Incorporating AI incident reporting into telecommunications law and policy: Insights from India

AI incidents in telecommunications are fundamentally different from traditional cybersecurity breaches and require their own regulatory framework. The paper identifies specific risks like algorithmic bias and unpredictable system behavior that current data protection and cybersecurity laws don't adequately address.

India's existing digital regulations have a critical gap: While laws like the Telecommunications Act 2023 and Digital Personal Data Protection Act 2023 cover cybersecurity and data breaches, they fail to address AI-specific operational failures such as performance degradation and algorithmic bias in telecom systems.

Current incident reporting systems are insufficient because they lack standardized definitions and categories for AI incidents, making it difficult for companies to report problems and for regulators to track patterns of AI-related failures across the telecommunications sector.

Structural barriers prevent companies from voluntarily disclosing AI incidents, suggesting that mandatory reporting requirements are necessary to ensure transparency and accountability in how AI systems perform in critical telecommunications infrastructure.

The paper recommends India establish a dedicated government body to manage AI incident reporting in telecommunications, with mandatory disclosure requirements for high-risk AI failures and standardized reporting protocols—a model that could serve as a template for other countries without comprehensive AI laws.