Governing trustworthy AI in critical communications infrastructure: an ethical and regulatory framework for 5G/6G Open RAN and network automation

Telecommunications infrastructure is undergoing a transformation that is ethical as much as technical. In fifth-generation (5G) and emerging sixth-generation (6G) environments, network functions are increasingly virtualised, software-driven and orchestrated through artificial intelligence (AI)-enabled control loops that allocate spectrum, prioritise traffic, route around disturbance and detect anomalies, increasingly without contemporaneous human approval. The International Telecommunication Union Radiocommunication Sector (ITU-R) framework for IMT-2030 anticipates AI/machine learning (ML) as integral to the IMT-2030 architecture, including an integrated AI-and-communication usage scenario (ITU-R, 2023), and the Global Coalition on Telecommunications (GCOT) 6G principles call for resilience-by-design and safe failover (GCOT, 2026). Policy institutions no longer treat this as a purely technical matter: the US National Telecommunications and Information Administration (NTIA) calls secure telecommunications vital to competitiveness and national security and has opened Executive Branch policy for 6G to public input (NTIA, 2024).

The problem is not absent standards but dispersed ones, spread across overlapping layers. The NIST AI Risk Management Framework (AI RMF 1.0) is built around the GOVERN, MAP, MEASURE and MANAGE functions and trustworthiness characteristics such as validity, security, transparency, explainability, privacy and fairness (NIST, 2023); NIST CSF 2.0 adds governance and supply-chain risk management (NIST, 2024a); 3GPP TS 33.501 defines the 5G security architecture (3GPP, 2025) and TR 33.877 studies AI/ML security in NG-RAN (3GPP, 2023); the ENISA 5G controls matrix consolidates 144 high-level and 399 detailed controls (ENISA, 2023); and the EU AI Act adds horizontal duties for high-risk systems (European Union, 2024). No single instrument consolidates these into a telecom-specific, lifecycle-organised form for AI-enabled network automation and Open Radio Access Network (Open RAN).

This dispersion directly affects network users. The Body of European Regulators for Electronic Communications (BEREC) has documented AI use across network operations and warned of explainability, liability, privacy and cybersecurity implications (BEREC, 2023). In high-consequence settings – emergency communications, public safety, national-scale carrier networks – an opaque or poorly governed model produces harms that are not merely technical: degraded service, disputes no human can adjudicate and outcomes no party owns.

The US national-interest implications are direct. NTIA’s 6G and Open RAN work emphasises trusted suppliers, interoperability and specialised use cases including defence scenarios (NTIA, 2024; NTIA, 2025; NTIA and ITS, 2025), while CISA’s Joint Cyber Defense Collaborative AI playbook shows US institutions increasingly expect AI vulnerabilities to be shared in collective defence (CISA, 2025).

This study therefore asks: what risk-based framework can align trustworthy AI principles, cybersecurity requirements and telecom-specific operational realities for Open RAN and AI-enabled 5G/6G automation in a way that is auditable, accountable and bounded by human authority? It answers through a structured documentary synthesis and proposes a governance model for regulators, operators, integrators and standards communities.

The trustworthy AI literature has converged on a common normative core: AI should be valid and reliable, safe, secure and resilient, accountable and transparent, explainable, privacy-enhanced and fair with harmful bias managed (NIST, 2023). The NIST AI RMF organises practice around GOVERN, MAP, MEASURE and MANAGE (NIST, 2023). Its 2026 concept note for a critical-infrastructure profile confirms that high-stakes environments require lifecycle trustworthiness across information technology, operational technology and industrial systems (NIST, 2026) – logic that transfers directly to carrier networks.

The horizontal regulatory layer is similarly maturing. The EU AI Act establishes risk-based duties for high-risk AI – lifecycle risk management, human oversight, robustness, cybersecurity, and transparency – and classifies AI used as a safety component in the management and operation of critical digital infrastructure as high-risk (European Union, 2024). ISO/IEC 23894 and 42001 add international risk-management and management-system layers that turn voluntary principles into auditable processes (ISO/IEC, 2023a; ISO/IEC, 2023b), while NIST CSF 2.0 emphasises governance and supply-chain risk management and notes that cybersecurity and privacy considerations apply across the AI lifecycle (NIST, 2024a). A telecom-relevant baseline is emerging: ETSI’s baseline cybersecurity requirements for AI models and systems define lifecycle security principles for developers, integrators and operators across the AI supply chain (ETSI, 2025).

