Telecoms operators deploy high-risk AI systems in more places than they expect: in managing critical digital infrastructure, in financing handsets for individual customers, and in managing their own workforce. Wherever that happens, Article 26 of the EU AI Act requires oversight by people with competence, training and authority. Operators must know where those places are and who stands in them.
What does Article 26 require of an operator?
In substance, a deployer of a high-risk system must use it according to the provider's instructions; assign human oversight to natural persons with the necessary competence, training and authority, and support them; ensure input data under its control is relevant and sufficiently representative; monitor operation, inform the provider of risks and suspend use if a serious risk appears; report serious incidents; keep logs under its control for an appropriate period; inform workers' representatives before using the system at work; and inform people subject to its decisions where required.
Telecoms operators also sit under NIS2 as entities whose cybersecurity risk management and incident reporting are regulated, which gives the "suspend use" and "report serious incidents" duties a familiar shape.
Where do telecoms operators meet the high-risk list?
Critical digital infrastructure. The Act treats AI systems used as safety components in the management and operation of critical digital infrastructure as high-risk. An agent that can reroute traffic, change network configurations or shed load, where its failure could disrupt service at scale, may fall within that use. An agent that summarises network alarms for engineers to act on is a weaker case.
Device financing and postpaid credit. When an operator decides whether an individual can take a handset on instalments or a postpaid contract with a credit element, it is assessing creditworthiness. That is a listed high-risk use. Many operators do not think of themselves as lenders, but the Act looks at what the system does.
Workforce. Agents that allocate field engineers' jobs based on their past performance, monitor contact-centre staff, or screen applicants fall within the high-risk workforce uses.
Customer support chat, plan recommendations and network planning analytics are generally not high-risk, though Article 50 requires that people be told when they talk to an AI system.
What competence does each use need?
Network operations engineers overseeing an agent that acts on infrastructure need to know exactly which actions it may take at which depth, which actions are held for them, and how to stop it in seconds. A governed agent might read telemetry at depth 1, draft change requests at depth 2, apply pre-approved routine changes at depth 3, and have anything that could affect service held at depth 4. Engineers must understand that a held change is their decision, and that a refusal means the agent was asked to step outside its bounds.
Credit and sales staff overseeing device financing decisions need to read the agent's assessment, separating sealed billing history from declared income and external documents, and to approve or decline against it within mandate.
Contact-centre and field managers overseeing workforce agents need to understand what the agent measures and what it cannot see, and to set aside unfair allocations or flags before they affect a worker.
Training has to follow the agent. An agent's certificate lapses after 90 days and is renewed against real cases; a run that clears no depth drops it to depth 1 the same day. For a network agent, that means every routine change becomes manual at once, which the network operations centre must be staffed to absorb.
How does an operator meet Article 26's competence duty?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Identify high-risk uses | Inventory covering network, credit and workforce agents | Inventory signed by each owner |
| Oversight assigned to named people | Named engineers per shift for network agents; named credit reviewers | Rotas and assignment register |
| Necessary competence | Scenario assessment on the operator's own incidents and applications | Assessment records |
| Necessary authority | Engineers may reject held changes or stop the agent without approval | Runbooks; rejections and stops in the record |
| Monitor and suspend | Agent suspension included in incident runbooks | Suspension events; incident reports |
| Report serious incidents | Incident teams trained to recognise agent-caused incidents | Incident classifications and reports |
| Inform workers' representatives | Consultation before workforce agents go live | Consultation records |
Proof of competence across these roles is discussed in how telecoms operators can prove staff are trained to oversee AI agents and, in general terms, in what evidence of competence is.
What will regulators ask?
Telecoms operators may hear from market surveillance authorities, cybersecurity authorities, consumer credit supervisors and data protection authorities. Expect: which of your agents are high-risk, and how did you decide? Who can stop the network agent, and how fast? Show a held change that was rejected and why. Who decides device financing applications? How are field engineers' allocations reviewed? Was the works council informed? Board members will be asked whether they understand where the operator relies on agents, a topic covered in what AI agent training a telecoms operator board needs.
What does Article 26 not cover?
It does not apply to non-high-risk agents, which is much of a telecoms operator's estate. It does not set network resilience rules or consumer credit rules, which come from sector law. It does not prescribe training content. It does not replace NIS2 or data protection duties. Operators sometimes include external credentials, such as Pryme Intelligence Academy certificates, in their evidence, but judging competence stays with the operator. Related treatments are in Article 26 duties in e-commerce and in payments, and the general model in AI literacy and certification for people who work with agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is a handset instalment plan really a credit decision?
If the operator assesses whether an individual can pay over time, the agent is assessing creditworthiness, whatever the product is called. Treat it as high-risk.
Should a network agent ever make changes without an engineer?
Pre-approved, routine changes within tight bounds can run at depth 3 if the agent is certified for them. Anything that could affect service should be held for an engineer, who must be able to stop the agent at once.
Who in a telecoms operator should train first?
Network operations engineers overseeing agents that act on infrastructure, because failures there affect the most people fastest. Credit and workforce overseers follow.