AI Rating in a telco: the gate sits on the commercial side

In short. In telecom operators the AI maturity profile skews high on Readiness and Delivery, because these are technology companies with their own data and mature release cycles. The gate blocking the class sits on Risk, and more precisely on one point: the commercial systems nobody has classified, starting with customer credit assessment. It is the one sector where the technical dimension isn't the problem.

An operator running the assessment expects a high result, and often gets one across three dimensions out of four, with scores that in other sectors would be out of reach. The jump in class, though, is decided entirely on the fourth, and no technical advantage compensates for it.

The four dimensions in a telco

Readiness measures preparation, data, skills, infrastructure. It is high: operators own their data, run their own infrastructure and hold technical competence in house. This is the opposite condition to sports clubs and many insurers.

Delivery measures the ability to reach production and maintain. This is high too, because the software release cycle exists and works at scale. The limit is that the cycle covers systems developed in house and not those switched on inside vendor platforms.

Risk measures governance, compliance and ethics. Everything concentrates here. The NIS2 framework exists, is mature and covers operational resilience well, while governance of AI systems read through the lens of impact on the individual is almost always exposed, because nobody asked for it before and the function that should own it isn't the same one.

Confidence measures management commitment and user trust. It is generally good inside the company and weaker across the indirect network, which uses tools without knowing what they do.

The gate: commercial systems never classified

The recurring constraint isn't where you would expect. Operators govern network systems well, because they consider them critical, and govern commercial systems poorly, because they consider them sales tools.

The emblematic case is the creditworthiness assessment attached to device instalment plans. It originates as a commercial rule, often implemented inside a CRM, and falls under Annex III. Until it gets classified as a high-risk system, the Risk dimension stays below threshold, and since the gates are non-compensable the class drops to the level of the constraint even with excellent Readiness and Delivery.

The second exposed point concerns AI features switched on inside platforms already in use, where the operator is a deployer without having decided to be and often without knowing.

When the two frameworks diverge

There's a finding that only surfaces at mature operators, and it is expensive. A company that built NIS2 documentation and then separately built AI Act documentation on the same systems ends up with two frameworks that diverge.

For the rating this doesn't help as much as it might seem, because the evidence that counts is the consistent kind. Two documents describing the same system differently weaken each other, and in a review the question becomes which of the two reflects reality.

The class improves when the frameworks coordinate, not when they multiply.

What a class means in practice

Class	Typical situation in a telco	What's reasonable to do
D	AI systems live in vendor platforms, no mapping	Build the inventory including activated features
C	Network governed, commercial unclassified	Classify commercial processes, starting with credit
B	Classification complete, NIS2 coordination underway	Complete the evidence on Annex III systems
A	Mature system verified across all dimensions	Reserved for verified assessments, not self-assessments

Moving from C to B at an operator is almost always classification and documentary coordination work rather than technology. It's also why it gets deferred: it produces nothing visible.

Why measure before the next investment cycle

Operators plan investment on long cycles and significant budgets. An assessment made before that cycle allows documentation and log access requirements to be written into vendor tenders, which is the moment the leverage exists.

After signing, everything changes. Obtaining a model's technical documentation, its logs or a guarantee of notice on updates costs far more, requires a renegotiation nobody wants to open, and in several cases simply isn't possible because the supplier doesn't produce them.

Where to start

The prerequisite is the AI system inventory, built to include features activated inside existing platforms and commercial processes with effects on customers.

The full model, with the four dimensions and the gate logic, is on the AI Rating page. The sector's regulatory picture is on the AI governance for telecom operators page.

For an assessment of your operator's position you can book a meeting or start the self-assessment.