Robi Axiata is preparing to let customers speak with an artificial intelligence-powered voicebot for routine services, in what would be the Bangladesh mobile industry’s first use of conversational AI over voice.
The Bangladesh Telecommunication Regulatory Commission (BTRC) has approved the Verbex VoiceBOT Solution for a six-month trial, allowing the second-largest mobile operator to use the system for charging and billing information, loan management, value-added services and mobile offer purchases.
A voicebot differs from the chatbots already used by telecom operators because customers do not have to type.
They can speak to the system, which interprets the request and responds by voice. If the conversation reaches a point where personal information must be exchanged, Robi will have to hand the call over to a human agent.
The service will remain optional. Customers must give explicit consent and be able to move seamlessly to a human customer-service representative at any time.
The trial also marks a more sensitive use of AI because some of the information needed to provide the service will be processed through Google Cloud Platform infrastructure outside Bangladesh.
That has prompted BTRC to impose controls on what can leave the country, how the information is handled and what the overseas AI provider can do with it.
Robi must encrypt and pseudonymise personal data before processing. The large language model (LLM) service provider may use customer information only to deliver the service, but cannot retain it or use personally identifiable information (PII) to train the AI model.
The arrangement also limits what is sent overseas in the first place.
Customers’ names, national identity card numbers, addresses and biometric information will not be transferred.
Their original mobile numbers, technically known as Mobile Station International Subscriber Directory Numbers, will also not be shared directly. Instead, the system will use pseudonymised and encrypted identifiers.
In simple terms, pseudonymisation replaces information that directly identifies a customer with another identifier or code, while encryption turns the information into a protected form that cannot readily be read without the proper decryption mechanism.
Complete call detail records will not be transferred directly either. Such records typically include call times, duration and the numbers involved.
Information relating to charging, offers, bundles and loans will instead be processed in hashed or pseudonymised form.
Robi has entered into a Managed Service Agreement with vendor Verbex to introduce the service. The system will use an application programming interface (API), identified as Mobile Internet Fulfilment Exchange, together with a database dashboard and CP connectivity to exchange information and integrate the voicebot with Robi’s systems.
The overseas Google Cloud server is identified as certified under an international standard for protecting personally identifiable information in public-cloud environments.
That certification, along with encryption and pseudonymisation, reduces some of the risks around overseas processing, but does not remove them altogether. The effectiveness of the safeguards will depend on how they are implemented and monitored during the trial.
BTRC has kept itself closely involved in that process.
Robi must retain relevant logs and records for at least two years and provide the regulator access to the relevant data. BTRC can audit the system at any time and can suspend or cancel the approval without stating a reason.
The approval also bars privacy violations and unauthorised data processing, while requiring Robi to follow commission directives on customer protection and telecommunications data security.
The six-month test therefore gives Robi room to see whether AI can handle routine voice-based customer service without giving the technology unrestricted access to customer information.
BTRC reviewed the proposal against Bangladesh’s rules on personal-data protection, telecom licensing and lawful access to information.
The review focuses in particular on data security, pseudonymisation and the requirement for prior regulatory approval when customer information is processed or transferred outside Bangladesh.
It also preserves lawful access for BTRC and law-enforcement agencies where information is required for national-security purposes or investigations.
The commission’s legal review cites relevant sections of the Personal Data Protection Act, 2024, alongside BTRC’s Unified Licensing Policy, the Cyber Security Act, 2023, and the Service and Tariff Directives, 2015.
It also refers to telecommunications law, giving BTRC authority to issue directions and formulate guidelines concerning telecommunications-related data centres.
