AI in telecom: network management, fraud detection and NIS2

Short answer: Telecom operators use AI mainly for two things: optimising networks and detecting fraud. Network-management AI is usually low-risk under the AI Act. Fraud detection can be more sensitive when it assesses or blocks customers. The heaviest regime for the sector, however, is NIS2: telecom is essential infrastructure with strict cybersecurity and reporting duties.

AI in network management

AI predicts traffic peaks, steers capacity dynamically and detects faults before customers notice them. These applications steer technology, not people, and touch no fundamental rights. In the AI Act risk pyramid they therefore usually fall under low or minimal risk.

Attention here goes mainly to reliability and security — not so much to the AI Act, but to NIS2.

Fraud detection and the fundamental-rights boundary

AI that detects subscription fraud, SIM swapping or payment fraud assesses customer behaviour. As long as the system generates signals reviewed by a human, it usually stays outside the high-risk category.

It becomes more sensitive if the system independently blocks services or places customers on a list without human intervention. Then safeguards come into play: transparency, human oversight and the ability to challenge a decision. Fully automated decisions with legal effects also engage the GDPR. Watch the boundary with prohibited AI practices, such as untargeted social scoring.

NIS2: the heaviest regime for telecom

NIS2 (Directive (EU) 2022/2555) designates telecom as an essential sector. That brings obligations independent of AI but applicable to AI systems in the network:

• Risk management: demonstrable security measures across the chain, including AI components and suppliers.
• Incident reporting: significant incidents must be reported quickly — an initial notification usually within 24 hours.
• Management accountability: leadership is responsible and can be held personally liable.

An AI system that controls the network is itself a potential attack surface. A manipulated model or a poisoned dataset falls under the risk management NIS2 requires.

What to do

• Classify per application: network AI is usually low-risk; fraud detection that affects customers warrants extra safeguards.
• Keep a human in the loop for decisions that block services or flag customers.
• Integrate AI into your NIS2 risk management: treat models and datasets as security-critical components.
• Test for manipulation: model poisoning and adversarial attacks are real risks for network AI.
• Document incident processes: know the reporting deadlines and management accountability under NIS2.

For telecom, cybersecurity is the sharpest edge — the same NIS2 logic recurs in AI in media and journalism, where platforms and infrastructure must also be protected.