Straight answer: the CCTV security rule governs what can be made, imported and sold, not what is already on your wall. Nothing in the notifications requires already-installed cameras to be removed. If a supplier is telling you your existing system is now illegal and must be replaced, that is a sales pitch, not the rule.
Something predictable has been happening in the market since April. A business owner gets a call or a WhatsApp forward saying the government has banned their cameras, that everything must be swapped out, and that the quotation is attached. For a factory running thirty or forty cameras, that is a large number arriving out of nowhere, attached to a deadline the owner has had no chance to check.
It is worth knowing what the rule actually says, because the honest version is far less alarming — and it changes what you should do next.
What actually changed
CCTV cameras are covered by India's Compulsory Registration Order, which requires BIS registration. By Gazette notification S.O. 1652(E) of 9 April 2024, the Ministry of Electronics and Information Technology added a set of Essential Requirements — security conditions a camera has to meet — which became mandatory on 9 April 2025 under S.O. 4378(E). Compliance is verified through testing at a BIS-recognised laboratory as part of the camera's BIS registration. STQC runs a separate certification that is used mainly for government purchases.
For a period, a relaxation let stock that had already been imported or manufactured continue to be sold while the industry caught up. According to trade reports, a MeitY Office Memorandum dated 16 January 2026 withdrew that relaxation with effect from 1 April 2026; we have not located an official copy of that memorandum. The effect reported is that from 1 April 2026, cameras that do not conform to the Essential Requirements should no longer be sold in India.
That is the whole change. A grace period for old stock ended.
The requirement applies to network (IP) CCTV cameras; BIS has confirmed it does not apply to analog cameras, and DVRs/NVRs are not covered by this entry.
Who the obligation falls on
This is the part that gets lost in the retelling. The rule restricts manufacture, import, storage and sale — the duty sits with whoever is making, importing, stocking or selling the camera.
Nothing in the notifications requires already-installed cameras to be removed, and there is no date on which a working system stops being usable because of this rule. If your cameras went up in 2023 and they still cover what you need them to cover, the rule has not asked anything of them.
Where it does affect you is the next time you buy. New network cameras, a site expansion, replacing a failed unit — all of that should come from compliant stock now. Which makes verification a purchasing skill worth having.
What the Essential Requirements are actually about
They are security conditions for the device, and they are aimed at a real problem rather than an imagined one. The requirements cover:
- Secure firmware, and a safe way to update it. A camera that cannot be patched safely stays vulnerable for its whole service life.
- Encrypted communication. Footage and credentials should not travel across your network, or out of it, in the clear.
- Proper authentication, strong password policies and no hardcoded credentials. Credentials baked into a device's firmware by the manufacturer have historically been how large numbers of cameras get taken over at once.
- Tamper protection.
The underlying concern is straightforward: a camera is a computer on your network with a lens attached. If it is badly built, you have not added security — you have added a way in. The rule is trying to raise the floor on how these devices are built.
How to check a camera before you buy
Ask for documents, and check them against the public list.
- The BIS registration (R-number) under the Compulsory Registration Order.
- Check the BIS public list of CCTV registrations complying with the security Essential Requirements, and confirm the exact model on your quotation appears there.
- Match the model numbers exactly. A registration can cover several models in a series, but only the ones it lists; a similar-looking model that is not listed is not covered. For government tenders, also ask for the STQC test report.
A verbal assurance, a brochure line, or "sir, sab certified hai" is not verification. A supplier who is genuinely selling compliant stock will have the registration and will not mind being asked for it.
What this means for a site that already has cameras
Mostly, it means you have more room than you are being told.
If the cameras are up, working, and pointed at the right things, the sensible order of business is to get more out of them before spending on replacements. Most sites we look at are not short of cameras. They are short of anyone watching the footage at the moment it matters — the recording exists, and the owner finds out the next morning. That gap is not closed by buying newer cameras, and it does not require replacing the ones you have.
When a camera genuinely does need replacing — it has failed, or it never covered the area properly — buy a compliant one and check it on the BIS list. That is the whole compliance task for most businesses.
Sources: MeitY, S.O. 1652(E), Gazette of India, 9 April 2024 (Essential Requirements for Security of CCTV); MeitY, S.O. 4378(E), 9 October 2024 (implementation from 9 April 2025); BIS circular of 1 April 2025 (Essential Requirements not applicable to analog cameras); BIS list of CCTV models complying with the security Essential Requirements. The MeitY Office Memorandum of 16 January 2026 is as reported by trade publications; an official copy was not independently located.
One honest caveat: this is a summary of what the notifications say, not legal advice, and rules get amended. For a large purchase, or if you are in a sector with its own security obligations, confirm the current position with your supplier and the official notifications before you commit.