General AI ethics scholarship adds a relevant caution. The OECD Recommendation and the EU High-Level Expert Group locate trustworthy AI in human-centred values, transparency, robustness, fairness and accountability (OECD, 2024; HLEG, 2019). Floridi et al. (2018) framed it around beneficence, non-maleficence, autonomy, justice and explicability, and Jobin et al. (2019) show global guidelines converge on core principles but diverge on implementation. Mittelstadt’s (2019) critique was central – principles cannot guarantee ethical AI unless translated into institutions and enforceable practices – and Selbst et al. (2019) warned that abstraction can hide the social conditions that produce harm. ML assurance, likewise, must be generated as evidence across the model lifecycle – data management, verification, deployment and monitoring – not asserted at a single checkpoint (Ashmore et al., 2021).

This study is situated within three regulatory-governance traditions. Firstly, algorithmic regulation describes systems that govern through continuous data-driven monitoring and automated or recommended intervention (Yeung, 2018); AI-enabled network automation is such a system, making its governance a regulatory and not only a security question. Secondly, responsible-innovation scholarship argues that emerging technologies should be governed through anticipation, reflexivity, inclusion and responsiveness (Stilgoe et al., 2013), embedding public values into technical design rather than appending them afterwards. Thirdly, telecommunication is infrastructure for other infrastructures, so its interdependencies propagate failures across sectors (Rinaldi et al., 2001); this raises the public-interest stakes above those of a single sector.

AI-security ethics also matters directly. NIST’s adversarial ML taxonomy shows that attacks span lifecycle stages and include evasion, poisoning, privacy compromise and model manipulation (NIST, 2025). Each category has an ethical valence: poisoning and evasion degrade fairness and safety; privacy compromise violates data-subject rights; model manipulation undermines the conditions of meaningful explanation. For telecom specifically, supervising AI-enabled control loops requires more than generic cybersecurity controls; it requires defences against data poisoning, model tampering, and environment-induced drift, visible to the institutions accountable to users. Recent experimental work on the RAN Intelligent Controller makes these threats concrete: Sapavath et al. (2023) show that manipulating data in a shared database RAN Intelligent Controller RIC inside the near-real-time RAN Intelligent Controller (RIC) can materially degrade the accuracy of an ML-based near-real-time RAN application xApp and, through it, system performance, while Lacava et al. (2025) demonstrate backdoor data-poisoning of deep-reinforcement-learning xApps that, once triggered on a live O-RAN deployment, produced average network-performance degradation of roughly 87%. Such RIC-specific evidence is precisely what a telecom assurance regime must anticipate.

Open RAN scholarship presents a double-edged architecture. Liyanage et al. (2023) argue that disaggregation, softwarisation, AI and virtualisation create flexibility and innovation but expand the attack surface and complicate security and privacy, while Yungaicela-Naula et al. (2024) show that AI/ML in RIC environments can both improve operations and intensify misconfiguration risk, especially where near-real-time RAN applications and non-real-time RAN applications (rApps) interact or policies conflict.

Official documents reinforce this conclusion. The NTIA Open RAN Security Report observes that Open RAN introduces additional security dynamics operators must manage, and that, lacking a standard way of sourcing and deploying Open RAN, mobile network operators (MNOs) must define and enforce security roles throughout the lifecycle (NTIA, 2023). Japan’s MIC reached a parallel conclusion in the Quad Open RAN Security Report (MIC, 2023).

Industry standards bodies are moving in the same direction. The O-RAN Alliance Security Work Group (WG11) 2025 update reports published security requirements, tests, threat modelling, progress towards zero-trust maturity, and a security-assurance programme based on O-RAN Security Assurance Specifications (SCAS) aligned with the GSMA NESAS framework, and identifies 6G priorities including AI security, continuous monitoring, and post-quantum cryptography (O-RAN Alliance, 2025). The 2024 zero-trust white paper aligns with NIST SP 800-207, the CISA Zero Trust Maturity Model, and US mobile-industry guidance (O-RAN Alliance, 2024). This zero-trust maturation between 2024 and 2025 bears directly on two TRACE functions: WG11’s security-assurance and conformance artefacts inform the pre-deployment evidence required at Assure, while its runtime zero-trust constraints and continuous-monitoring direction inform the enforcement and override regime at Control. These strengthen security and interface controls without resolving the ethical questions of explainability, retraining and model provenance in automated operations.

