17 Questions to Ask a CCTV/AI Vendor Before You Sign (India)
Ask these before the purchase order. Four questions decide most Indian deals: the exact model's BIS R-number and STQC certificate — certification is granted per model, and only conforming cameras may be sold here since 1 April 2026 — who holds the admin password, where the footage physically sits, and the AMC price for years 2 and 3, written into this contract.
You run 200–1,000 workers in Ludhiana, Coimbatore, Pune, Rajkot or Hosur. An integrator has quoted you 32 cameras and an "AI dashboard". The quote is one page, the demo was someone else's warehouse, and the AMC line says "as applicable". This is the interrogation that turns that into a contract you can enforce.
Key points
- Certification is per model, not per brand. Under MeitY's Essential Requirements (ER) regime, a CCTV camera sold, imported or manufactured in India must carry BIS CRS registration and, for network cameras, ER/STQC security certification — the sell-through relaxation for non-ER stock was withdrawn with effect from 1 April 2026. Verify the R-number yourself, model by model, on crsbis.in (BIS CCTV implementation guidelines).
- Analogue is a different case. BIS's own circular on analogue cameras records MeitY's clarification that the security ER Order is not applicable to analogue CCTV cameras — they still sit under BIS registration for safety. If half your plant is coax into a DVR, your exposure is genuinely different, so make the vendor state which line items are network cameras.
- You are the data fiduciary, not your vendor. Under the DPDP Act 2023 the factory carries the duty and the penalty — up to ₹250 crore for failing to take reasonable security safeguards — while the integrator is at most a processor (DPDP Act text, MeitY). The substantive duties are enforced from 14 May 2027.
- Get the AMC number now. Year 1 is usually bundled; indicative Indian market practice is roughly ₹350–500 per camera per year plus a site minimum around ₹7,500. An unpriced renewal is where a ₹2 lakh system becomes a ₹2 lakh system with a hostage.
- Normalise every AI quote to rupees per camera per month. "₹2,399 per instance" beats "₹1,200 per camera" only until you learn an instance caps at four streams. Budget ₹1,000–₹2,500 per camera per month for a real analytics layer (indicative, July 2026).
- GST on CCTV is 18%, reduced from 28% in the September 2025 rate revision — make the quote say inclusive or exclusive, because on a ₹15 lakh project that is ₹2.7 lakh.
- A false-alarm rate you cannot audit is a system your guard will mute in week three. Ask for the number, in writing, measured on your floor.
Round 1: the four questions that end a bad meeting in ten minutes
1. "Give me the exact model number, its BIS CRS R-number, and its ER/STQC certificate — per line item." Not "4MP dome". The full SKU. ER compliance is granted at model level, so a brand-level "we are STQC approved" claim is a sales sheet, not proof.
2. "Which line items are network cameras, which are analogue, and what registration does the recorder carry?" The security ER layer is aimed at network-connected cameras and does not apply to analogue ones; buyers check cameras and forget the box that stores everything. Get the position for every line, in writing, rather than assuming one rule covers the quote.
3. "What is the country of origin, and does the certificate annexure list this exact model and firmware version?" Model numbers and firmware sit in the certificate annexure, not on its first page. Industry reporting describes certified Indian lines migrating to non-Chinese silicon, but treat that as market colour — the annexure match is the check that actually holds up.
4. "Is this current post-deadline stock, in writing?" The certified pool is small: expect thinner model choice and longer lead times than you are used to. If a quote is suspiciously close to last year's, ask what inventory it is drawn from. Full timeline in our BIS/STQC 2026 compliance guide.
Round 2: who owns the footage, and who holds the password
This is where Indian owners lose control quietly. Nothing here costs money to fix — it costs a clause.
5. "Who owns the recordings — in the contract, by name?" The answer must be: the factory, unconditionally, including after termination.
6. "Where is the footage physically stored?" On-premise NVR in your server room, a vendor-hosted cloud, or a cloud region outside India? DPDP's cross-border transfer obligations sit in the tranche enforced from 14 May 2027 (DPDP Rules notification, PIB). Compare the two models in NVR vs cloud video storage for Indian factories.
7. "Who holds the admin password on day one, and will you hand it over?" Many integrators keep the admin account and give the owner a viewer login. That means you cannot change retention, cannot audit access, and cannot fire them.
8. "If I terminate, how do I get 90 days of footage out, in what format, at what cost?" Get the export format and the price in the contract. Proprietary containers that only open in the vendor's player are a lock-in device.
9. "Do you sign a processor agreement with confidentiality, breach notification and no secondary use?" Your engineers must not be able to view or copy floor footage from their homes without an access log.
Round 3: the exact wording that stops "AI" being a slide
10. "Run it on my floor, on my cameras, for 14 days, before I pay." Written as a paid pilot with a defined exit. A demo on someone else's warehouse video proves nothing about your 40-foot weld-shop ceiling.
11. "What is the expected false-alarm rate per camera per day, and what do we do at handover if it is higher?" The honest vendor gives a specific range and offers a tuning period. The dishonest one says "99% accurate", which is a number with no denominator.
12. "Who tunes it, how fast, and at what cost after go-live?" Detection that nobody tunes decays into noise.
13. "Price this in rupees per camera per month, and tell me what happens if I add eight cameras." Per-instance pricing must be converted before comparison — see what a factory camera AI system costs in India.
14. "Does the analytics run at the edge or in your cloud?" Cloud adds bandwidth and compute cost — indicatively 20–40% on top — and moves personal data off your premises.
