Do I Have to Replace My Factory CCTV in 2026? (India)

No — not the cameras already on your wall. India's rule binds manufacture, import and sale. MeitY's Office Memorandum of 16 January 2026 withdrew the sell-through relaxation, so from 1 April 2026 no camera failing the Essential Requirements can be sold here. Your installed estate stays legal. The rule bites the next time you buy.

You run a 200–1000 worker plant somewhere between Coimbatore and Ludhiana. Your integrator has been calling since March saying your Hikvision or Dahua units are "banned" and quoting a full replacement. Here is what the rule actually says, and the moments where you genuinely have no choice.

Key points

• The obligation sits on manufacture, import and sale — not on possession. MeitY notified the Essential Requirements (ERs) for Security of CCTV by gazette notification dated 9 April 2024 under the Compulsory Registration Order, and the 16 January 2026 Office Memorandum withdrew the sell-through relaxation with effect from 1 April 2026.
• Certification is per model, not per brand. Industry guidance is blunt that ER compliance is granted at the individual model level and each model must be verified against the official database — a "CP Plus quotation" proves nothing by itself. You can run that check on a model number yourself with the CCTV certificate checker.
• The certified pool is narrower than before — but not tiny. The STQC IoT System Certification Scheme list is frozen (STQC notes it is no longer being refreshed) and carries network-camera certificates for seven manufacturers only — Prama India, Aditya Infotech, Matrix Comsec, Samriddhi Automation, Honeywell, Vicon, Equus. The live register is BIS CRS at crsbis.in: its list of models complying with the Security ER shows 925 models in its Security-ER column, from 47 brands under 57 registrations with status Registered (checked 16 Oct 2026). Choice is still thinner than the pre-2026 market, so expect some lead-time friction. The certified CCTV finder lets you filter that list by brand.
• Tenders are where it becomes non-negotiable. MeitY's circular of 4 February 2026 tied STQC ER test reports to the Public Procurement (Preference to Make in India) Order, and the Railway Board circulated it to all zonal railways on 23 February 2026.
• Your bigger legal exposure is footage, not hardware. The DPDP Rules, 2025 were published on 13 November 2025, with the substantive obligations applying from 14 May 2027, and the Act's penalty ceiling for failing reasonable security safeguards is ₹250 crore. Nobody is fining you for an old camera; they can fine you for a leaked recording.
• Stop quoting the Factories Act by itself. The OSH Code, 2020 came into force on 21 November 2025, subsuming the Factories Act 1948, and the OSH (Central) Rules, 2026 were notified on 8 May 2026. State notifications issued under the old Act still operate transitionally until state rules under the Code replace them — so you read both.

What actually changed on 1 April 2026 — and what did not

Two separate things get muddled in the WhatsApp forwards.

What changed: the sell-through window closed. Until then, older non-ER stock could still be legally sold. MeitY's January 2026 OM ended that. Manufacturers, importers, distributors, dealers, installers and system integrators are bound. A dealer who installs an uncertified network camera in your plant next month is the one breaking the rule.

What did not change: nothing requires an end user to tear out working cameras. There is no retrospective clause and no inspection regime aimed at factory owners for holding older cameras. Trade coverage is consistent on this point — existing installed cameras can continue to operate; the restriction applies to selling and installing new non-compliant devices.

One useful technical distinction, and it is a load-bearing one: the security ERs run through STQC's IoT System Certification Scheme, aimed at network-connected cameras. BIS's circular on analogue CCTV cameras records MeitY's clarification that the Security ER Order is not applicable to analogue CCTV cameras, which therefore need not be tested against the notified security ERs. Analogue cameras still sit under BIS registration for safety — the exemption is from the security layer only. If half your plant is analogue coax into a DVR, your exposure is genuinely different. Ask your integrator to state, in writing, which of your cameras are network-connected.

The moments you are actually forced to change

Four rows say yes, and the middle three are the ones that bite. An owner in Hosur or Sanand bidding into an auto OEM's tier-1 chain, or into a railway or defence PSU order, will meet ER/STQC language in the technical bid document long before any inspector visits the shop floor. That is the practical mechanism by which this rule reaches private factories — through the buyer, not the regulator.

Also note the second-order effect, and split it by camera type. Network (IP) cameras: no Hikvision- or Dahua-branded model appears in the BIS CRS Security-ER column (checked 16 Oct 2026), and neither brand is on the frozen STQC list, so identical IP spares for those units cannot be legally bought new. (Prama India, a Hikvision-affiliated Indian manufacturer, is certified under its own Prama brand — the lineage is not banned, the branded SKUs you own simply are not the ones being certified.) Analogue cameras: the security ER does not apply to them, and the same BIS CRS list shows 376 Hikvision analogue models (366 DS-2CE, 10 AE-VC) under PRAMA HIKVISION INDIA's registration R-71004456, Registered with validity to 17 Jul 2031 — so like-for-like analogue Hikvision spares can still be sold. Dahua's 64 analogue models (DH-HAC) sit on Pacific Cyber Technology's registration R-71011460, which BIS CRS shows as Cancelled (checked 16 Oct 2026), so those are not a legal source of new stock. Your old cameras are legal either way; the eight identical IP replacements you assumed you could buy in 2028 are not on legal sale today. That is a maintenance-planning problem, not a compliance one. We cover the substitution question in Hikvision and Dahua alternatives for Indian factories.

What to check on the invoice before you pay

Four lines. Do this yourself, not through the dealer.

1. Exact model number, not the series. "CP Plus 4MP bullet" is not a model. You need the SKU printed on the box.
2. The certificate number, and the annexure. Certificates list the manufacturer on the front page; the covered model numbers sit in an annexure you have to open. Match your SKU there, and cross-check the BIS CRS registry.
3. Firmware version and certificate validity. Certification attaches to a tested build. A camera flashed to a different firmware is not obviously the certified article.
4. A one-line warranty from the seller stating the supplied models conform to the ERs notified on 9 April 2024. It costs the dealer nothing if he is telling the truth, and it moves the risk to him if he is not.