At the global standards level, ITU Telecommunication Standardization Sector (ITU-T) Recommendation Y.3172 provides one of the earliest formal architectures for ML in future networks, including an ML pipeline and ML management and orchestration functions (ITU-T, 2019). This early architecture remains a reference point for AI-driven network management, and is complemented by ETSI’s zero-touch network and service management (ZSM) work, whose reference architecture targets closed-loop, largely autonomous management and orchestration across multi-vendor domains (ETSI GS ZSM 002, 2019); together they show that closed-loop automation has had standardised architectural form for several years, sharpening rather than softening the governance question. ITU-R Recommendation M.2160 projects this logic into IMT-2030 by envisioning an AI-native air interface with sensing integration, distributed ML and AI-compute orchestration (ITU-R, 2023). This confirms that AI is not a peripheral enhancement to future networks but part of the base architecture, making the governance question more urgent.

The policy layer is also thickening. GCOT’s 2025 principles on AI in telecommunications call for transparency, explainability, human oversight, redress, privacy, fairness, and security-by-design (GCOT, 2025), and its 2026 6G principles treat 6G as critical national infrastructure, demanding resilience-by-design, safe failover, resilient AI, telecom-AI incident sharing and multi-vendor Open RAN support (GCOT, 2026). Japan’s 2026 AI Guidelines for Business retain a soft-law, risk-based lifecycle approach (METI, 2026), and Singapore’s IMDA frameworks emphasise accountability and human responsibility (IMDA, 2026).

Convergence does not equal closure. BEREC has warned that telecom regulators may need roles in AI Act implementation, competition oversight, explainability and user rights as AI becomes embedded in electronic communications networks and services (ECN/S) (BEREC, 2023). Industry white papers from major vendors describe AI-native, intent-based or zero-touch network futures (Ericsson, 2025; Roeland et al., 2026), but those documents are strongest on capability architecture and weakest on public-interest guardrails. The standards stack is advancing towards autonomous networks faster than the governance stack is advancing towards auditable, telecom-specific assurance. The ethical risk is that capability outruns accountability.

This study used a structured documentary review combined with cross-jurisdictional ethical and regulatory gap-mapping. Document analysis is an established qualitative method for systematically examining institutional, regulatory and technical texts to derive themes and evidence (Bowen, 2009), and suits a field governed primarily by standards, legal instruments and official guidance. The design adopts transparent reporting principles – explicit search logic, stated inclusion and exclusion criteria, source categorisation, and reproducible synthesis – but is a structured documentary review rather than a fully audited database systematic review, because the corpus mixes legal instruments, official standards, white papers, government advisories and academic literature.

The source base combined four categories. The first was official standards and government or regulatory documents: the NIST AI RMF, CSF and adversarial-ML guidance, NTIA 6G and Open RAN reports, the CISA JCDC AI playbook, ITU-R M.2160, ITU-T Y.3172, 3GPP TS 33.501 and TR 33.877, the ENISA 5G Security Controls Matrix, the EU AI Act and GCOT documents. The second was peer-reviewed literature, especially studies of Open RAN security, O-RAN misconfiguration, and machine-learning assurance. The third was industry and standards-adjacent white papers from the O-RAN Alliance and Ericsson, used cautiously as supplementary. The fourth was regional-regulator material, including BEREC, METI, IMDA and MIC. All cited sources appear in the reference list; documentary sources were reviewed up to 10 May 2026. The five jurisdictions were selected to span contrasting governance models rather than for exhaustiveness: the US represents a risk-based, agency-led approach; the European Union a binding, rights- and risk-based statutory regime; the UK, through the GCOT, a pro-innovation, sectoral approach; and Japan and Singapore soft-law, lifecycle-based models. A trans-jurisdictional standards-and-industry column captures the SDO layer that operates across all blocs.

Search logic combined the following concept clusters: trustworthy AI; AI governance and risk management; Open RAN security; O-RAN misconfiguration; 5G automation; 6G AI-native; RAN Intelligent Controller; xApps and rApps; zero trust; critical infrastructure; explainability; human oversight; algorithmic accountability.

Sources were included if they were official standards, regulations or government documents relevant to AI-enabled telecom infrastructure; peer-reviewed studies materially addressing Open RAN security, AI/ML assurance or autonomous network management; or industry documents adding architecture or assurance context unavailable elsewhere. English-language sources were prioritised. Sources were excluded if duplicative, purely promotional, unrelated to telecom infrastructure or too remote from the focus on ethical governance and cybersecurity. Particular weight was given to documents addressing at least one of five dimensions: lifecycle AI governance, telecom cybersecurity, Open RAN assurance, operational automation and autonomy and critical-infrastructure or public-interest implications.

