How can telecoms operators prove staff are trained to oversee AI agents?

Start with the SIM swap. A telecoms operator proves staff are trained by showing that every high-risk account action an agent prepares, such as a SIM replacement, port or large credit, was approved by a named person holding a current certificate checked at source, with the verification they performed on file. If that chain holds there, it holds elsewhere.

Why SIM swaps set the standard

A SIM replacement looks like routine customer service. In practice it can hand control of a person's phone number, and with it their one-time passcodes for banking and email, to whoever asked. Account takeover through a fraudulent SIM swap is one of the most damaging errors a telecoms operator can make on a customer's behalf.

When an agent handles customer contacts, it can prepare a SIM replacement in seconds. The decision whether to complete it, after verifying the requester, belongs to a person. That person's competence is the control, and the evidence of it is what a regulator, a bank whose customers were defrauded, or a court will ask for.

What other decisions reach people?

• Bill disputes and credits above the operator's limit for the agent.
• Collections arrangements for customers in arrears, where fair treatment rules apply.
• Number porting requests that the agent has flagged.
• Disconnections, which the operator may keep with a person in every case, especially for vulnerable customers.
• Complaints that may go to an ombudsman or regulator.

What evidence should an operator keep?

The AI agent training plan template for telecoms operators helps build the training behind this.

What should telecoms staff be trained to catch?

1. Identity claims. A caller who knows the account holder's date of birth and address has shown they know two facts, not that they are the customer. Those facts are declared and often stolen.
2. Pressure. Urgency, distress and threats to complain are common in fraudulent requests. Approvers must not relax verification for them.
3. Vulnerability in collections. An agent's arrears plan may be affordable on paper and inappropriate for a customer who has disclosed a hardship.
4. Refusals. If the agent refuses a SIM swap because verification failed, the approver must not complete it manually.

The common gaps are covered in what telecoms operators get wrong about AI agent training.

An example from a fraud review

A mobile operator's agent handles SIM replacement requests through chat. It completes verification steps and holds every replacement for a person. After a spate of account takeovers, the fraud team reviews 60 approved replacements.

Each record shows the verification steps, the approver and their certificate status. The fraud cases cluster around three approvers on one evening shift, all certified, who accepted a security-question answer as sufficient when the operator's policy required a one-time code sent to the existing SIM. The certificates show training happened; the records show it did not hold under pressure. The operator removes the security-question path for SIM swaps entirely and briefs every approver, logged against each name.

Which controls make the evidence trustworthy?

• Rights for SIM swaps, ports and disconnections tied to current certificates.
• Verification method recorded against each approval.
• No manual completion of refused actions outside the workspace.
• An append-only record that fraud and complaints teams can query.

Under the EU AI Act, deployers of high-risk systems must assign oversight to people with the competence, training and authority to exercise it; see Article 26 deployer duties and staff competence in telecoms. Operators that are essential or important entities under NIS2 also face cybersecurity risk management duties. For comparable sectors, see how utilities prove staff are trained and how universities do it. The guide to AI literacy and certification covers the general approach.