Hikvision & Dahua Cameras in 2026: Keep, Add AI or Replace? (Factory Decision Guide, India)

By the Mama Editorial Team — we scope camera projects for Indian factories. Last verified: 29 September 2026, against the BIS CRS "Guidelines for implementation of Essential Requirement(s) for Security of CCTV" (crsbis.in), the MeitY Office Memorandum of 16 January 2026 as reported by trade press, the STQC IoT System Certification Scheme page, the US NVD/CISA Known Exploited Vulnerabilities records, and the ONVIF profile specifications.

For most factories the answer is: keep the Hikvision and Dahua cameras that work, lock them down, and put AI on top of them — replace a camera only when it dies, when you expand, or when a buyer or tender demands certified hardware. India's 2026 rule governs what can be sold, not what you already run. The real decision is camera by camera, and it is mostly about maintenance and security, not legality.

This is general information for plant owners, not legal advice. Confirm current rules on the official BIS and STQC portals, and take formal advice before a regulated tender or a large procurement.

You have dozens of cameras on the floor, bought when Hikvision and Dahua were the default. Before you sign your integrator's new quote, sort them into four piles.

The decision tree: one camera at a time

Run each camera (or group of identical cameras) through five steps; stop at the first answer.

Step	Question	If YES	If NO
1	Does the camera still work reliably? (clear image day and night, records without gaps, no repeated reboots)	Go to step 2	Replace this camera — with a certified model
2	Are you adding cameras or re-cabling this zone in the next 12 months?	The new cameras must be certified; mark this zone Replace at expansion and continue to step 3 for the existing ones	Go to step 3
3	Does a customer audit, OEM supplier requirement or public tender you care about ask for certified (ER/STQC) cameras at this site?	Replace this camera — or the cameras in the scope the buyer defines	Go to step 4
4	Can you secure it? (password changed, not exposed to the internet, on a separate network, firmware you can identify)	Go to step 5	Fix it this week; if you cannot, Replace this camera
5	Can it deliver a clean video stream over RTSP or ONVIF?	Keep + add AI	Keep (as a recorder of evidence) — and plan it into the next replacement cycle

Four outcomes, in plain words:

Keep. It works, it is secured, nobody asks for certified hardware. It records; it cannot usefully feed analysis.
Keep + add AI. Same as above, and it can hand a video stream to software. This is where most working cameras in a mid-size plant end up.
Replace this camera. It is failing, it cannot be secured, or a buyer's rule covers it. Replace with a certified model, not a like-for-like.
Replace at expansion. Nothing is wrong today, but when this zone gets new cameras or new cabling, the old units go at the same time — so you do not run two generations side by side in one area.

What the 2026 rule requires — and what it does not

What it requires. CCTV cameras fall under MeitY's Electronics and IT Goods (Requirements for Compulsory Registration) Order, 2021, registered with BIS against IS 13252 (Part 1):2010. MeitY added "Essential Requirement(s) for Security of CCTV" by gazette notification dated 9 April 2024, and BIS's implementation guidelines require a separate security test report (ER: 01) for each lead model (BIS CRS guidelines). MeitY's Office Memorandum of 16 January 2026 withdrew the last sell-through relaxation: from 1 April 2026, no CCTV camera that does not conform to the ERs may be sold.

What it does not require. Nothing in the order or the BIS guidelines asks an end user to remove installed cameras; the obligation sits on those who manufacture, import and sell. The rule reaches you the next time you buy — a replacement, an expansion, a new site.

Where it reaches you indirectly. Public procurement is stricter: a MeitY circular linked ER test reports to the Public Procurement (Make in India) framework, and the Railway Board circulated it to zonal railways in February 2026 (secondary report). If you supply PSUs or railways, or an OEM's audit checklist copies that language, the requirement arrives through your buyer.

What about Hikvision and Dahua specifically? No Hikvision- or Dahua-branded camera models appear on the certified lists compiled by trade sources as of late August 2026 (one compilation dated 23 August 2026). Prama — an Indian company that holds its own certified models, sold under the Prama name — is a separate case: its certificates cover Prama-branded models and say nothing about the Hikvision-branded cameras on your wall. Note that the STQC page itself now says its network-camera list "is no longer being updated and is retained solely for historical reference" (STQC IoTSCS), so check a specific model on the BIS registry at crsbis.in before you buy — certification is per model, and a brand name on a quotation proves nothing.

Your NVR or DVR is a separate question with its own answer; we cover it in do NVRs and DVRs need STQC/BIS certification in India? — this guide makes no claim about recorders.

For the wider "do I have to replace anything at all" question, see do I have to replace my factory CCTV in 2026?. For what to buy when you do replace, see Hikvision and Dahua alternatives for Indian factories and the STQC/BIS-approved camera list, explained.

The real risks of an older estate

Legality is not the problem. These are.

1. Support and spares may thin out. When a brand cannot sell new cameras in a market, spares and dealer support tend to shrink. Trade commentary in India expects firmware updates to slow and support to become harder to obtain — that is a secondary, forward-looking view, not an announced policy. Plan as if the identical replacement you assumed you could buy in two years may not exist through your usual dealer.

2. Firmware you cannot patch is a standing risk. Network cameras of every brand have had serious vulnerabilities. Two examples from the public record: a command-injection flaw in the web server of some Hikvision products (CVE-2021-36260) and an authentication bypass in some Dahua products (CVE-2021-33044) are both in the US CISA Known Exploited Vulnerabilities catalogue — meaning attackers have used them in the wild (NVD: CVE-2021-36260; NVD: CVE-2021-33044). If you cannot confirm your firmware is patched, treat the camera as unpatched and isolate it.

