Do I Have to Replace My Factory CCTV in 2026? (India)

No — not the cameras already on your wall. India's rule binds manufacture, import and sale. MeitY's Office Memorandum of 16 January 2026 withdrew the sell-through relaxation, so from 1 April 2026 no camera failing the Essential Requirements can be sold here. Your installed estate stays legal. The rule bites the next time you buy.

You run a 200–1000 worker plant somewhere between Coimbatore and Ludhiana. Your integrator has been calling since March saying your Hikvision or Dahua units are "banned" and quoting a full replacement. Here is what the rule actually says, and the moments where you genuinely have no choice.

Key points

• The obligation sits on manufacture, import and sale — not on possession. MeitY notified the Essential Requirements (ERs) for Security of CCTV by gazette notification dated 9 April 2024 under the Compulsory Registration Order, and the 16 January 2026 Office Memorandum withdrew the sell-through relaxation with effect from 1 April 2026.
• Certification is per model, not per brand. Industry guidance is blunt that ER compliance is granted at the individual model level and each model must be verified against the official database — a "CP Plus quotation" proves nothing by itself.
• The certified pool is small. The STQC IoT System Certification Scheme list carries network-camera certificates for a handful of manufacturers — Prama India, Aditya Infotech, Matrix Comsec, Samriddhi Automation, Honeywell, Vicon, Equus. Expect longer lead times and thinner model choice than you are used to. (STQC notes that its network-camera list is no longer being refreshed, so cross-check the BIS CRS registry at crsbis.in as well.)
• Tenders are where it becomes non-negotiable. MeitY's circular of 4 February 2026 tied STQC ER test reports to the Public Procurement (Preference to Make in India) Order, and the Railway Board circulated it to all zonal railways on 23 February 2026.
• Your bigger legal exposure is footage, not hardware. The DPDP Rules, 2025 were notified on 13 November 2025, effective 14 November, with obligations phased into 2027, and the Act's penalty ceiling for failing reasonable security safeguards is ₹250 crore. Nobody is fining you for an old camera; they can fine you for a leaked recording.
• Stop quoting the Factories Act by itself. The OSH Code, 2020 came into force on 21 November 2025, subsuming the Factories Act 1948, and the OSH (Central) Rules, 2026 were notified on 8 May 2026. State notifications issued under the old Act still operate transitionally until state rules under the Code replace them — so you read both.

What actually changed on 1 April 2026 — and what did not

Two separate things get muddled in the WhatsApp forwards.

What changed: the sell-through window closed. Until then, older non-ER stock could still be legally sold. MeitY's January 2026 OM ended that. Manufacturers, importers, distributors, dealers, installers and system integrators are bound. A dealer who installs an uncertified network camera in your plant next month is the one breaking the rule.

What did not change: nothing requires an end user to tear out working cameras. There is no retrospective clause and no inspection regime aimed at factory owners for holding older cameras. Trade coverage is consistent on this point — existing installed cameras can continue to operate; the restriction applies to selling and installing new non-compliant devices.

One useful technical distinction, and it is a load-bearing one: the security ERs run through STQC's IoT System Certification Scheme, aimed at network-connected cameras. BIS's circular on analogue CCTV cameras records MeitY's clarification that the Security ER Order is not applicable to analogue CCTV cameras, which therefore need not be tested against the notified security ERs. Analogue cameras still sit under BIS registration for safety — the exemption is from the security layer only. If half your plant is analogue coax into a DVR, your exposure is genuinely different. Ask your integrator to state, in writing, which of your cameras are network-connected.

The moments you are actually forced to change

Four rows say yes, and the middle three are the ones that bite. An owner in Hosur or Sanand bidding into an auto OEM's tier-1 chain, or into a railway or defence PSU order, will meet ER/STQC language in the technical bid document long before any inspector visits the shop floor. That is the practical mechanism by which this rule reaches private factories — through the buyer, not the regulator.

Also note the second-order effect. Hikvision- and Dahua-branded models are not on the STQC network-camera list, so your integrator's spares depth for those units is thinning. (Prama India, a Hikvision-affiliated Indian manufacturer, is certified — the lineage is not banned, the branded SKUs you own simply are not the ones being certified.) Your old cameras are legal; the eight identical replacements you assumed you could buy in 2028 may not exist. That is a maintenance-planning problem, not a compliance one. We cover the substitution question in Hikvision and Dahua alternatives for Indian factories.

What to check on the invoice before you pay

Four lines. Do this yourself, not through the dealer.

1. Exact model number, not the series. "CP Plus 4MP bullet" is not a model. You need the SKU printed on the box.
2. The certificate number, and the annexure. Certificates list the manufacturer on the front page; the covered model numbers sit in an annexure you have to open. Match your SKU there, and cross-check the BIS CRS registry.
3. Firmware version and certificate validity. Certification attaches to a tested build. A camera flashed to a different firmware is not obviously the certified article.
4. A one-line warranty from the seller stating the supplied models conform to the ERs notified on 9 April 2024. It costs the dealer nothing if he is telling the truth, and it moves the risk to him if he is not.