Round 4: AMC, renewal and the hostage year
15. "What is the AMC in years 2, 3 and 4 — in rupees, capped, in this contract?" Also: response SLA in hours (4–8 business hours is the usual Indian market ask), spares availability, and whether firmware and analytics licences continue if you skip a renewal.
16. "If I do not renew, does the system keep recording?" Basic recording should survive; only analytics should lapse. If refusing an AMC bricks your NVR, you have not bought a system, you have rented one.
17. "Who signs off compliance — and do you accept liability if the hardware is later found non-conforming?" Under DPDP, the data-protection duty is yours regardless. But an indemnity for supplying non-conforming hardware is fair, and a serious vendor will accept it.
The answer key
| Question area | A good answer sounds like | Red flag |
|---|---|---|
| Certification | "Here is the BOM with R-numbers and ER/STQC certificates per SKU; verify on crsbis.in" | "The brand is approved" / "list is with head office" |
| Analogue vs network | "Lines 1–18 are network cameras with ER certs; 19–32 are analogue, ER not applicable, BIS safety registration attached" | One blanket compliance claim for the whole quote |
| Stock | "Post-deadline stock; the invoice will state it" | No written confirmation of what is being supplied |
| Footage ownership | "Yours, in clause 8, including post-termination" | Silence, or "standard terms" |
| Storage location | "On-prem NVR in your MCC room; cloud optional, India region" | "Our secure cloud" with no region named |
| Admin password | "Handed to you at commissioning; we get a named service account" | "We manage it for you" |
| False alarms | A specific per-camera-per-day figure plus a two-week tuning window | "99% accurate" |
| AI pricing | "₹1,400 per camera per month, capped for 24 months" | "₹X per instance", instance size unstated |
| AMC | "₹450/camera/year, capped, 8-hour on-site SLA" | "As applicable at prevailing rates" |
| Non-renewal | "Recording continues; analytics licence lapses" | "System locks" |
| GST | "18% extra, shown as a line" | Ambiguous "all-inclusive" |
Rupee figures above are illustrative of shape, not a rate card — sanity-check them against your own quotes.
What this list does not do
It does not tell you whether you need cameras at all. There is no blanket statutory requirement to install CCTV in an Indian factory. Obligations come from the OSH Code 2020 regime and its Central Rules, from state rules, and — far more often in practice — from customer and brand-owner audits. What is regulated is what you may buy.
It does not make a certified camera a good camera. Certification means a device passed a defined safety and security test. It says nothing about whether the lens resolves a label, survives your foundry dust, or sees anything at 2 a.m. A fully certified camera pointed at a blank wall is compliant and useless — placement is your decision, not the vendor's spec sheet (where to place cameras on a shop floor).
And it does not reduce theft by itself. A reviewed clip with a consequence does. If nobody in your plant owns 15 minutes a day of looking at what the system flagged, buy fewer cameras and spend the difference on a gate process.
Cameras can also cut against you. Footage of a hazard you did not fix is evidence, not protection. Under the OSH Code 2020 — which came into force on 21 November 2025 and subsumed the Factories Act 1948 — Section 103 provides that a contravention resulting in an accident causing death carries imprisonment up to two years, or a fine of not less than ₹5 lakh, or both (OSH Code 2020, India Code). Cover washroom approaches, never interiors, and post the notice (worker CCTV privacy notice under DPDP).
Finally: a camera in the women's night-shift package is a condition attached to running the shift, not a productivity tool. Keep the stated purpose in security-and-safety terms and keep it there.
FAQ
What is the single most important question to ask a CCTV vendor in India? "Give me the exact model number with its BIS CRS R-number and its ER/STQC certificate." Compliance is granted model by model, not to a brand, and since 1 April 2026 non-conforming CCTV cameras cannot be sold, imported or manufactured in India. Verify the number yourself on crsbis.in before releasing the purchase order.
Do the certification rules apply to my analogue cameras and my DVR? Not identically. BIS has circulated MeitY's clarification that the security Essential Requirements Order does not apply to analogue CCTV cameras — those remain under BIS registration for safety. The security layer runs through STQC's IoT scheme, aimed at network-connected cameras. Ask your integrator to state, per line item, which units are network-connected.
Should the vendor keep the admin password to my NVR? No. You should hold the administrator account from commissioning, with the vendor given a named service account that appears in the access log. If the integrator holds admin, you cannot change retention, audit who viewed footage, or switch suppliers without their cooperation.
What is a reasonable AMC for factory CCTV in India? Indicative market practice runs around ₹350–500 per camera per year plus a site minimum near ₹7,500, usually with year 1 bundled. What matters more than the rate is that years 2–4 are priced and capped in the contract, with a stated on-site response SLA in hours and confirmation that recording continues if you skip a renewal.
Is GST on CCTV 18% or 28%? CCTV equipment attracts 18% GST, reduced from 28% in the September 2025 rate revision. Insist the quote states whether prices are inclusive or exclusive — on a ₹15 lakh project the difference is about ₹2.7 lakh, and "all-inclusive" quotes that quietly exclude tax are a common quotation dispute.
Who is legally responsible for worker privacy — me or the CCTV vendor? You. Under the DPDP Act 2023 the factory is the data fiduciary; the integrator or AMC firm is at most a processor. The penalty ceiling for failing to take reasonable security safeguards is ₹250 crore, with substantive duties enforced from 14 May 2027. Sign a processor agreement, but do not assume it transfers your duty — it does not.