AI literacy in a telco: the problem is scale
Thousands of people across call centres, stores and indirect channels, most of them not employees. How to separate the few roles needing individual evidence, and what to reuse from the existing NIS2 framework.
In short. In a telco the problem with AI training is scale: thousands of people across call centres, stores and the sales network, most of whom are not employed by the operator. The uniform training that works at those numbers covers the literacy obligation and doesn't cover clause 7, which asks for competence by role. The answer isn't training everyone the same way, it's separating the few roles needing individual evidence from the mass that needs awareness.
Telecom operators have vast, well-run training frameworks built on compliance, safety and product. AI slots in easily as a module, and that is both the advantage and the risk: a module added to a system designed for scale produces no specific competence on any system.
The perimeter is wider than the payroll
Clause 7.3 speaks of people working under the organisation's control, and in a telco that perimeter includes the outsourced call centre, franchised stores, agents and installation technicians. These are people using assistance, quotation and diagnostic tools daily, and who in most cases appear in no operator training plan.
This is the first gap to close, and it is contractual work. Competence requirements belong in service contracts with partners, alongside an obligation to supply evidence.
The second gap concerns turnover. In a call centre annual churn is high, and an annual training plan covers a population that has half changed in the meantime. What's needed is a trigger tied to a person joining, not to the calendar.
The roles needing individual evidence
For the vast majority, awareness is enough: what the tool does, when it needs checking, who to report to. For three groups the evidence has to be named.
Those working on credit assessment. This is the surprise in a telco. Device instalment plans involve an assessment of the customer's creditworthiness, which falls under Annex III, and anyone working on that process carries full competence obligations.
Those exercising human oversight over critical network systems. Not under the AI Act, where those systems stay low risk, but under NIS2, which requires demonstrable competence on resilience.
Those approving platform adoption. In a telco adoptions often run through procurement, and whoever signs needs to know what they are approving in terms of role and obligations.
Which framework does your company actually need?
AI Rating measures maturity across the four areas of the model and shows where to start, with priorities and estimated effort.
Start your AI RatingWhat to reuse from NIS2
The framework built for NIS2 already covers part of the work, and mapping it is worth doing before building.
| Element | Exists for NIS2 | What's missing for AI |
|---|---|---|
| Security and resilience training | Yes, structured | Extension to AI systems |
| Evidence tracking | Yes, by obligation | Link to role and system |
| Critical supplier management | Yes | AI competence requirements in contracts |
| Operational risk culture | Yes | Translation to risk for the individual |
| Effectiveness verification | Exercises | Practical cases on AI systems in use |
The last row is the easiest to close and the most often ignored. Telcos run exercises on security incidents, and the same format applied to an anomalous AI output produces effectiveness evidence that a questionnaire doesn't give.
The module no vendor can write
As in every sector, the useful part requires information only the operator holds: which systems are live on which processes, which edge cases have already surfaced in support, who to report anomalous behaviour to and what happens next.
In a telco this translates into short, repeatable content, because it has to reach thousands of people with high turnover. Thirty minutes per system, refreshed when the system changes, distributed through the same channels already used for product.
Where to start
The prerequisite is the AI system inventory, built in the knowledge that many systems arrived inside network vendor platforms and were never classified.
From there the matrix gets built, described in a roles-competence matrix for AI, separating the few roles needing individual evidence from the wider population. The full requirements are in clause 7 explained without jargon.
The sector's regulatory picture is on the AI governance for telecom operators page.
Our approach to role-based tracks is on the AI Training page. To review your operator's plan, you can book a meeting.