FCC Communications Act (Title II) — Regulatory Reference

Under 47 U.S.C. § 222, telecommunications carriers have strict obligations around Customer Proprietary Network Information (CPNI) — the call records, usage patterns, and service details carriers collect in the course of providing communications services. AI agents that access CPNI to power customer support, churn prediction, or network operations are subject to these same obligations. The carrier must restrict CPNI use to authorized purposes, prevent unauthorized disclosure, and be able to demonstrate that access controls were in place. Automated agents operating without explicit access governance create direct exposure because the carrier — not the AI vendor — remains the legally responsible party.

CPNI (Customer Proprietary Network Information) is defined under 47 U.S.C. § 222 as information a carrier obtains by virtue of its relationship with a customer — call detail records, call destination data, service type, usage volume, and related billing data. CPNI is classified as high-sensitivity under Title II, meaning AI agents cannot freely query it for general analytics or model training. Permitted uses are narrow: service provisioning, billing, and emergency services. Any AI agent accessing CDR data, raw call records, or customer service history must operate under a policy that restricts access to authorized purposes only. Agents built for tasks like churn scoring or customer segmentation should be explicitly blocked from accessing raw CPNI sources.

Title II obligations attach to any entity the FCC classifies as a common carrier — typically facilities-based carriers, CLECs, and ISPs that have been reclassified under the broadband rulemaking cycles. The CPNI obligations under § 222 apply whenever a carrier or its systems — including AI agents acting on behalf of the carrier — access, process, or transmit customer communications data. This includes internal analytics agents, support automation tools, and any agentic workflow that reads CDR data, account summaries, or usage records to make decisions or generate recommendations. CPNI rules are carrier-level obligations; a carrier cannot delegate accountability to a third-party AI vendor.

AutoPIL enforces access policy at the retrieval layer — before any AI agent receives CPNI. Each agent is registered with an explicit policy that defines which sources it can access (for example, account summaries and service history) and which are denied (for example, CDR data and raw call records). The platform applies a maximum sensitivity ceiling per agent, so a churn prediction agent scoped to medium-sensitivity data cannot retrieve high-sensitivity CPNI even if it attempts to. Every access attempt — allowed or denied — is written to a tamper-evident audit log with cryptographic chain integrity. This produces the access records a carrier needs to demonstrate compliance with § 222 without relying on agent-level logging that could be altered after the fact.

The FCC has authority to issue forfeiture orders under the Communications Act for CPNI violations, with penalties that can reach tens of millions of dollars for repeated or willful violations. Past FCC enforcement actions against carriers for CPNI breaches have included multi-million dollar fines. Beyond direct FCC enforcement, unauthorized CPNI access by an AI agent can trigger state attorneys general investigations under state consumer protection statutes and create class action exposure if customer communications data was disclosed or used outside permitted purposes. The FCC also has authority to condition or revoke operating licenses in cases of serious or repeated violations. Carriers deploying AI on customer data without documented access controls face compounded risk if they cannot produce an audit record of what the agent accessed and why.