Regulation · India · CCTV Compliance

BIS ER-01 / MeitY Essential Requirements: What CCTV Buyers Must Do Now That Enforcement Is Live

Since 1 April 2026, BIS ER-01 compliance is mandatory for every CCTV camera sold in India. MeitY's Essential Requirements make STQC-tested, BIS-registered cameras the only legal purchase. Buyers must verify the BIS CRO registration and ER-01 test evidence for each model, write compliance into purchase orders, and reject uncertified stock.

Dr. Vivek Gujar · 14 July 2026 · 12 min read

For two years, the CCTV industry treated India's camera security mandate as a moving deadline — notified, extended, relaxed, extended again. That era is over. On 16 January 2026, the Ministry of Electronics and Information Technology (MeitY) issued an Office Memorandum withdrawing the last remaining relaxation. From 1 April 2026, no CCTV camera that fails to conform to the notified Essential Requirements can be sold in India — not by manufacturers, not by importers, not by the dealer clearing "old stock" at a discount.

Enforcement is now live. If you are specifying, procuring, or expanding a video surveillance system anywhere in India — a factory in Chakan, a retail chain, a housing society, a government tender — this article tells you what changed, what ER-01 actually tests, a paradox inside the certificate that almost nobody discusses, and the checklist to run before you sign any purchase order. Every regulatory claim is sourced at the end.

Three ways to read one regulation

On paper, ER-01 is a cybersecurity rule. In practice, it is three policies wearing one gazette notification — and a buyer who understands all three will negotiate better than one who sees only the first.

Reading one: a security floor for the internet's softest target

Networked cameras have a specific, well-earned reputation in security circles. In 2016, a botnet assembled largely from hijacked cameras and video recorders — devices running default passwords and unpatched firmware — briefly broke large sections of the global internet in one of the biggest denial-of-service attacks ever recorded. The cheapest camera on the market has, for a decade, been one of the cheapest ways into a corporate network. ER-01's answer is blunt: minimum device security is no longer a premium feature; it is a condition of market access. A camera that cannot prove it resists compromise cannot legally be sold.

Reading two: a passport for cameras

The most consequential line in ER-01 is not about encryption. It is the requirement that a camera's certificate record the make and origin of its chipset, plus its exact firmware version and hash. Every certified camera now carries, in effect, a passport — a verifiable declaration of where its silicon was born and what code it runs. India is among the first large markets in the world to make this disclosure a condition of sale. Whatever else the regulation achieves, it has permanently ended anonymous hardware.

Reading three: a market restructured in eighteen months

The enforcement deadline coincided with — and accelerated — a historic shift in market share. Chinese brands accounted for roughly a third of Indian CCTV sales as recently as a year before enforcement; by early 2026, industry research put Indian manufacturers at more than 80% of the market, built on redesigned supply chains, non-Chinese chipsets, and localised firmware. The overall India video surveillance market — roughly USD 4.40 billion in 2025 and forecast to reach USD 7.12 billion by 2030 at a 10.1% CAGR — now flows almost entirely through certified, disclosed, domestically accountable hardware.

You do not have to pick a reading. All three land on the same desk: the buyer's. The security floor changes what you must verify, the passport changes what you can demand to see, and the market restructuring changes who you will be buying from.

The timeline: how a deadline became a hard wall

Note the subtlety in the final row: even stock imported or manufactured before April 2025 must now meet the Essential Requirements to be sold. "We imported it before the deadline" is no longer a legal basis for sale. If a quote today includes uncertified hardware, the supplier is offering you a product that cannot lawfully change hands.

What ER-01 actually tests inside the camera

ER-01 is not a paperwork exercise. STQC labs — 14 of them are recognised by BIS for this testing — evaluate physical samples, including engineering boards with access probes, against a defined methodology. The requirements fall into five broad areas:

1. Hardware-level security

The device must resist physical attack: tamper resistance and tamper detection, a hardware root of trust (a TEE, Secure Element, or TPM), secure boot that validates the boot image signature before loading, and cryptographic keys that are unique to each individual device — so compromising one camera does not compromise the fleet.