3. Footage is personal data. Under DPDP, a leaked worker recording is a bigger exposure than an old camera.

The one-week lock-down checklist

Change every default and shared password — on cameras, recorder and any viewing app. One password per device, stored with the plant head, not the installer.
Close internet exposure. No port-forwarding from the router to cameras or the recorder. Turn off UPnP and "cloud P2P" features you do not use. Remote viewing, if needed, goes through a VPN.
Put cameras on their own network — a separate VLAN or physical switch, not the office Wi-Fi or the production PLC network.
Inventory model and firmware for every camera — you need it for patching, step 5 and buyer audits.
Update firmware only from a trusted source — the manufacturer's official channel via your integrator — and never from files passed around on WhatsApp.
Remove logins of ex-employees and ex-vendors.

A fuller audit is in our unsecured camera feeds checklist.

Can AI run on your camera? Five questions

You do not need new cameras to analyse video. You need a camera that can hand a stream to software without disturbing recording. Ask your integrator, or check yourself:

Is it an IP camera, or analogue (HD-CVI/TVI/AHD) into a DVR? IP cameras can usually stream directly. Analogue cameras stream only through the DVR, if it supports RTSP — that is a recorder question.
Does it offer RTSP? Most Hikvision and Dahua IP cameras do. Test it: open the stream address in a free player such as VLC on a laptop on the same network. If you see video, software can too.
Is it ONVIF-conformant (Profile S)? Profile S covers video streaming and configuration for IP cameras — it makes connection from third-party software predictable.
Does it have a second stream (sub-stream)? Most IP cameras send a main stream for recording and a lighter sub-stream. AI can use one without degrading recording.
Does the view show the work? A camera pointed at a gate cannot tell you why press 4 stood idle. Resolution, angle, light and obstructions decide what software can read. Sometimes the right answer is "keep this camera, and move it."

Five "yes" answers: Keep + add AI. A "no" on 2 or 3 with a DVR in the way: talk to your integrator about the recorder. A "no" on 5: re-aim before you replace. More detail in can you run AI analytics on your existing CCTV?.

Replace in phases, not in a panic

A panic swap buys mismatched firmware, PoE surprises and a thin choice of certified models. A phased plan reaches the same end state calmly:

Now: lock down everything (checklist above). Build the inventory: location, model, firmware, working/failing, RTSP yes/no.
When a camera fails: replace it with a certified model chosen for that position — not a like-for-like. Check the exact model number on the BIS registry before payment.
When a zone expands or gets re-cabled: replace that zone's old cameras at the same time, so one area runs one generation.
When a buyer or tender asks: replace the scope they define, and get their requirement in writing so you do not over-replace.

The rule of thumb: replace cameras for a reason you can name — failure, expansion, a buyer's requirement, an unfixable security gap. "The brand" alone is not a reason.

Where Mama fits

Mama is AI on the video from your shop-floor cameras — the ones you already own, or ones our team installs. It connects to existing cameras over RTSP/ONVIF, without replacing them, and every morning sends the owner one WhatsApp message: where machines stood idle, the likely reasons, and what it cost in ₹. For the "Keep + add AI" pile, that is the point: the cameras you already paid for start telling you something.

FAQ

Is it illegal to keep using Hikvision or Dahua cameras in my factory after April 2026? No. The 2026 requirement governs the sale of cameras that do not meet the Essential Requirements. Nothing requires you to remove working installed cameras.

Can I buy more Hikvision-branded cameras to match my existing ones? Only ER-certified models may be sold from 1 April 2026, and trade compilations show no Hikvision-branded models certified as of late August 2026. Verify any model number on the BIS registry.

Is a Prama camera the same as a Hikvision camera for compliance? No. Certification is per model. Prama holds certificates for its own Prama-branded models; that does not certify Hikvision-branded models, and it does not change the status of cameras you already own.

Can AI work on my existing Hikvision or Dahua cameras? Usually, if they are IP cameras that offer RTSP or ONVIF streams and the view actually shows the work. Test with a free video player on the same network before paying anyone.

Do I need to replace my NVR or DVR too? That is a separate question — see do NVRs and DVRs need STQC/BIS certification in India?

Want the tree run on your floor?

Send us a video of your floor — a slow walk-through on a phone is enough. We will mark which cameras to keep, which ones to connect AI to, and where replacement actually makes sense.

Sources

BIS CRS, Guidelines for implementation of "Essential Requirement(s) for Security of CCTV", 22 October 2024 — crsbis.in (primary)
MeitY Office Memorandum, 16 January 2026, withdrawal of sell-through relaxation from 1 April 2026 — as reported by Security Update (secondary report of a primary document)
STQC, IoT System Certification Scheme — certified product list and archive notice — stqc.gov.in (primary)
BIS Compulsory Registration registry — crsbis.in (primary; check model numbers here)
Certified-model compilation by brand, dated 23 August 2026 — FGtech (secondary)
Railway Board circular on CCTV testing under the Public Procurement Order — StaffNews (secondary)
Trade commentary on firmware and support outlook — CCTV Helpdesk (secondary, opinion)
US NVD / CISA KEV — CVE-2021-36260, CVE-2021-33044 (primary)
ONVIF, Profile S (primary)