Orange España strengthens its alliance with Google Cloud to scale its AI operations

In a telecommunications operator, there is no single “AI license.” Implementing large-scale artificial intelligence solutions requires fitting together several regulatory frameworks simultaneously: data protection and privacy, sector-specific telecommunications regulations, cybersecurity and essential services, and the new European AI Regulation, in addition to consumer and customer service rules. Practically, this translates into a series of assessments, registrations, documentation, and notifications, plus a robust internal governance system.

1. Inventory and classification of AI systems

The first real “procedure” is organizational but has legal consequences:

• Inventory all AI systems (own and third-party), use cases, data processed (customers, network, location, employees), purposes, and territories.
• Classify them according to the European AI Act: minimal risk, transparency obligations, high risk, or, if applicable, prohibited activities.
• Identify whether the operator acts as an AI system provider (develops/trains it) or as a deploying entity (uses it on its customer base or network), because obligations differ.

2. Data protection and privacy in communications

For any system processing personal data (almost all in a telecom), key steps are:

• Legal basis and purpose: define for each processing (network optimization, commercial segmentation, fraud risk scoring, etc.) the GDPR basis (contract execution, legitimate interest, consent, legal obligation) and document it.
• Traffic and location data: the General Telecommunications Law and privacy rules in electronic communications impose additional limits. Using location data for analytics or marketing usually requires enhanced consent and strict anonymization if aggregated.
• Impact assessment (DPIA): large-scale customer profiling, automated decisions with legal effects, or intensive use of biometrics and geolocation are typical cases requiring a formal DPIA. If, despite planned measures, a high risk remains, a prior consultation with the Spanish Data Protection Agency (AEPD) must be considered.
• Transparency and rights: update privacy clauses, clearly explain AI use, provide channels to exercise rights (access, objection, restriction), and, when applicable, guarantee human intervention and the possibility to challenge automated decisions.
• Contracts and transfers: review agreements with model/cloud providers (data processors), regulate subprocessors, data location, and international transfers.

3. Compliance with the European AI Regulation

For systems classified as high risk (e.g., AI used in selection processes, customer creditworthiness evaluation, certain critical network uses), additional procedures include:

• Documented risk management system, with identification, mitigation, and continuous risk review.
• Data governance: requirements for quality, relevance, and absence of unjustified biases in training datasets.
• Technical documentation and records: the system’s “technical file” and automatic operation logs enabling traceability and audit.
• Human oversight: define who, how, and with what powers can intervene or deactivate the system.
• Conformity assessment and, if applicable, European registration before market placement or service start when the operator acts as provider.
• Notification of serious incidents to the competent authority designated in Spain when high-risk systems cause or may cause significant harm.

Additionally, general transparency rules require the telecom to inform when a user interacts with a chatbot, label content generated or manipulated by AI (e.g., commercial communications or automated support), and technically mark such content to be detectable as synthetic.

4. Cybersecurity and essential services

Many operators are or will be within the scope of the NIS2 Directive and its Spanish transposition, as well as specific 5G network regulations:

• Designation as essential or important operator and compliance with reinforced risk management obligations.
• Security policy and information security officer, with a statement of applicability of technical and organizational measures.
• Notification of significant security incidents through the national cyber incident platform, coordinating with reference CSIRTs.
• Consistency between these schemes and safeguards required by the AI Regulation (robustness, resilience, service continuity).

5. Sectoral and consumer regulations

Moreover, AI in a telecom must comply with:

• The General Telecommunications Law, which sets obligations on network integrity, service quality, and communication secrecy, relevant if network management or traffic routing is automated with AI.
• Consumer and customer service rules, requiring transparency in personalized pricing and targeted advertising, and limiting telephone service based exclusively on automated systems: customers must be able to demand human assistance.
• The digital services framework (DSA) and competition rules (CNMC, DMA) when the operator acts as a platform or integrates AI assistants in mass services.

6. Internal governance and relationship with authorities

Finally, although not formal “permits,” today they are considered practically mandatory:

• Approve a corporate AI policy and a governance model (AI committee, compliance roles, use case review channel).
• Maintain a register of AI systems with their risk assessments, DPIAs, classification decisions, and applied controls.
• Use, when relevant, the guidelines and sandboxes enabled by the Spanish AI Supervisory Agency for high-risk systems, which help anticipate authorities’ criteria.