The analysis proceeded in three steps: sources were coded into thematic clusters (trustworthy-AI principles, cybersecurity controls, Open RAN architecture and assurance, automation and autonomy, and regulatory obligations); risks were mapped into a taxonomy spanning technical, organisational, legal and systemic dimensions, attentive to ethical implications such as opacity, bias and accountability gaps; and a comparative gap map was constructed across jurisdictions and standards bodies to locate where governance coverage was comprehensive, partial or absent. Operational definitions of the four maturity levels, the cell-assignment decision rule and a per-cell justification appear in the Supplementary material A. The reviewed corpus comprised the 46 sources listed in the references – 25 official standards and government or regulatory documents, 13 peer-reviewed studies, 4 industry and standards-adjacent white papers, and 4 regional-regulator texts – retained after applying the inclusion and exclusion criteria stated above to the candidate sources identified through the issuing bodies’ repositories and the Scopus, IEEE Xplore and Google Scholar searches. Finally, the gap map is an analytical instrument, not formal legal advice; it characterises the relative maturity of governance coverage rather than assessing enforceability jurisdiction by jurisdiction.

The documentary record indicates a transitional governance phase. In governance terms, however, the sector has not produced a unified framework equivalent to the NIST AI RMF for general AI or ENISA for broad 5G controls. The ethical implication is that AI capability is being deployed into an accountability architecture still under construction.

Official actors already recognise AI-enabled telecom as a strategic governance domain whose ethical stakes – public safety, fair access, redress and democratic accountability – are commensurate with its technical complexity.

The literature also converges on a core institutional finding: Open RAN redistributes accountability. The NTIA Open RAN Security Report stresses that there is no standardised sourcing or integration model and that operators must define and enforce roles across the lifecycle, concluding that Open RAN can be as secure as traditional RAN if stakeholders adopt sound practices, while warning that AI/ML poisoning remains unresolved (NTIA, 2023).

Telecom AI governance is not only about preventing control-plane failure but about preserving user rights, accountability, dispute resolution and public trust – the conditions under which AI-mediated communications are ethically legitimate.

The taxonomy in Table 1 synthesises NIST AI RMF trustworthiness characteristics, the NIST adversarial ML taxonomy, the EU AI Act and peer-reviewed Open RAN literature.

The gap map in Figure 1 compares the governance landscape across jurisdictions and standards ecosystems. “Strong” denotes explicit, materially relevant coverage; “Partial” adjacent or general coverage; “Emerging” active but soft-law or developmental coverage; and “Gap” materially underdeveloped coverage for telecom AI operations.

The least mature domains across all blocs are post-deployment AI assurance, model provenance, explainability for operational decision loops and telecom-specific incident reporting. The standards ecosystem is ahead of regulation on runtime technical controls, while regulation is ahead on formal accountability and legal consequence; neither yet delivers a complete assurance chain for AI-native telecom infrastructure. That gap is precisely where ethical harms accumulate – unaccounted for, unaudited, and unredressed. It also bears on how the principles are weighted: in critical-infrastructure settings, safety, security and resilience typically carry higher regulatory priority than fairness, because failures in the control plane translate directly into service-continuity and public-safety consequences. The gap map and taxonomy therefore treat the trustworthy-AI principles as differentially weighted in this sector rather than of equal force, while still requiring that fairness and other principles be addressed.

The documentary synthesis supports a five-part governance model applicable by regulators and operators without waiting for a single universal telecom AI law. Figure 2 illustrates it as a closed-loop assurance cycle, organised around five sequential and recursive functions. The framework’s contribution is not another principle list but an organising device: it arranges dispersed and overlapping obligations into five lifecycle control points – risk classification, inventory and provenance, pre-deployment assurance, runtime constraint and post-deployment reauthorisation – that existing instruments address only in dispersed or non-telecom-specific form, as Table 2 sets out.

Tier. Use cases are classified by consequence, autonomy and external dependency: traffic steering in a low-consequence enterprise slice should not be governed like emergency-service prioritisation, autonomous failover, or infrastructure safety functions, following the contextual trustworthiness logic of NIST AI RMF and the risk-based EU AI Act (NIST, 2023; European Union, 2024); emerging explainability standards such as IEEE 2894 provide an architectural reference for the explanation surfaces this requires (IEEE, 2024). Because near-real-time control loops operate under sub-millisecond to low-tens-of-milliseconds budgets, explanation here cannot rely on heavyweight post-hoc methods; it calls for lightweight, telecom-appropriate explainability whose computational cost is compatible with operational latency, with fuller explanation reserved for non-real-time and offline review.

