Mobile phone operator, Robi Axiata has secured a six-month experimental approval to deploy an artificial intelligence-powered customer service platform using offshore cloud infrastructure, subject to stringent conditions on subscriber data protection, privacy and regulatory oversight.
The approval, granted by the Bangladesh Telecommunication Regulatory Commission (BTRC) at its recent commission meeting, allowed the mobile operator to introduce the Verbex VoiceBOT Solution through a managed service arrangement (MSA) with vendor Verbex, according to the documents.
The proposed system aims to modernise AI-driven customer support by handling enquiries and services related to charging information, billing details, loan management, value-added services (VAS) and offer purchases.
Talking to BSS, Robi Chief Corporate and Regulatory Officer Shahed Alam today said they have already introduced the service and customers have started to get the benefit of it.
“Now, the customers will not have to stay on queue to get connected the agent. It will totally given them experience of AI,” he added.
By automating interactions involving these services, the system is intended to provide another channel for customers to access operator services and obtain relevant information.
Its technical architecture will use API integration through MIFE, a Metabase Dashboard and CP Connectivity, with processing routed through Google Cloud Platform (GCP) infrastructure located outside Bangladesh.
However, the permission places strict limits on the categories of subscriber information that can be transmitted or processed through the offshore platform.
Robi cannot transmit subscribers' mobile numbers, or MSISDNs, in their original form. The numbers must undergo pseudonymisation and encryption before being sent to the cloud.
Raw Call Detail Records (CDRs) are strictly prohibited from leaving Bangladesh, while processing through the offshore system is limited to hashed or pseudonymised data relating to charges, loans and offers.
The restrictions also prohibit the transfer or overseas storage of directly identifiable personal information, including subscribers' names, National Identity Card (NID) numbers, addresses and biometric information.
A separate safeguard applies to voice interactions involving personal information. Whenever an interaction requires the exchange or verification of PII, the system must immediately transfer the call to a human customer service agent.
The approval also imposes restrictions on the use of large language models (LLMs) in the voicebot service. LLM service providers cannot store or retain subscriber information, which may only be processed dynamically during a session. Subscriber data and PII are also prohibited from being used for LLM training or fine-tuning.
Subscribers must have complete discretion over whether to use the service, and its activation requires their explicit and clear consent. The system must also ensure seamless transfer to a human agent at any stage of an interaction.
The conditions are grounded in the Personal Data Protection Act, 2023. Sections 17 and 20 address technical requirements for pseudonymisation and security during data processing, while Section 29 requires prior commission approval before any subscriber data can be transferred offshore. Sections 5 and 15 provide safeguards against unauthorised overseas transfer of personal data and complete CDRs.
The BTRC's regulatory authority in this regard derives from Section 30(t) of the Bangladesh Telecommunication Regulation Act, 2001, which empowers the commission to issue directives and regulations concerning telecom data management and data centres. The Cyber Security Act 2023, BTRC Unified License conditions and Services and Tariff Directives, 2015, also form part of the applicable regulatory framework.
As part of the approval conditions, Robi must preserve subscriber access and session logs for at least two years. The system must remain accessible to the BTRC and law enforcement agencies (LEAs) for national security and investigation purposes.
The commission has retained unrestricted authority to audit the system at any time. It can also suspend or cancel the approval at any time without prior notice or providing any reason.
The six-month experimental permission thus allows Robi to test its offshore AI-powered customer service platform under defined data-processing restrictions, while leaving the system subject to continuous regulatory scrutiny and the commission's power to withdraw the approval.
