AI agents for compliance teams in telecoms in India

Indian telecoms compliance is about volume: hundreds of millions of subscribers, every one verified, and every commercial message traced to registered consent and an approved template. AI agents can test subscriber verification records, check message traffic against consent and template registrations, and draft audit responses. People keep findings. The Digital Personal Data Protection Act 2023 governs the data.

What do telecoms compliance teams in India spend their time on?

Subscriber verification is the foundation. Every SIM must be issued against verified identity, through digital identity-based checks or documents, and the operator must be able to show the record for any connection. Retailers and agents who issue SIMs are a known weak point, so compliance tests their records constantly.

Commercial communications are the second load. India's rules on unsolicited commercial messages require senders to register, use approved headers and message templates, and hold the recipient's consent, all recorded on shared ledger systems run by operators. Operators must block messages that do not match and act against senders who abuse the system. Spam and fraud complaints drive regulatory attention.

Licence conditions add security and reporting duties, including cyber incident reporting within short deadlines. Where the group runs a payments bank or wallet, RBI rules apply to that business as well. And the DPDP Act 2023 now governs how all of this personal data is handled.

Where can AI agents help?

• Point-of-sale verification testing (depth 1). The agent samples new connections by retailer and checks the identity record, the photograph match, the timestamps and the location of activation. It flags retailers with patterns that suggest fraud, such as many activations on one identity or activations far from the shop.
• Commercial message assurance (depth 1). The agent compares a sample of delivered messages with registered headers, templates and consent records, and lists messages that should have been blocked. It also groups spam complaints by sender to identify repeat offenders.
• Consent notice review (depth 1). For each app, form and retail journey, the agent checks that the notice tells the subscriber what data is collected and why, in the languages the operator offers, and that consent can be withdrawn as easily as it was given.
• Regulator query drafting (depth 2). The agent drafts responses to regulator queries and audits, citing the records behind each answer. A compliance officer edits and sends.

Each flag needs a trail. When a regulator asks why a retailer was suspended, the operator must show the records the agent read and the person who decided. Our guide on how to audit a compliance agent's recommendations explains what that trail must hold. The guide to AI compliance agents sets out why the agent recommends and people decide.

What stays with people?

Suspending a retailer, disconnecting subscribers whose verification failed, and blacklisting a commercial sender are decisions for named people. They affect livelihoods and service to customers, and the operator must be able to justify them.

Incident reporting decisions stay human. The agent can gather the facts of a cyber incident quickly, which matters when deadlines are short, but whether and what to report is a person's call.

Responses to data principals exercising their rights under the DPDP Act, and decisions about a personal data breach, also stay with the data protection function.

Which rules apply in India?

Telecoms licensing and the rules on commercial communications come from the licensing authority and the telecoms regulator, and set subscriber verification, consent registration, blocking duties and penalties. Licence conditions include security obligations and require incidents to be reported to the national cyber agency.

The Digital Personal Data Protection Act 2023 applies to digital personal data. It requires notice and consent (or a legitimate use), purpose limitation, reasonable security safeguards and breach notification, and gives individuals rights of access, correction and erasure. Large operators may be designated as significant data fiduciaries, with extra duties such as audits and impact assessments. An agent that reads subscriber data is processing within these duties.

RBI regulates payments banks and wallets, and SEBI applies if the group is listed. There is no single AI law; our guide to how AI agents are regulated in India covers the advisories and frameworks that apply. If the operator has European customers or operations, GDPR and the EU AI Act may apply to that part.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

How do you start in the first 90 days?

Month one: start with point-of-sale verification testing in one circle. The records are system-generated and fraud patterns are well understood by your investigators. Name the officer who owns retailer findings.

Month two: replay the agent on a period where investigators already found and acted on fraudulent retailers. Check whether it would have found them earlier and how many false flags it raised.

Month three: certify at depth 1 and add commercial message assurance. Keep every retailer suspension decision with a person, and record the agent's flag and the decision together. German operators face a quite different mix of rights and works council rules; see our brief on compliance agents in German telecoms.