Straight answer: the rule that changed on 1 April 2026 governs what can be sold, not what is already on your wall. Cameras you bought and installed before that date remain lawful and can keep running. If a supplier is telling you your existing system is now illegal and must be replaced, that is a sales pitch, not the rule.
Something predictable has been happening in the market since April. A business owner gets a call or a WhatsApp forward saying the government has banned their cameras, that everything must be swapped out, and that the quotation is attached. For a factory running thirty or forty cameras, that is a large number arriving out of nowhere, attached to a deadline the owner has had no chance to check.
It is worth knowing what the rule actually says, because the honest version is far less alarming — and it changes what you should do next.
What actually changed
CCTV cameras were brought under India's Compulsory Registration Order some time ago, which requires BIS registration. Alongside that, the Ministry of Electronics and Information Technology notified a set of Essential Requirements — security conditions a camera has to meet — verified through STQC testing.
For a period, a relaxation let stock that had already been imported or manufactured continue to be sold while the industry caught up. On 16 January 2026, MeitY issued an Office Memorandum withdrawing that relaxation. The effect is that from 1 April 2026, cameras that do not conform to the Essential Requirements may no longer be sold in India.
That is the whole change. A grace period for old stock ended.
Who the obligation falls on
This is the part that gets lost in the retelling. The duty sits with whoever is selling, importing or manufacturing the camera. It applies at the point of sale.
It does not reach backwards into installations that already exist. There is no provision requiring you to replace working cameras, and no date on which your current system stops being lawful. If your cameras went up in 2023 and they still cover what you need them to cover, the rule has not touched them.
Where it does affect you is the next time you buy. New cameras, a site expansion, replacing a failed unit — all of that has to come from compliant stock now. Which makes verification a purchasing skill worth having.
What the Essential Requirements are actually about
They are security conditions for the device, and they are aimed at a real problem rather than an imagined one. The requirements cover:
- Secure firmware, and a safe way to update it. A camera that cannot be patched safely stays vulnerable for its whole service life.
- Encrypted communication. Footage and credentials should not travel across your network, or out of it, in the clear.
- Proper authentication, with no hardcoded credentials. Hidden default passwords baked into a device by the manufacturer have historically been how large numbers of cameras get taken over at once.
- Tamper protection at the hardware level.
The underlying concern is straightforward: a camera is a computer on your network with a lens attached. If it is badly built, you have not added security — you have added a way in. The rule is trying to raise the floor on how these devices are built.
How to check a camera before you buy
Ask for documents, and read them.
- BIS registration under the Compulsory Registration Order.
- The STQC certificate for the exact model you are being quoted.
- Match the model numbers. Certification is issued per model. A certificate for a nearby model in the same range does not cover the one on your quotation — this is the most common gap, and it is easy to miss because the model names usually differ by a character or two.
A verbal assurance, a brochure line, or "sir, sab certified hai" is not verification. A supplier who is genuinely selling compliant stock will have the paperwork and will not mind being asked for it.
If you want the primary source rather than a vendor's summary, the MeitY notifications and the BIS CRO listings are public, and worth ten minutes before signing a large order.
What this means for a site that already has cameras
Mostly, it means you have more room than you are being told.
If the cameras are up, working, and pointed at the right things, the sensible order of business is to get more out of them before spending on replacements. Most sites we look at are not short of cameras. They are short of anyone watching the footage at the moment it matters — the recording exists, and the owner finds out the next morning. That gap is not closed by buying newer cameras, and it does not require replacing the ones you have.
When a camera genuinely does need replacing — it has failed, or it never covered the area properly — buy a compliant one and check the certificate. That is the whole compliance task for most businesses.
One honest caveat: this is a summary of what the notifications say, not legal advice, and rules get amended. For a large purchase, or if you are in a sector with its own security obligations, confirm the current position with your supplier and the official notifications before you commit.