Overall, large-scale deployment does not involve a single procedure but demonstrating—with documentation, assessments, and living processes—that AI is integrated into the telecom with full guarantees of privacy, network security, user rights, and effective oversight.

Several European telecommunications operators have launched artificial intelligence (AI) initiatives in recent years in direct collaboration with Google Cloud, usually supported by its data platform, Vertex AI, and the Gemini models. Below is a synthetic map of the most relevant publicly announced cases in Europe, grouped by operator and type of use (network automation, customer service, data analysis, and advanced services over 5G).

Operators with AI projects on the network

• Deutsche Telekom (Germany / Europe). According to Google Cloud documentation and industry press, Deutsche Telekom has worked with Google on developing “RAN Guardian”, an AI agent based on Gemini 2.0 and deployed on Vertex AI.
  • Main function: analyze the behavior of the radio access network (RAN), detect anomalies, and propose or execute corrective actions.
  • Goal: improve network reliability, reduce diagnosis times, and minimize manual interventions in complex network operations.
• Telefónica Deutschland (O2 Germany). Telefónica’s German subsidiary appears in Google Cloud’s AI-related network use cases:
  • Project: migration and operation in the cloud of a RAN orchestration platform (from Cellwize) on Google Cloud.
  • Focus: automate mobile network planning and management tasks using AI capabilities and advanced analytics, in a “cloud-native” scheme.
• Vodafone (pan-European group). Beyond the major 2024 strategic agreement focused on generative AI and Gemini for its digital services, Google materials and specialized press identify:
  • Network Performance Platform, developed together with Cardinality and Google Cloud.
  • Main use: intelligent analytics of network performance and infrastructure modernization, with aggregated data from European operations.
  • Desired outcome: operate a more dynamic, efficient network prepared for new 5G services and big data.
• Vodafone Italy. Listed as a specific data modernization case:
  • Project: Nucleus data platform, co-developed with Google Cloud.
  • Orientation: build a data and analytics foundation prepared for AI, supporting automation, service personalization, and operational improvements.
• DNA (Telenor’s subsidiary in Finland). Google Cloud cites DNA as an example of an operator progressively migrating workloads to its cloud:
  • Purpose: facilitate future adoption of generative AI applications, improve data analysis, and enable new network services.
  • Focus: cloud modernization as a prerequisite for automation and AI use cases in telecommunications.

Operators focused on customer service and front-office

• Bouygues Telecom (France). One of the most visible examples of generative AI oriented to sales:
  • Project: launch of a mobile sales assistant based on Google Cloud generative AI technologies.
  • Technology: use of Gemini, Agent Builder, and Dialogflow, according to published cases.
  • Application: support for the commercial process and customer interaction, with a conversational assistant that personalizes recommendations and streamlines operations.

“Group” approaches and cross-cutting transformation

• Liberty Global (Virgin Media O2, VodafoneZiggo, Telenet, Sunrise, etc.). Various sources report a five-year strategic agreement between Liberty Global and Google Cloud:
  • Areas: use of Gemini and other Google Cloud tools in customer service, TV platform (Horizon TV), data analytics, security, and operational efficiency.
  • Vision: advance towards more autonomous network operations and more personalized customer experiences in several European markets simultaneously.

Comparative reading and common trends

Taken together, these cases show a clear pattern in collaboration between European operators and Google Cloud:

• Network automation: Deutsche Telekom, Telefónica Deutschland, Vodafone, and Liberty Global use AI (Gemini, Vertex AI) to monitor, optimize, and progressively automate RAN and core networks.
• Data platforms for AI: Vodafone Italy and DNA focus efforts on building “lakes” and cloud architectures that facilitate massive data exploitation with AI.
• Customer experience and front-office: Bouygues Telecom (and more broadly Liberty Global) explore sales and service assistants based on generative AI.
• 5G and future 6G orientation: almost all projects are conceived as steps towards advanced 5G networks and, mid-term, infrastructures designed with AI integrated from the start.

If you are interested, in a subsequent response I can detail the regulatory and competition implications this concentration of AI projects on a single cloud provider like Google Cloud may have in Europe.