Since 1 April 2026 India Has Allowed Only Security-Certified Non-Analog CCTV Cameras to Be Sold, and 507 Models Were Certified by 25 March

Since 1 April 2026, a CCTV camera that does not meet India’s security requirements cannot lawfully be sold in the country. A MeitY office memorandum dated 16 January 2026 says that “no sale of any CCTV cameras, which do not conform to ERs notified by MeitY” is allowed from that date. The ERs are the Essential Requirements for Security of CCTV, a test list the Ministry of Electronics and Information Technology published in the Gazette of India on 9 April 2024. A reply submitted in Lok Sabha on 25 March 2026, released by the Press Information Bureau, said 507 camera models were certified as compliant.

What the rule says and who it covers

The 16 January memorandum ended a concession. On 21 May 2025 MeitY had allowed cameras imported or made in India before 9 April 2025 to be sold off as old stock. Citing the line that “sufficient time has elapsed”, the new memorandum withdraws that relaxation from 1 April 2026. It was addressed to the Director General of the Bureau of Indian Standards (BIS) and to industry associations.

Its legal footing is an order dated 9 April 2024, numbered S.O. 1652(E). It added CCTV cameras at serial number 41 of the schedule to the Electronics and Information Technology Goods (Requirements for Compulsory Registration) Order, 2021, which is issued under the Bureau of Indian Standards Act, 2016. Under that order a maker needs a BIS licence to use the Standard Mark, and test reports from BIS-recognised labs are a prerequisite for the licence. A camera therefore has to meet the older electrical safety standard, IS 13252 (Part 1): 2010, and also the security requirements added in 2024.

As written, the rule is a standard that applies to every brand and every country of origin. One group of cameras sits outside it. A BIS circular of 1 April 2025 reports that MeitY clarified on 12 March 2025 that analog cameras do not need to be tested against the security requirements. Cameras of any other type do.

How a camera gets certified

A maker applies to BIS with a test report for what the BIS portal calls ER: 01. STQC, the Standardisation Testing and Quality Certification Directorate of MeitY, assigns a lab and a validator, the lab tests the camera, STQC sends the report to BIS, and BIS issues the certificate. Packaging of a compliant camera may carry the line “This CCTV camera complies with Essential Requirement(s) for Security.”

A second route serves government buyers. A MeitY notification of 6 March 2024, published in the Gazette on 7 March, put video surveillance systems under the Public Procurement (Preference to Make in India) Order, with the same security requirements. STQC issues certificates for that route under its IoT System Certification Scheme, and a certificate is valid for three years. A MeitY circular of 4 February 2026 says the two routes use the same requirements, so from that date STQC issues a single security test report under the BIS order that also counts for public procurement.

Cameras in one series must share the same chip, the same layout of the security-related circuits and identical firmware with matching hash values, according to the series guidelines BIS circulated in October 2024. Each certificate lists the chipset, including its country of origin, the firmware version and the hash. One example is STQC certificate ER/009, issued on 8 October 2024 to Prama India Private Limited for three network camera models. It records the chip as a Novatek NT98525 and its country of origin as Taiwan, based on documents the maker submitted, and it runs to 7 October 2027. By its own wording the certificate is not an endorsement of the product by any government agency.

What the labs test

STQC’s P01 procedure, dated 21 May 2024, sets out the checks in four groups.

On the hardware, debug ports such as USB, UART, JTAG and SWD must be disabled or protected by a complex password, and the lab checks the maker’s factory process to confirm they are closed when the camera is provisioned. Each device must carry its own cryptographic keys and certificates, the camera must show tamper resistance or tamper detection, and it must check the signature of its boot image before loading it. Sensitive data and keys are to sit in a secure element, a trusted platform module or a trusted execution environment, which are protected zones on or beside the chip, or else be protected with strong cryptography.

On the firmware, the lab verifies that memory protections are on, that data in transit uses strong encryption and that the camera validates the digital signature of the servers it talks to. It checks that risky C functions are replaced with safe ones and that the firmware carries a software bill of materials, a list of every third-party component with its version and known vulnerabilities. Firmware updates must be signed and checked before installation, and the camera must refuse to roll back to an older version.

Source code is reviewed too. Procedure P01 requires an automated and manual code review with a licensed static analysis tool, and it requires all code, including third-party binaries and libraries, to be checked for hardcoded credentials, which the document labels backdoors. Vendors supply firmware binaries and their internal review reports. Several ways to do the review are listed, from the vendor bringing its code to the lab to the lab getting remote access to the vendor’s own systems. A camera that uses a proprietary network protocol must hand over complete implementation details and the source code for that protocol.

