Why this paper matters now?

By Jabulani Chibaya

HARARE – FOR a hundred years, telcos sold access. Voice, then SMS, then data. The network was the product, and the customer was a number on a bill.

The GSMA’s June 2025 white paper, Agentic AI for Telecom: Charting the Course for an Intelligent Future, argues that this model is ending. Led by operators including China Mobile, KT, LG U+, TIM and KPN, with NTT DOCOMO, Turkcell and China Unicom among the contributors, it says agentic AI will move operators from pipe providers to “AI-driven value architects”.

The paper is less a forecast than a call to build shared standards before the hyperscalers write the rules alone.

Is that a threat or an opening? For African operators, it is both. This article reads the paper, draws out what it means, and tests it against the realities of Sub-Saharan Africa, including the cyber risks the paper only begins to name.

What the paper actually says

The core claim is simple. Generative AI creates content. Agentic AI pursues goals: it breaks a task into steps, calls tools, checks the result and adapts. The authors describe a shift from AI as a tool to AI as a collaborative partner.

For operators, the paper sets out three strategic tiers:

1. Tool-oriented (conservative): expose existing network capabilities as APIs that other people’s agents can call.
2. Service-oriented (proactive): rebuild core services around large language models, such as proactive customer care, dynamic SLA management and personalised connectivity.
3. Ecosystem-oriented (radical): own the customer’s primary assistant and become the gateway through which third-party agents reach them.

The use cases make this concrete. An enhanced IMS routes live calls to translation, summarisation and emotion-analysis agents. A home agent runs on a cloud phone or home compute host and uses SIM-based authentication for payments. A “generative network” turns a request such as “I need a secure, low-latency network for a smart factory” into a configured deployment.

Underneath sits a reference stack: network and compute convergence, data, models and tooling, orchestration, multi-agent collaboration, and a marketplace on top. The paper calls the destination Telco Agentic AI Service, or TAaaS.

Two things stand out. First, the paper is candid about immaturity. Google’s A2A protocol lacks user confirmation and prompt-injection mitigation, Cisco’s AGNTCY lacks built-in identity authorisation, and MCP overlooks cross-domain security. Second, it flips the security model: treat the threat actor as internal to the workflow, not outside it.

What it means for telcos

The paper’s strategic logic rests on one idea: operators own things a cloud provider cannot copy. Edge sites at cell towers and aggregation nodes. Network slices with enforceable SLAs. Real-time network and location data. A SIM that already proves who the customer is. A billing relationship with millions of households.

That is a real position. It is not a guaranteed one. Three implications follow.

The tiers are a risk ladder, not a menu. Exposing APIs is cheap and low risk, but it makes the operator a supplier to other people’s agents. Owning the customer assistant captures the relationship, but it means competing with the consumer assistants that Google, Apple and others already ship. Most operators should run tiers one and two now and treat tier three as an option to earn.

Standards are the strategy. The paper’s call to action is a shared reference architecture with agreed protocols and capability exposure. An operator that builds a proprietary agent layer will meet the vendor lock-in the paper warns against. This is where GSMA Open Gateway, A2A, MCP and telecom-specific ideas such as MCP-T meet.

The operating model must change before the technology does. The authors call for modular technical stacks, federated governance and cross-disciplinary talent. In practice, network engineers, data scientists, security teams and compliance officers must work on one agent lifecycle, from design through monitoring.

A fair reading also asks who wrote it. The paper comes from operators with a stake in the outcome, and its trillion-dollar figure is attributed only to “some analysts”. Treat the destination as a hypothesis. Treat the direction as sound.

Where the innovation space is

The paper points to five places to build.

Trust APIs for other people’s agents. Tier one is not trivial. An agent about to move money needs to know whether the SIM was swapped an hour ago. Operators can sell that answer through standardised APIs, and every agent that calls it makes the operator part of the transaction.

Proactive care. Agents that watch network quality, device status and customer behaviour can fix a problem before the complaint arrives. That cuts cost and builds loyalty at once.Intent-based enterprise networks. The paper’s smart-factory example is the template. A mine, port or farm states what it needs, and the network designs, configures and deploys it. The customer no longer needs network design expertise to buy connectivity.

Household and personal agents. A SIM-authenticated assistant that handles shopping, travel and payments for a whole household turns connectivity into a daily relationship.

Telecom-specific models. General-purpose LLMs struggle with network troubleshooting and SLA management. The paper proposes domain models built on retrieval and knowledge-graph augmentation, tuned efficiently with methods such as LoRA and small enough for edge deployment. It urges operators to share domain data and know-how, and to accelerate GSMA’s Open Telco LLM benchmarks.

Beneath all five sits a monetisation question the paper leaves open. It floats MCP-T, a telecom extension of MCP with persistent sessions, as one answer. Operators who define the commercial terms early will set the market’s price.

What it means for Sub-Saharan Africa

The paper was written mostly by operators in Asia and Europe. Sub-Saharan Africa starts from a different base, and that changes the order of play.

Coverage is not usage. GSMA estimates that mobile technologies contributed $240 billion to Africa’s economy in 2025, yet almost one billion people, 63% of the population, still do not use mobile internet despite widespread coverage. It expects 5G to carry only 17% of Sub-Saharan mobile internet connections by 2030. The paper’s home compute hosts and AR-enabled IMS assume devices and data that most subscribers lack. Tier three is a premium play. Tiers one and two are the mass-market ones.