Register. Operators maintain a live inventory of models, training inputs, interfaces, certificates, xApps and rApps, suppliers and fallback modes – addressing the visibility and role-allocation problems identified by NTIA and O-RAN WG11 (NTIA, 2023; O-RAN Alliance, 2025).

Assure. Pre-deployment evidence is required: security test results, interoperability validation, robustness testing, SBOM and CBOM records, model cards, bias testing where applicable and operator sign-off for risk thresholds – resonating with ENISA’s matrix logic, O-RAN SCAS aligned with GSMA NESAS and NTIA testbed findings (ENISA, 2023; NTIA and ITS, 2025; O-RAN Alliance, 2025).

Control. Runtime governance embeds human oversight, explanation surfaces, policy arbitration, zero-trust constraints and emergency override. GCOT principles call for failover and kill-switch scenarios (GCOT, 2025), and the EU AI Act requires human oversight commensurate with risk (European Union, 2024).

Evaluate. Once-and-done certification yields to continuous assurance: drift detection, incident reporting, post-change revalidation and periodic reauthorisation – the least mature area today and the most important for AI-native networks (O-RAN Alliance, 2025).

Telecom AI assurance is best treated as a socio-technical control regime, not a stack of isolated technical safeguards. Engineering standards alone cannot resolve who may authorise retraining, how conflicting model outputs are adjudicated, when self-healing should yield to human intervention, or how operators demonstrate compliance in multi-vendor environments; horizontal AI laws alone cannot specify the latency, interoperability, resilience and safety requirements of carrier-grade systems. What is needed is an organising layer – governance technically literate enough for telecom and ethically robust enough to discharge the duties expected of critical infrastructure (GCOT, 2026; NIST, 2023; BEREC, 2023; GCOT, 2025). The framework foregrounds, at telecom-specific decision points, four ethical commitments that existing instruments articulate but rarely tie to network-control operations: that AI-mediated outcomes affecting users are explainable to them; that authority over autonomous behaviour is locatable in identifiable actors; that high-consequence decisions remain reversible by human action; and that harms from AI-enabled control loops are remediable through accessible redress. Because telecommunications is infrastructure for other infrastructures, these commitments carry beyond the network itself: automated transport systems, energy-grid synchronisation and other smart-city services increasingly depend on AI-governed telecom control, so a governance failure in the control plane can propagate into the physical systems that rely on it.

For regulators, existing AI and cyber instruments should be profiled rather than replaced, as the forthcoming NIST critical-infrastructure AI profile suggests (NIST, 2026).

For operators, the decisive issue is accountability architecture. Open RAN and AI-native operations do not remove accountability from operators; they intensify it. Boards should treat AI-enabled RAN and orchestration as enterprise-risk subjects, not R&D pilots.

For standards bodies, the next frontier is not more interface detail but operational assurance: model provenance, auditable explanation records, policy-conflict handling, retraining authority, assurance levels for autonomous actions and machine-speed incident sharing.

Table 2 maps each TRACE-5G/6G function to its closest coverage in existing instruments – the NIST AI Risk Management Framework, the EU AI Act’s high-risk duties, and O-RAN and ETSI assurance work – and identifies what each function consolidates into a telecom-specific, operational form rather than what it invents.

Two lines of work would materially advance the agenda, combining ethical urgency with empirical tractability. Telecom-AI explainability research should establish what level and form of explanation are required for safe operator and user understanding of automated network decisions. 6G-readiness profiling should establish which TRACE-5G/6G obligations ought to harden into binding requirements before 6G deployment.

The following directions for future operationalisation focus on the near term; they are hypothetical and require pilot validation rather than being prescriptive, and each step should be calibrated to jurisdiction-specific capacity and the sequencing of binding rules. This near-term horizon (roughly 0–12 months) lays foundations: use-case tiering, an inventory baseline, a drafted telecom-AI governance profile, assurance-evidence scoping, pilot provenance controls, initial runtime-monitoring metrics and incident-reporting templates.

