← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for telecom operators

*Engineering guidance, not legal advice. Your legal team decides how the Act applies to your products.*

Where this sector lands

Telecom operators meet the Act in three places:

• Network operations. Annex III point 2 covers AI used as a safety component in the management and operation of critical digital infrastructure, which includes electronic communications networks. Self-healing and traffic-steering systems whose failure could take down emergency calling deserve a careful look. AI used solely for cybersecurity is, per the recitals, not a safety component on that basis alone. Point 2 systems are registered at national level (Art. 49(5)).
• Customer contracts. A creditworthiness check before a postpaid contract or handset financing on instalments may fall under point 5(b), evaluation of the creditworthiness of natural persons.
• Customer service. Support and sales agents are usually not high-risk, but Article 50 requires disclosure that the customer is dealing with an AI, from 2 August 2026. See customer support.

The logging duties that follow

• Art. 12 (providers): automatic recording of events for high-risk systems, whether a network vendor supplies them or you build them.
• Art. 19 (providers): keep logs under your control for at least six months.
• Art. 26 (deployers), the operator: competent human oversight of automated network actions (Art. 26(2)), monitoring and serious-incident reporting (Art. 26(5)), logs kept for at least six months (Art. 26(6)). Deployers of point 2 systems are exempt from the Article 27 impact assessment; deployers of 5(b) systems are not.

Network incident reporting under telecom and NIS2 rules runs in parallel and usually asks for faster answers than the AI Act does.

On timing: the Digital Omnibus agreement moves Annex III high-risk obligations to December 2027 (details and caveats).

What counts as evidence

After an outage, the operator must show what the automation saw, what it changed, and whether a human approved it.

Abbreviated ledger excerpt (prev, hash and sig omitted):

{"seq":1,"type":"tool.result","data":{"name":"kpi_anomaly","output":{"cell_cluster":"MIL-N-12","drop_rate":0.074}}}
{"seq":2,"type":"llm.response","data":{"model":"noc-copilot-2","usage":{"input_tokens":3120,"output_tokens":140}}}
{"seq":3,"type":"policy.decision","data":{"kind":"tool.call","action":"block","hits":[{"rule":"no-core-change-without-noc"}]}}
{"seq":4,"type":"tool.call","data":{"name":"open_change","input":{"noc_engineer":"noc_5","change":"CHG-30418","scope":"ran_only"}}}

The block on core changes and the human-owned change ticket sit in one verifiable chain.

How Vetro Attest fits

Vetro Attest accepts an OpenTelemetry GenAI trace (OTLP/JSON) or a native Vetro ledger, with nothing to install. Verification is free. For 29 USD per ledger, one-off:

• a full EU AI Act report (Markdown and HTML) mapping the run onto the logging obligations, with an explicit list of what the log cannot show;
• an ed25519 countersignature over the ledger digest, event count and timestamp, verifiable by anyone with our published public key.

A practical pattern: countersign each automation run that changes network state, and attach the attestation to the change ticket. For customer credit checks, do the same per decision.

Limits, stated plainly: the countersignature proves the log verified clean at a time, not that the network change was safe. The report supports a compliance conversation; it is not a conformity assessment. Paid ledgers are deleted after 7 days, and the report and attestation are emailed to you to keep.

Next steps

• Run the free EU AI Act Art. 12/14 checker against your current setup.
• Verify a trace free, then get the countersigned report for 29 USD.
• Compare approaches: vs. OpenTelemetry alone, vs. Datadog LLM Observability.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.