2. Software and firmware security

Firmware must enable memory protections (ASLR and DEP), updates must be cryptographically signed and protected against rollback to older vulnerable versions, and the lab checks for hardcoded credentials and banned code — the classic weaknesses behind most camera botnets.

3. Secure communication

Data in transit must be encrypted using strong TLS, communication channels must support mutual authentication, only standard documented protocols are allowed, and open ports must be justified. The lab literally scans the device and asks the vendor to defend every listening service.

4. Access control

Authentication is mandatory, with role-based access control and no universal default passwords — the vulnerability that made older CCTV estates trivially harvestable.

5. Supply-chain transparency

This is the passport described above. Vendors must demonstrate trusted component sourcing, and the issued certificate records chipset make and origin, firmware version, and hash. Under the series guidelines, every model in a certified series must use the same SoC and the same firmware hash — a different firmware build is treated as a different product.

The paradox inside the certificate

Here is the part of this regime that procurement teams have not yet metabolised — and the reason a certificate should start a conversation with your vendor rather than end one.

The ER-01 certificate freezes a moment in time: it records the exact firmware version and cryptographic hash of the build that passed the lab. But ER-01 also mandates a secure, signed update mechanism — because everyone involved knows that unpatched firmware is precisely how cameras get compromised. Read those two requirements together and you find a genuine tension: the certificate certifies an artifact whose security depends on that artifact changing.

This is not a flaw unique to India — every device-certification regime in the world wrestles with it — but it has a practical consequence for buyers. It creates a quiet incentive problem: a vendor who ships security patches promptly must also keep documentation aligned with the new build, while a vendor who sits on patches keeps tidy paperwork and a slowly rotting fleet. The mark on the box tells you the camera was secure on the day it was tested. It does not tell you the camera is secure today.

So add one question to every vendor conversation, and watch how it is answered: "When you release a security patch for this certified model, what is your process — and how quickly does your compliance documentation catch up?" A vendor with a disciplined patch-and-realign pipeline will answer in specifics. A vendor who treats the certificate as a one-time event will change the subject. That single question separates compliance culture from compliance theatre better than any datasheet.

Five myths that will get a procurement team in trouble

How to Verify BIS ER-01 Compliance Before You Buy

Here is the seven-step verification workflow we recommend to system integrators and facility teams. It takes minutes per model and can save a project from stranded, unsellable, or unsupportable hardware.

The part ER-01 does not cover: your data

Here is the distinction that most buying conversations still miss. ER-01 secures the device. It says nothing about what you do with the footage.

India's surveillance compliance now has two layers, and they map cleanly onto the two layers of any modern video system:

Buying a certified camera gives you a compliant capture layer — and nothing more. If that camera streams identifiable footage to an analytics stack with no retention policy, or to processing outside your control, the device certificate will not help you in a DPDP inquiry.

This is where architecture matters. An edge-first intelligence layer — processing video on-site, next to the cameras, rather than shipping raw footage out — keeps the data-protection surface small and auditable. It is the design principle behind IndoAI's Appization platform: a programmable layer of installable AI apps that connects to any ONVIF/RTSP-compliant camera estate, including the newly certified Indian brands now dominating the market, and including the cameras you already own.

That last point deserves emphasis, because it is the good news inside this regulation. Since the mandate restricts sale rather than operation, your installed estate is a legitimate foundation — you can add modern AI capability to it today, and apply the ER-01 checklist only to the cameras you buy from here on. Regulation-driven panic replacement is rarely necessary; regulation-aware procurement always is. Teams running manufacturing sites in particular can phase hardware refresh across budget cycles while the intelligence layer stays constant above it.

The bottom line for buyers

ER-01 enforcement is the best thing to happen to Indian CCTV procurement in a decade — it converts a race-to-the-bottom hardware market into one where security is a legal floor, not a premium feature. But the burden of verification sits with you. From 1 April 2026, four habits protect every project: demand the registration and test report per model, contract for compliance in the PO, ask the patching question, and treat device certification and data protection as two separate questions — one answered by the camera you buy, the other by the intelligence layer you run above it.

Frequently asked questions