If a quotation comes back with "STQC applied for" or "compliance under process", treat it as not certified. Our deeper walkthrough is in BIS and STQC 2026 factory camera compliance.

The rule that is more likely to catch you: women on night shift

If you are worried about compliance, this is where to spend the worry.

Section 43 of the OSH Code lets women be employed before 6 a.m. and beyond 7 p.m. with their written consent and prescribed safeguards. The OSH (Central) Rules, 2026, which bind central-sphere establishments, attach the conditions that carry teeth — written consent, safe pick-up and drop transport, a well-lit workplace and passages, and CCTV surveillance "on the way to" toilets, washrooms and drinking water (rule 83(d)). State texts add the numbers. Karnataka's 2019 notification and the Factories (Karnataka Amendment) Act, 2023 both required lighting and CCTV coverage inside and around the factory, with footage stored for at least forty-five days. Both were made under the Factories Act, which the OSH Code repealed from 21 Nov 2025; for a factory, the State now prescribes the night-work conditions under s.43 of the Code, so ask your inspectorate which conditions it applies.

That is a rule about coverage and retention, not about camera certification. A plant can be entirely ER-compliant on paper and still fail a night-shift inspection because the loading bay is dark and the DVR overwrites at 14 days. State-by-state detail is in which Indian states require CCTV for women's night shift.

What replacing your cameras will not fix

Be honest with yourself about what a hardware swap buys.

• It does not create coverage. Swapping 32 cameras for 32 certified cameras in the same positions leaves the same blind spots at the scrap yard, the dispatch gate and the back stairwell. Coverage is a layout problem, and no certificate solves it.
• It does not make anyone watch the footage. Most mid-size plants review recordings only after a loss. A certified camera nobody opens is a certified camera nobody opens.
• It does not give you DPDP cover. Certification is a product security standard. Your obligations around notice, purpose limitation, retention and access to worker recordings are separate, and phased enforcement runs into 2027. See DPDP and worker CCTV.
• It can make things worse if you rush. Ripping out a working estate under panic pricing, in a market with a narrower certified model pool, is how plants end up with mismatched firmware, broken PoE budgets and a VMS that no longer records reliably.
• It does not, by itself, reduce theft or improve output. Cameras record; they do not act. And if analytics is the real goal, that is often a software layer over the estate you already own, not a reason to replace it.

A sane sequence for a 200–1000 worker plant

This month, free: get a written inventory from your integrator — every camera, model, whether it is network-connected, and its current firmware. Most owners do not have this. Everything else depends on it.

Before your next purchase: decide your standard certified model family now, while you are calm, rather than at 11 p.m. when a camera dies. Two or three SKUs is enough for a whole plant.

Before your next tender or OEM audit: check whether the bid documents carry ER/STQC or PPP-MII language. If they do, scope the replacement to the area the tender names — a tender rarely demands your canteen camera be certified.

Never: replace the whole estate in one purchase order because a dealer sent you a screenshot of a gazette notification. Budget that money against coverage gaps and retention instead.

What this means for output and money

Before you spend on new cameras, find out what your current ones can already tell you: how many hours your machines really ran yesterday, and where the gaps were. That is a production question first, a security one second. See how cameras watch a production line and how OEE frames the result in rupees.

FAQ

Is my existing Hikvision or Dahua CCTV illegal in India now? No. Owning and operating already-installed cameras is not prohibited. The 1 April 2026 restriction applies to manufacture, import and sale. It depends on the camera type. For network (IP) cameras, no Hikvision- or Dahua-branded model is in the BIS CRS Security-ER list (checked 16 Oct 2026), so new units or identical IP spares cannot be legally bought. For analogue cameras the security ER does not apply: Hikvision's analogue models remain BIS-registered under PRAMA HIKVISION INDIA (R-71004456, valid to 17 Jul 2031), while the registration covering Dahua's analogue models (R-71011460) shows as Cancelled. Either way, the units already running are not the problem.

Will a factory inspector fine me for uncertified cameras? There is no notified penalty aimed at end users for operating pre-existing non-compliant cameras. Inspections under the OSH Code and its rules look at safety, welfare and night-shift conditions. Where CCTV appears there, it is about coverage and retention, not product certification.

What if I only need to replace two failed cameras? Those two must be certified models supplied by a compliant seller. There is no minimum-quantity exemption. A mixed estate — old uncertified units plus new certified ones — is lawful, because the rule attaches to each transaction rather than to the system as a whole.

Do I have to replace my DVR, NVR or recording software too? The security ER regime and the STQC scheme are framed around cameras, principally network-connected ones; recorders sit under BIS registration and your own security practice, and for personal data under the DPDP Rules. Ask your integrator to confirm in writing what is in scope for anything he quotes.

How do I verify a certificate without trusting the dealer? Type the exact model number into the CCTV certificate checker, which matches it against the STQC ER certificates and the BIS CRS Security-ER list. To see the document itself, open the STQC IoT System Certification Scheme list, find the manufacturer, download the certificate and its annexure, and match your exact model number, the firmware version and the validity date. Model numbers sit in the annexure, not on the first page. Cross-check the BIS CRS registry at crsbis.in, since STQC's network-camera listing is no longer being refreshed.

Does any of this apply if my plant is fully analogue? Not the security layer. BIS's circular records MeitY's clarification that the Essential Requirements for Security of CCTV do not apply to analogue CCTV cameras, so they need not be tested against them; BIS registration for safety still applies. Get written confirmation of which of your cameras touch a network before assuming either way.