The AI Regulatory Readiness Index ARRI: Assessing Cross-Jurisdictional Legal Preparedness for AI in Telecommunications

TL;DR

This paper introduces the ARRI index to evaluate national legal preparedness for AI in telecommunications, revealing global gaps and proposing standards for improved governance across jurisdictions.

Contribution

It develops a reproducible, sector-agnostic index for assessing legal readiness for AI regulation, applied across ten jurisdictions with detailed analysis.

Findings

Global ARRI scores are generally low, with a mean of 34.

AI incident reporting and risk classification are major gaps.

ARRI scores differ from existing indices, highlighting unique legal readiness issues.

Abstract

As Artificial Intelligence becomes increasingly embedded in critical telecommunications infrastructure, existing legal frameworks remain ill-equipped to address the distinct risks this development introduces. This paper proposes the AI Regulatory Readiness Index (ARRI), a reproducible instrument for doctrinally assessing the legal preparedness of national frameworks to govern AI in critical digital infrastructure, and applies it across ten jurisdictions spanning five continents. ARRI comprises seven indicators across three dimensions: substantive AI-specific obligations, operational safeguards, and governance coordination, scored on a four-point ordinal scale and aggregated to a normalised 0-100 index. Legal instruments in force as of 28 February 2026 are assessed across telecommunications, cybersecurity, data protection, and AI governance domains. The study finds that global AI regulatory readiness in telecommunications remains concentrated in the lower range, with a mean ARRI score of 34 and a median of 26.5. AI incident reporting and risk classification emerge as the most acute and near-universal gaps, with binding legal definitions of AI-specific incidents largely absent across the legal frameworks applicable to telecommunications in the jurisdictions studied. ARRI scores diverge systematically from existing composite indices. For example, Indonesia achieves ITU Global Cybersecurity Index Tier 1 status yet scores 19 under ARRI, demonstrating that cybersecurity readiness and AI regulatory readiness are legally distinct conditions that existing frameworks conflate. The ten jurisdictions are classified into five regulatory archetypes, and a normative minimum standards framework is proposed, anchoring baseline AI governance readiness at an ARRI score of 67. ARRI is designed to be sector-portable and applicable beyond telecommunications to energy, healthcare, and transport infrastructure.