India's 2026 CCTV Security Rules (BIS-ER & STQC): A Buyer's Guide

What Changed on 1 April 2026?

The Ministry of Electronics and Information Technology (MeitY) published its gazette notification in April 2024, giving the industry two years to comply. From 1 April 2026, every CCTV camera sold in India must be certified under the Bureau of Indian Standards (BIS) Essential Requirements framework — specifically ER-01:2024 — and must carry a valid STQC (Standardisation Testing and Quality Certification) approval.

This is not a product ban in the traditional sense. It is a security certification mandate — similar to how electronics must carry BIS marks before they can be sold legally in India. Cameras already installed continue to operate. The rule governs new procurement only.

Why Did the Government Act Now?

The mandate responds to long-standing concerns about the cybersecurity posture of surveillance hardware. Globally, procurement regulators across the United States (NDAA 2019), the United Kingdom, Australia, and several EU member states have tightened controls on surveillance equipment — primarily over data-security and supply-chain transparency concerns.

India's approach is technology-neutral: rather than naming specific brands, MeitY set technical security baselines that any manufacturer must meet. The practical effect is clear: brands that did not invest in the certification process in time are unable to legally sell new units under the new framework.

The Six Essential Requirements Every CCTV Must Meet

The BIS ER-01:2024 framework specifies six mandatory security requirements. Any CCTV camera sold in India after 1 April 2026 must satisfy all six.

# Essential Requirement — What It Means in Practice

1. No default passwords — Devices must force unique credentials on first setup

2. Encrypted video transmission — TLS/HTTPS required for all video streams

3. Secure signed-firmware boot — Only cryptographically verified firmware may run

4. Disabled debug ports — Physical debug interfaces (UART/JTAG) must be locked

5. Supply-chain/chipset origin transparency — Manufacturers must disclose component origins

6. Published vulnerability-disclosure policy — A formal CVD process must be documented and accessible

These requirements are not theoretical — they address real attack vectors. Default credentials and unencrypted streams are the two most commonly exploited entry points in IP camera breaches. Unsigned firmware enables persistent malware. Disabled debug ports prevent on-device tampering after deployment.

Before vs. After April 2026: What Actually Changed

Dimension — Before 1 April 2026 — After 1 April 2026

Non-certified camera new sales — Permitted — Not legally permitted without STQC cert

Existing installed cameras — Operational — Continue to operate (rule is not retroactive)

Government procurement — Largely uncertified — STQC certification mandatory

Indian brand market share — ~33% — 80%+ (post-mandate estimate)

Certification verification — No central check — Verify at crsbis.in / stqc.gov.in

Are Existing Cameras Affected?

No. The mandate is prospective, not retroactive. Cameras that were purchased and installed before 1 April 2026 may continue to operate legally. Organizations are not required to replace existing infrastructure.

However, organizations running older, uncertified hardware should consider two practical points:

1. Security posture: Cameras lacking the six ER-01:2024 controls are more exposed to the attack classes those controls address.

2. Future procurement: When expanding or replacing cameras, new purchases must be STQC-certified, which may create a mixed-estate management consideration.

Who Is Most Affected?

Government and PSU Buyers

New procurement rules for central and state government, defence, and public sector undertakings require STQC-certified hardware. Non-certified cameras cannot be specified in new tenders from April 2026 onwards.

Private Enterprises and Residential Projects

Technically, the BIS mandate applies to all sales in India, not just government. A retailer selling uncertified stock after the deadline is non-compliant. Channel partners and importers who did not transition to certified product pipelines before the cut-off face legal exposure.

System Integrators

Integrators who specify or install non-certified cameras on new projects after the deadline carry compliance risk, particularly on government, banking, or critical-infrastructure contracts.

What Does "CCTV Brands That Have Not Completed STQC Certification" Mean for Buyers?

The certification requirement is brand-agnostic. Several major imported camera brands — including some that previously held large market share in India — did not complete STQC certification under ER-01:2024, and new units of their CCTV products therefore cannot be legally sold in India from April 2026. The market shift from roughly one-third domestic share to over 80% reflects the scale of this transition. Buyers should verify any brand's current certification status on the official portals before purchasing.

Certified Alternatives: What to Look For

Buyers who need STQC-compliant cameras have a growing list of certified options. Before purchasing, verify any claimed certification number on the official portals: crsbis.in (BIS) or stqc.gov.in (STQC).

ArcisAI

ArcisAI is an Indian AI-first surveillance brand building hardware and software certified under the new framework. Their cameras carry BIS-ER certification (reference: R-72003735 ER01:2024) and their Video Management System (VMS) holds STQC certification. The platform is NDAA compliant and Made in India. Key differentiators include edge AI with eight onboard detection types and ArcisGPT, a natural-language interface for searching and querying footage. For organisations moving to a fully certified, AI-capable stack, ArcisAI offers certified hardware, certified VMS, and integrated analytics — without reliance on overseas chipsets or external cloud infrastructure.

Other Certified Indian Brands

• CP Plus — The largest Indian CCTV brand by volume; wide product range across segments.

• Prama — Indian manufacturer with a focus on HD and IP cameras.

• Matrix — Pune-based brand strong in enterprise and access-control integration.

• Sparsh — Domestic manufacturer serving both commercial and government verticals.

• HiFocus — Chennai-based brand with an established government supply track record.

Always request the BIS-ER or STQC certificate number from your vendor and cross-check it on the official portals before committing to a purchase or specification.

How to Verify a CCTV's STQC Certification

1. Ask your vendor for the BIS Registration Number or STQC Test Certificate number.

2. Visit crsbis.in and search by registration number or product category.

3. Confirm the certificate is valid (not expired), covers the specific model, and references ER-01:2024.

4. Optionally cross-check at stqc.gov.in for STQC-specific test reports.

If a vendor cannot provide a verifiable certificate number, treat that as a red flag.