AI at the scale of every subscriber in the country

Sector figures

Three use cases with risk notes

1. 01

   Network-incident triage and customer communication

   A read-and-propose agent correlates alarms, tickets and change records, summarises the likely cause and blast radius for the NOC, and drafts the customer notice that a person approves and sends.

   Risk notes. Mostly operational data; cell-level location can be personal when tied to subscribers, so keep the summariser on aggregated views; no write path to network elements; hosting in-country is straightforward because the data never needed to leave.

2. 02

   Customer-care assistant over subscriber records

   Retrieval over plans, policies and the caller's own account, with the retriever filtered by the agent's entitlements and the caller's verified identity; answers cite the record; the assistant proposes account changes that the care agent applies.

   Risk notes. Millions of data subjects: Tier 4 licence (SI 155 s.6(1)(d)); every prompt containing account data is personal data, so in-country models by default and a s.28 assessment plus notification (SI 155 s.10(2)(c)) before any regional or hosted model sees it; interception and confidentiality obligations under the operator's licence sit alongside the Act; 24-hour breach reporting to the Authority that also licenses the network.

3. 03

   SIM-swap and mobile-money fraud scoring

   Models score risk on SIM changes, device changes and transaction patterns and route high-risk events to a fraud analyst or a step-up verification; blocking a customer remains a human or a rule-with-appeal decision.

   Risk notes. A block or a hold is a decision with significant effect (s.25); either obtain consent to automated checks in the terms and offer a contest route, or keep the decision human; bias monitoring across customer segments; model register and validation even though no RBZ standard applies to the operator itself (it does apply to any banking partner in the mobile-money chain).

POTRAZ twiceThe same authority publishes the sector performance report, licenses the operator and administers the Cyber and Data Protection Act (s.5). Governance material prepared for one conversation should be reusable in the other: the model register, the processing notifications and the breach runbook.