AI Governance When the AI Is Inside the Network

Most AI governance guidance assumes the AI sits beside the business. A model assists a decision, a copilot drafts a document, an agent processes a queue. Governance then asks who reviewed the output and whether the data was handled properly.

‍

In a telecom network the AI is inside the product. Automation makes configuration changes to the thing customers are paying for, at machine speed, and the obligations attached to that product were written before anything could change it without a person deciding to.

‍

Why Doesn't Standard AI Governance Fit?

‍

Because it is built around a review step, and a review step is incompatible with the reason the automation exists.

‍

Human oversight works where a decision waits. An agent optimizing traffic, rebalancing capacity or responding to a degradation is making changes on a timescale that would be pointless if somebody had to approve each one. So the standard control cannot be applied where it matters most, and applying it anyway produces either a bypassed process or an automation nobody uses.

‍

Oversight Has to Move

‍

From approving actions to bounding them. Where a change cannot be reviewed before it happens, the governable properties are which changes are available at all, how far each can go, and whether it can be reversed. The control is design-time rather than runtime, and the approval gate before deployment is where it has to be exercised.

‍

Which Obligations Are Specific to This Sector?

‍

Three, and none appears in general AI governance material because none exists outside telecommunications and adjacent regulated infrastructure.

‍

Lawful interception is the first and the least discussed. Operators maintain legally mandated capability for authorized access to communications, and automation that reroutes or reconfigures traffic paths can interact with that machinery. An optimization that moves a flow is a routine engineering action in most contexts and something else entirely where an active interception depends on the path.

‍

Customer network information is the second. Call records, location data and usage patterns carry statutory protection distinct from general privacy law, and network optimization models ingest exactly that telemetry. A model trained or prompted on raw operational data is handling protected information whether or not anyone framed it that way.

‍

The Third Is Classification

‍

Network infrastructure sits inside critical infrastructure regimes, so an AI component making decisions in that path can fall into a high-risk classification on the strength of where it operates rather than what it does. A model doing something unremarkable inside a regulated function inherits the function's obligations, which classification following the use rather than the tool sets out.

‍

What Should Be Recorded Instead of an Approval?

‍

Decision lineage, which is the substitute for oversight when oversight cannot happen in time. Rather than evidence that somebody approved a change, evidence of what the system decided and on what basis.

‍

Four fields, being the inputs the model saw, the action it selected, the constraint set in force at the time, and the outcome. Four fields, recorded per action, which is a volume problem rather than a design problem and is why it frequently is not done. An operator able to reconstruct why a configuration changed at a given moment has the artifact a regulator will ask for.

‍

Why Does the Constraint Set Matter?

‍

Because it establishes what was possible rather than what happened. An action within a bounded set is a system working as designed, and the same action where the bound was absent is a different finding. Recording the constraints in force alongside the decision is what separates the two later, and change records that survive an audit needs both halves.

‍

How Do You Bound a Change That Happens in Milliseconds?

‍

Constrain the action set at design time and enforcing it outside the model, the only approach that holds where the decision cannot wait.

‍

Three bounds do most of the work. A magnitude limit, so a single action can change capacity or routing by a stated proportion rather than without limit. A rate limit, so a model in a loop cannot make a thousand small changes that compound into a large one. Then a protected set, meaning configuration the automation cannot touch regardless of what it concludes.

‍

Which Configuration Belongs in the Protected Set?

‍

Anything an obligation depends on. Interception capability, retention settings, logging configuration and the boundaries of regulated data stores are the candidates, since an automation that can alter its own audit trail or the machinery a legal duty rests on has been given a capability no efficiency gain justifies.

‍

What Does the Model See That It Should Not?

‍

Protected customer information, routinely, and the exposure is at retrieval rather than at training.

‍

An optimization model reasoning about network conditions is reading telemetry that includes subscriber patterns. A customer care assistant retrieving account context is pulling records that carry statutory protection. Neither is an unusual design and both place regulated data into a model context, so the control is filtering what reaches the model rather than auditing what it produced. An AI Interaction Data Fabric records which data classes reached which model, which is the evidence the obligation requires.

‍

Why Is Retrieval Harder Than Training?

‍

Because training happens once under supervision and retrieval happens continuously in production. A training dataset can be reviewed, minimized and signed off. A retrieval path assembles context per request from whatever the query matches, so the data reaching the model differs every time and nobody reviewed any particular instance.

‍

How Should the Exposure Be Priced?

‍

Through service continuity rather than data loss, which inverts the usual weighting and follows from where the automation sits.

‍

A misconfiguration propagated by automation degrades service for subscribers, and the consequence is measured in outage duration, regulatory penalty and customer compensation rather than in records exposed. Regulatory reporting duties for significant service disruption apply on their own timetable, and modeling an outage rather than a breach is the framing that produces a usable figure.

‍

What Makes This Worse Than a Manual Error?

‍

Propagation speed and scope. A person making a configuration mistake affects what they touched before somebody noticed. An automation making the same mistake applies it wherever its scope reaches, at machine speed, which is why the magnitude and rate bounds matter more than the accuracy of the model.

‍

Who Owns This Inside an Operator?

‍

Network engineering builds the automation and security governs AI, and the two report through different chains with different incentives, which is where the problem sits unattended.

‍

Engineering owns the automation because it owns the network, measures itself on availability and efficiency, and experiences a bound as a constraint on both. Security owns AI governance, has no authority over network configuration and frequently cannot read the telemetry that would show what the automation did. Neither position is unreasonable and the union leaves the bounds unowned.

‍

Where Should the Bounds Be Set?

‍

Engineering sets them, with security able to require that they exist and be recorded. Asking security to specify a magnitude limit on capacity reallocation is asking a function without the domain knowledge to make an engineering judgment. Asking engineering to record which bounds are in force, and to treat the protected set as non-negotiable, is a request they can act on, and an obligation split across functions describes what happens otherwise.

‍

What Does the Regulator Ask For?

‍

Neither function's answer on its own. A question about why a configuration changed needs the engineering record, and a question about whether the change was governed needs the control position. An operator able to produce both from one record is in a materially better position than one assembling them from two teams during an inquiry.

‍

What Should an Operator Establish First?

‍

Four things, and the first two need no new tooling.

‍

Which automations can change production configuration, as an enumerated list rather than a description. Which of those can reach configuration an obligation depends on, which is the protected set by another name. Whether decision lineage is recorded at all, since the answer is frequently no and it cannot be reconstructed later. Finally, whether a rate bound exists, because a model in a loop is the failure mode with no manual equivalent. An AI data fabric supplies the first from observed activity rather than from an inventory somebody maintains.

‍

Bound It, Because You Cannot Review It

‍

AI governance built around a human review step does not transfer to a network where automation changes the product at machine speed, since the review would defeat the purpose. Oversight moves to design time, constraining which actions exist, how far each can go and how often, with a protected set covering anything an obligation depends on. The sector-specific duties around lawful interception, customer network information and critical infrastructure classification appear in no general AI governance material and attach on the strength of where the model operates. The loss is also service continuity rather than records exposed. Kovrr's AI Security and Governance Platform records which data classes reached which model and what each automation can touch.

‍

To see which AI automations in your network can reach regulated configuration or protected customer data, book a demo mapped to your own estate.