This article privileges authoritative, high-confidence documents, but five limitations remain. First, it is a documentary analysis without primary field data or operator interviews. Second, several industry sources used for architectural context are vendor white papers rather than peer-reviewed or official texts, and are treated as supplementary. Third, the pace of change in 6G, agentic AI and telecom automation means some recommendations – especially on runtime assurance and resilient AI – will require iterative refinement as standards mature; emerging profiles for generative and agentic systems, such as the NIST generative-AI profile (NIST, 2024b), indicate the direction this refinement is likely to take. Fourth, the review does not report the duplicate-removal and screening counts standard in a fully audited bibliometric review. Fifth, the gap-map coding was performed by a single coder without inter-coder reliability testing, so the ratings should be read as a transparent analytical judgement rather than a consensus-coded classification.

The hardest ethical question in AI-enabled 5G/6G is not whether AI should be used in telecom networks, but how to ensure AI-enabled control remains explainable, auditable, resilient, fair and bounded by accountable human and institutional authority. Standards bodies have advanced cyber baselines, interface security and architectural clarity; policy-makers have advanced AI risk management, human oversight and critical-infrastructure framing. What is less developed is a consolidated, telecom-specific way to convert trustworthy AI commitments into verifiable institutional behaviour. The gaps the analysis isolates map directly onto the framework’s functions: the absence of telecom-specific post-deployment assurance and incident reporting is the work of Evaluate; reliance on general-purpose AI rules without telecom operational depth is what Tier and Assure are meant to localise; and the developmental state of post-quantum-cryptography readiness for 6G control paths is a forward obligation that Register and Evaluate must carry as standards mature.

TRACE-5G/6G is offered as such an organising layer, not as a replacement for NIST, ENISA, 3GPP, O-RAN or statutory regulation, and as a heuristic for future empirical or multi-coder validation rather than a settled solution. It maps available governance principles to telecom-specific decision points: which systems deserve higher oversight, what must be inventoried, what counts as adequate assurance, how runtime autonomy is constrained, and when reauthorisation is required. Whether such a framework supports improvements in cybersecurity, ethical accountability, procurement quality, regulatory coherence and public trust is a question for future empirical work to test, not a property demonstrated here. A central tension runs through any such regime: the transparency, auditability and reporting that accountability demands can compete with the ultra-low-latency, real-time behaviour carrier networks require, so the governance challenge is not to maximise oversight in the abstract but to design assurance that discharges accountability without compromising network performance – favouring lightweight runtime explanation and continuous monitoring at machine speed, with heavier evidence-generation shifted to non-real-time and offline review. On that basis, the near-term priorities are concrete: standards bodies should converge ITU-T, ETSI ZSM, O-RAN and 3GPP work towards auditable runtime assurance and machine-speed incident sharing; industry should treat model provenance, signed releases and lightweight explanation as procurement-grade requirements for xApps and rApps; and regulators should profile existing AI and cyber instruments into a single telecom-AI supervisory map rather than legislate anew, hardening selected obligations into binding form ahead of 6G.

Trustworthy AI governance for telecom therefore belongs within both AI ethics and critical-infrastructure policy. Future networks will not only carry traffic but allocate resources, prioritise services and interact with physical infrastructure in real time, and the ethical governance of those functions must be as mature as the engineering that enables them.

Sushanta Paul is based at National Board of Revenue (NBR), Government of Bangladesh, Dhaka, Bangladesh.

The author is employed by the National Board of Revenue (NBR), Government of Bangladesh. This research was conducted in a personal capacity, and the views expressed are the author’s own and do not represent the official position of the NBR.

No funding was received for conducting this study.

Not applicable. This study is a structured documentary review of public sources and did not involve human or animal subjects.

No new datasets were generated or analysed during the current study. All sources used in the documentary review are publicly available official documents, peer-reviewed publications or open industry white papers, accessible through the URLs and DOIs listed in the reference list.

Not applicable. No code was generated during the current study.

Not applicable. No human participants were involved and no identifiable individual data are reported.

During the preparation of this manuscript, the author used Claude Opus 4.7 (Anthropic) and ChatGPT (OpenAI, GPT-5.5) only for language editing, copy-editing, formatting-consistency checks and non-substantive structural review of the author’s own pre-existing draft text. These tools were not used to generate new scholarly content, data, sources, citations, analysis, findings or the TRACE-5G/6G framework. The author reviewed and verified all edited text, checked all sources and citations, and takes full responsibility for the integrity, originality and validity of the manuscript. No AI tool is listed as an author.

Sushanta Paul: Conceptualisation, methodology, investigation, formal analysis, framework design, writing – original draft, writing – review and editing, and visualisation. The author read and approved the final manuscript.

The supplementary material for the article can be found online.