If a quotation comes back with "STQC applied for" or "compliance under process", treat it as not certified. Our deeper walkthrough is in BIS and STQC 2026 factory camera compliance.

The rule that is more likely to catch you: women on night shift

If you are worried about compliance, this is where to spend the worry.

Section 43 of the OSH Code lets women be employed before 6 a.m. and beyond 7 p.m. with their written consent and prescribed safeguards. The OSH (Central) Rules, 2026 attach the conditions that carry teeth — written consent, safe pick-up and drop transport, a well-lit workplace including entry and exit, and CCTV surveillance. State notifications add the numbers. Karnataka's, issued in 2019, requires lighting and CCTV coverage inside and around the factory, with footage maintained for at least forty-five days. It was issued under the Factories Act and continues transitionally, so confirm the version your inspectorate is currently applying.

That is a rule about coverage and retention, not about camera certification. A plant can be entirely ER-compliant on paper and still fail a night-shift inspection because the loading bay is dark and the DVR overwrites at 14 days. State-by-state detail is in which Indian states require CCTV for women's night shift.

What replacing your cameras will not fix

Be honest with yourself about what a hardware swap buys.

• It does not create coverage. Swapping 32 cameras for 32 certified cameras in the same positions leaves the same blind spots at the scrap yard, the dispatch gate and the back stairwell. Coverage is a layout problem, and no certificate solves it.
• It does not make anyone watch the footage. Most mid-size plants review recordings only after a loss. A certified camera nobody opens is a certified camera nobody opens.
• It does not give you DPDP cover. Certification is a product security standard. Your obligations around notice, purpose limitation, retention and access to worker recordings are separate, and phased enforcement runs into 2027. See DPDP and worker CCTV.
• It can make things worse if you rush. Ripping out a working estate under panic pricing, in a market with a thin certified model pool, is how plants end up with mismatched firmware, broken PoE budgets and a VMS that no longer records reliably.
• It does not, by itself, reduce theft or improve output. Cameras record; they do not act. And if analytics is the real goal, that is often a software layer over the estate you already own, not a reason to replace it.

A sane sequence for a 200–1000 worker plant

This month, free: get a written inventory from your integrator — every camera, model, whether it is network-connected, and its current firmware. Most owners do not have this. Everything else depends on it.

Before your next purchase: decide your standard certified model family now, while you are calm, rather than at 11 p.m. when a camera dies. Two or three SKUs is enough for a whole plant.

Before your next tender or OEM audit: check whether the bid documents carry ER/STQC or PPP-MII language. If they do, scope the replacement to the area the tender names — a tender rarely demands your canteen camera be certified.

Never: replace the whole estate in one purchase order because a dealer sent you a screenshot of a gazette notification. Budget that money against coverage gaps and retention instead.

FAQ

Is my existing Hikvision or Dahua CCTV illegal in India now? No. Owning and operating already-installed cameras is not prohibited. The 1 April 2026 restriction applies to manufacture, import and sale. Those brands' own models are not on the STQC network-camera list, so buying new units or identical spares through legitimate channels is the problem — not the units already running.

Will a factory inspector fine me for uncertified cameras? There is no notified penalty aimed at end users for operating pre-existing non-compliant cameras. Inspections under the OSH Code and its rules look at safety, welfare and night-shift conditions. Where CCTV appears there, it is about coverage and retention, not product certification.

What if I only need to replace two failed cameras? Those two must be certified models supplied by a compliant seller. There is no minimum-quantity exemption. A mixed estate — old uncertified units plus new certified ones — is lawful, because the rule attaches to each transaction rather than to the system as a whole.

Do I have to replace my DVR, NVR or recording software too? The security ER regime and the STQC scheme are framed around cameras, principally network-connected ones; recorders sit under BIS registration and your own security practice, and for personal data under the DPDP Rules. Ask your integrator to confirm in writing what is in scope for anything he quotes.

How do I verify a certificate without trusting the dealer? Open the STQC IoT System Certification Scheme list, find the manufacturer, download the certificate and its annexure, and match your exact model number, the firmware version and the validity date. Model numbers sit in the annexure, not on the first page. Cross-check the BIS CRS registry at crsbis.in, since STQC's network-camera listing is no longer being refreshed.

Does any of this apply if my plant is fully analogue? Not the security layer. BIS's circular records MeitY's clarification that the Essential Requirements for Security of CCTV do not apply to analogue CCTV cameras, so they need not be tested against them; BIS registration for safety still applies. Get written confirmation of which of your cameras touch a network before assuming either way.