On the supply chain, the vendor submits a bill of materials for the critical hardware parts, design documents down to the circuit-board and chip level, supply-chain risk and continuity plans, and evidence that malware scanning was done before packing. Labs are told the security-critical parts are the chip, the firmware, the circuit board, the network interface and the physical ports.

The chipset clause and what the documents name

The sourcing check is the part that has drawn most attention. STQC’s guidance note to test labs tells them to verify that the chip and firmware are “not sourced from Land Border Sharing Countries”, using invoices, technical literature and other supporting documents. Labs must also trace the chip and firmware from procurement through to the finished product, and it says a part developed in-house needs no invoice.

No document cited here names a country or a company. Both the Gazette annexure and the P01 procedure speak of trusted sources and a managed bill of materials, and the land-border wording appears in the guidance note. That phrase describes countries that share a land border with India.

Press accounts go further than the documents. MediaNama, citing an Economic Times report, described the measure as a bar on Chinese video surveillance firms and said authorities deny certification to products using Chinese chipsets or firmware, without naming a source for that practice. Hikvision, Dahua and TP-Link were named by The News Minute as directly affected, also without a cited document. Reuters reported in May 2025 that Xiaomi said Indian labs had asked its China-based contract manufacturers for extra documents, citing “internal guidelines” for firms from countries that share a land border with India. China’s foreign ministry, according to Reuters, urged India to provide a non-discriminatory environment for Chinese firms. What the official record shows is a certification regime, and none of its documents lists a rejected brand.

The reasons the government has given

MeitY’s advisory of 11 March 2024 lists data security, privacy breach, hacking and cyber attack as growing risks of CCTV systems and says incidents have been reported from security flaws in cameras. It advises government bodies to avoid brands with a history of security breaches and data leakages and to keep data from CCTVs at government establishments and public places within India. STQC’s guidance note gives its own reason: leaked footage reaching unauthorised people.

In its release of 25 March 2026 the Press Information Bureau lists the CCTV rules among the government’s security measures, next to a 2021 directive that telecom networks use equipment only from trusted sources. It says government departments are restricted from buying CCTV equipment that does not meet the criteria. Reuters quoted an unnamed senior official as saying “China is part of the concern” and reported that officials cited the need to secure national surveillance infrastructure. A Recorded Future report on attacks on India’s power sector described attackers relaying commands through compromised DVRs and IP cameras, which gives the supply-chain concern a technical example.

The dates from 2024 to 2026

• 6 March 2024: MeitY notifies the security requirements for government purchases, published in the Gazette on 7 March. A MeitY circular says they took effect on 7 June 2024.
• 9 April 2024: S.O. 1652(E) adds CCTV cameras to the compulsory registration order, to apply six months after publication.
• 21 May 2024: STQC issues procedure P01.
• 22 October 2024: BIS sets 9 April 2025 as the implementation date and says non-compliant models will then be removed from licences.
• 12 March 2025: MeitY excludes analog cameras.
• 9 April 2025: the requirement takes effect under the BIS order.
• 21 May 2025: MeitY permits sale of stock imported or made before 9 April 2025.
• 16 January 2026: MeitY withdraws that permission with effect from 1 April 2026.

What changed for suppliers

Reuters reported on 28 May 2025 that STQC had 15 labs able to process 28 applications at once, and that applications exceeded that capacity. It said officials told executives from 17 companies at a meeting on 3 April 2025 that the policy would be enforced without exception, and that 342 applications were pending as of 28 May 2025 with one approval for a foreign brand. Hanwha’s South Asia director warned the ministry by email that “millions of dollars will be lost from the industry”, Reuters said. That report put the Indian CCTV market at 3.5 billion dollars in 2023 and said about 80 per cent of components still came from China.

By April 2026 the reporting had shifted to who gained. Citing Counterpoint Research, The News Minute said Indian companies held more than 80 per cent of the market as of February 2026. It listed CP Plus, Qubo, Prama, Matrix and Sparsh as expanding and said they had moved to Taiwanese chipsets and locally written firmware, without citing a source for that part. It reported Bosch and Honeywell strong at the premium end.

The official count stood at 507 certified models on 25 March 2026, and none of the government documents cited here gives a breakdown of those models by brand.