terms, Anthropic said. It also said it may not meet incident-reporting deadlines in Europe, where regulators want detailed information “which we may not be able to provide within the prescribed time frame.”

How does this fit India’s AI rules?

TRAI said the draft applies the India AI Governance Guidelines to telecom. Those guidelines recommend assigning liability to companies that build AI and companies that use it “based on their role and level of risk.” TRAI’s draft places accountability on the operator using the AI.

The Ministry of Electronics and Information Technology (MeitY) is working on wider AI rules. IT Minister Ashwini Vaishnaw said in October that a consultation paper on AI regulation would come within a month. “The industry has to take the primary responsibility,” he said. MeitY has also said it will tighten rules on reporting AI incidents.

TRAI’s draft adds no new penalties. Existing laws, rules and licence conditions would apply to violations involving AI.

Questions the draft leaves open:

Vendors: What can operators do if an AI vendor refuses to accept liability or allow audits in its contract?

Records: How will operators investigate failures involving vendors that delete conversation data or lack full records?

Oversight: How will operators supervise AI agents that act faster than people can review?

Deadline: How quickly must operators report serious AI incidents to TRAI?

Enforcement: What happens to operators that don’t comply, given the draft adds no penalties?

TRAI draft requires telecom operators to bear responsibility for the consequences of third-party AI systems; Anthropic prospectus says AI liability law is unsettled

Why read this

Topics

Tags

Body