Mobile money is the native advantage. Sub-Saharan Africa carried about $1.4 trillion of the more than $2 trillion that moved through mobile money globally in 2025. Operators here already run financial platforms with agents, identity checks and transaction data. The paper’s SIM-based authentication and finance-agent scenarios are product roadmaps here, not futures. An agent that offers savings, credit or insurance over USSD, WhatsApp or voice is the African version of the digital life companion.

Language is the moat. GSMA calls the underrepresentation of African languages in mainstream AI a critical constraint. At MWC Kigali in October 2025, Airtel, MTN, Orange, Vodacom, Axian and Ethio Telecom announced a collaboration on African language models. A voice-first agent that works in Shona, Swahili or Hausa is something a global assistant cannot yet match.

The network side is moving. MTN joined a $45 million round for an AI-native RAN start-up built for power-constrained, multi-vendor African networks, and signed a March 2026 MoU with Huawei on agent-driven networks.

Scale is an asset. MTN reports 317.7 million customers across 19 markets, and Airtel Africa 183.5 million across 14. Shared agent platforms, data and security tooling across such footprints can fund what a single-market operator cannot. Smaller operators should partner early rather than wait for a perfect platform.

Regulation will set the pace. Zimbabwe’s National AI Strategy 2026–2030, launched in March 2026, is a strategy, not a statute. The binding rules sit in the Cyber and Data Protection Act, with POTRAZ as data protection authority and mandatory inspections announced from September 2026. Expect compliance, not guidance.

The practical path: start with trust APIs and proactive care, add local-language agents, and join pooled efforts rather than build alone.

The risks and the cyber security picture

The paper’s security stance is its most useful contribution: assume the threat is already inside the workflow. It names three failure modes. Boundary collapse is when tooling treats a model’s output as authoritative. Supply chain substitution is tampered dependencies, images or model weights. Privilege misconfiguration is service accounts so permissive that an agent can alter its own scheduler. In a telco, any of these can change provisioning, routing or billing.

Prompt injection and tool poisoning. An agent that reads customer messages, documents or tool descriptions can be instructed by them. As summarised by industry analysts, Cisco’s State of AI Security 2026 found that 83% of enterprises have deployed or plan agents, but only 29% feel prepared for the risks.

Identity is the crown jewel. SIM swap is estimated at around 43% of mobile money fraud in Africa, and up to 60% of mobile banking fraud in some markets is linked to it. INTERPOL reports that Kenyan SIM swap fraud rose 327% in 2025, with more than 123,000 fraudulent SIM cards. Now imagine a customer-care agent with permission to reissue a SIM, facing a persuasive caller. INTERPOL also finds AI involved in 55% of reported African cybercrime, with losses rising from $192 million to $484 million. Attackers are automating. Defenders must too.

Data and sovereignty. Home and companion agents learn habits, location and spending. That is personal data under Zimbabwe’s Cyber and Data Protection Act and its regional peers. GSMA’s mobile money report says 24% of providers find cross-border data transfer rules a barrier, which matters when models run on foreign clouds.

Regulatory drift. The paper expected EU AI Act human-oversight duties from August 2026. A provisional agreement in May 2026 moved standalone high-risk obligations to 2 December 2027. The date has moved. The direction has not, so build human override now.

Controls that matter. Deny by default every action an inference triggers. Scope agent privileges tool by tool. Require out-of-band approval for control-plane changes and SIM swaps. Sign artefacts and keep verbose prompt logs, so an incident can be reconstructed. Operators that buy agents from vendors should also demand signed model provenance and the right to audit.

Where to start

The paper asks operators to choose a position before one is chosen for them. For Sub-Saharan Africa, the answer is not to copy the operators who wrote it. It is to start where African telcos are strongest: identity, mobile money and local languages.

Three moves for the next twelve months:

1. Expose trust APIs, such as SIM swap and device swap checks, and wire them into agent workflows.
2. Pilot proactive care and network agents with human approval gates and full logging.
3. Join shared efforts on standards, African-language models and threat intelligence.

The pipe was never the prize. Trust was. In an agentic world, whoever can prove who is acting, and stop them when they should not, holds the position.

Sources

• GSMA, Agentic AI for Telecom: Charting the Course for an Intelligent Future (June 2025)
• GSMA, The Mobile Economy Africa
• Telecoms.com, Tackling sub-Saharan Africa’s mobile usage gap
• Connecting Africa, $1.4T flowed through mobile money in sub-Saharan Africa in 2025
• Guardian Nigeria, Mobile money doubles in four years
• Connecting Africa, AI’s impact on Africa’s mobile industry
• TelecomLead, Top 10 Mobile Operators in Africa 2026
• Technology Times, Huawei, MTN sign AI network partnership
• INTERPOL, AI linked to more than half of cybercrime in Africa (3 August 2026)
• Tech-ish, Kenyans lost KES 491.6 million to SIM swap fraud in 2025
• GSMA Open Gateway, COURE Statement of Requirement (August 2026)
• Gibson Dunn, EU AI Act Omnibus Agreement
• Business Times, Strategy without statute: Zimbabwe’s national AI strategy
• Techpoint Africa, POTRAZ to police data protection laws

Meta Intelligence, AI agent security in 2026 (summarising Cisco State of AI Security 2026)

Jabulani Simplisio Chibaya is a Data and AI Consultant specializing in data science, artificial intelligence, blockchain, and cryptocurrency innovation. A seasoned conference speaker, he also writes on the intersection of technology, regulation, and economic development. Contact: Cell: +263 778 921 881 | Email: simplisiochibaya22@gmail.com | LinkedIn: https://www.linkedin.com/in/jabulani-simplisio-chibaya