Duplicate SIM fraud is the place to begin. Spanish telecoms support team leads must understand why an agent holds every SIM duplicate for a person, how to read verdicts on portability and bundle changes, and how to calibrate reviewers so decisions match. The EU AI Act's literacy and disclosure duties, GDPR as the AEPD enforces it and NIS2 complete the frame.
What does a telecoms support lead in Spain deal with?
Spanish customers switch operators often, attracted by convergent bundles of fibre, mobile lines and television, so porting requests and retention conversations are constant. Bundle prices change when promotions end, and customers call to dispute the new amount. Television packages with sports rights add their own disputes about access, devices and seasonal pricing.
Duplicate SIM requests are the most serious risk. A criminal who obtains a duplicate receives the victim's banking codes and can empty accounts. Customers speak Spanish and, in several regions, Catalan, Basque or Galician. The team lead manages a large, often outsourced team, sets quality standards, owns escalations and reports on resolution, churn and fraud.
Which tasks can agents take on, and at what depth?
- Bill and promotion queries, depth 2 to 3. The agent explains price changes from the contract and promotion records and answers routine questions directly once certified. Disputes about whether a promotion was promised are held.
- Porting status, depth 3. The agent tracks incoming and outgoing ports and explains delays from the portability system's status.
- Bundle changes, depth 2. The agent quotes the new price and any change in commitment period. A person confirms changes that extend a commitment.
- Technical appointments, depth 3. Booking and rebooking fibre installations and repairs.
- Duplicate SIM requests, depth 4. Held for a person every time, with identity verified to the operator's strengthened procedure. Requests arriving shortly after a change of contact email or address are a pattern the lead should recognise.
What must team leads learn, and what stays with them?
Start with what support team leads should learn before working with agents. For a Spanish operator, two skills deserve weight.
The first is holding the line on duplicates. A caller may know the customer's identity number, address and bank details. Those details are declared and often stolen. The operator's verification record is what counts, and a photo of an identity document sent by message is external. Leads should understand that the hold is the control, and that releasing it to shorten a queue is the failure.
The second is calibration. Large outsourced teams drift. One site releases held promotion disputes generously, another declines them. Regular sessions where reviewers from every site decide the same held cases and agree the rule keep decisions aligned, and aligned corrections improve the agent faster. Running calibration sessions for support team leads explains the format.
Team leads keep:
- duplicate SIM approvals;
- promotion disputes and goodwill beyond policy;
- complaints heading to the telecoms user office or arbitration;
- fraud conclusions and line suspensions;
- quality, coaching and supplier oversight for outsourced sites.
The argument for their role is in why support team leads are the real control, and the limits are in what support team leads should never let an AI agent do.
Which Spanish and EU rules shape oversight and literacy?
The EU AI Act applies directly. Article 4 requires deployers to ensure AI literacy among staff who use AI systems on their behalf, and that includes outsourced staff who review agent output for the operator. Article 50 requires that customers are told when they are interacting with an AI system.
GDPR governs customer data, and the AEPD enforces it in Spain. Issuing a duplicate SIM to the wrong person is both a fraud and a personal data breach, so the verification process sits squarely within GDPR's security requirements and breach rules. The Article 5 principles, a lawful basis under Article 6 and records of processing under Article 30 apply to every agent. Telecoms rules add confidentiality of communications and limits on traffic data. Article 22 is relevant where an agent suspends a line on automated signals without a person deciding.
The NIS2 Directive covers providers of electronic communications, with cybersecurity risk management and incident reporting obligations. Social engineering aimed at agents belongs in that risk management. Telecoms consumer rules on contracts, portability and complaints are set nationally; load them into the agent's sources. Banco de España does not supervise operators, but duplicate SIM fraud lands in bank accounts, so coordination with banks matters.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
A 90-day plan
Month one. Foundations for leads and reviewers at every site, in-house and outsourced. Pryme Intelligence Academy's Foundations track is free and tested in telecoms, which makes it practical to train outsourced sites to the same standard. Publish the Article 50 notice. Confirm duplicates are held at every depth.
Month two. The agent handles bill and promotion queries at depth 2 alongside staff. Leads correct with reasons and run the first cross-site calibration session. Leads sit the operator exam.
Month three. Routine queries move to depth 3 where proven. Two-week practicum on live held items, then a second calibration on twenty promotion disputes and ten duplicate requests. Approval rights for duplicates pass only to certified leads. The full role map is in AI agent skills by role.
Questions people ask
Can outsourced staff approve held actions?
They can if they are trained and certified to the operator's standard and the approver rule names them. The operator remains accountable for the outcome.
Should the agent answer in Catalan, Basque or Galician?
If those languages are in its certified scope. Review a sample in each until quality holds, and offer a person who speaks the language.
What if a duplicate SIM is issued wrongly?
Treat it as a fraud and a possible data breach at once. The record shows who verified and approved the request, which is where the review starts.