What’s changing in CCTV specs and compliance

What’s changing in CCTV specs and compliance

What’s changing in CCTV specs and compliance

CCTV has moved on from “pick a camera, stick in a recorder, job done”. The expectations are higher, the technology is smarter, and the compliance bar is firmer — especially on commercial sites where evidence quality, cyber risk, and privacy obligations all sit in the same conversation.

For installers and specifiers, the challenge isn’t keeping up with every new feature. It’s knowing which spec changes genuinely matter, and which compliance shifts can bite later if they’re ignored up front.

What follows is a practical, installer-friendly view of what’s changing — and how to stay ahead.

Specs are shifting from “megapixels” to usable evidence

Resolution still matters, but the industry is increasingly focused on whether footage is usable: facial detail where it’s needed, clear motion at night, and stable recordings that stand up when exported.

That’s why many installs now start by choosing the right tier for each zone:

The trend is simple: instead of over-specifying everything, sites are being designed with “evidence points” in mind — entrances, chokepoints, tills, loading bays — and then broad coverage elsewhere.

Low-light performance is becoming a headline requirement

Customers don’t judge a system at midday — they judge it at 2am. Low-light performance is now one of the most common “why doesn’t it look like the demo?” complaints, which is why more specs call out minimum illumination, smart IR behaviour, and real-world night colour performance.

This has helped drive demand for specialist low-light lines such as Colourvision ↗, plus smarter deterrence-focused kit like Active Deterrence Cameras ↗ where the site needs prevention, not just recording.

AI and metadata are moving from “nice-to-have” to expected

Analytics used to be a premium add-on. Now, even mid-range jobs regularly ask for human/vehicle filtering, line crossing, intrusion, and smart searching.

This shift is also reflected in open standards. ONVIF’s newer profiles increasingly focus on metadata and analytics configuration, not just basic streaming. For example, ONVIF Profile M is built around analytics metadata and related queries/streams. 

On the hardware side, installers are often pairing analytics-capable cameras with NVRs built for higher throughput and smarter event handling, using ranges like IP CCTV Cameras ↗ and IP CCTV NVRs ↗.

Compression and retention are being specced more tightly

More detail means more data. That’s pushed two practical changes:

1) Storage conversations happen earlier.
Retention is now often contractual (7/14/30/90 days) and tied to compliance requirements, insurance, or incident response policies.

2) Surveillance-grade storage is assumed.
Consumer drives failing under 24/7 write loads is still one of the biggest causes of “system issues”. That’s why installers increasingly standardise on Hard Drives ↗ built for continuous recording.

PoE power and network design are now part of the spec (not just the install)

As cameras add IR, heaters, microphones, PTZ motors, and AI processing, power draw becomes less forgiving. The result is a noticeable shift toward clearer PoE requirements and better switch selection.

At the standard level, PoE has evolved to deliver far more power over Ethernet than the original PoE generations, with IEEE 802.3bt (often referred to as PoE++) supporting significantly higher device power than earlier standards. 

In real installs, that translates into:

  • choosing the right POE Switches ↗ with proper power budget headroom

  • planning for distance properly (rather than hoping a long run behaves), sometimes using a POE Extender ↗

  • avoiding “mystery faults” caused by underpowered night mode or poor cabling/terminations

On larger sites, this matters as much as camera selection, especially when the customer expects stable uptime across dozens of channels.

Compliance is changing too — and it’s not just “put a sign up”

UK privacy expectations are clearer (and enforcement risk is real)

In the UK, CCTV is firmly treated as a personal data issue when people can be identified. The ICO’s guidance is explicit about building CCTV that is necessary, proportionate, and managed properly, including signage, retention, and handling requests. 

For installers, this doesn’t mean becoming a data protection officer. It means making sure the customer understands the practical obligations they’re signing up to:

  • define the purpose (crime prevention, staff safety, access control, etc.)

  • avoid excessive coverage (especially private areas)

  • set sensible retention (not “keep everything forever”)

  • control access to footage and exporting

  • be able to respond to subject access requests where relevant 

Signage is part of that. Many sites now treat signage as a procurement checklist item rather than an afterthought, using products like a CCTV Warning Sign ↗.

Standards-based specification is becoming more common on commercial jobs

A noticeable trend (especially in larger tenders) is referencing recognised CCTV standards for performance, commissioning, and documentation. In the UK, BS EN 62676 is frequently referenced as a framework for agreeing system requirements and performance expectations. 

The practical benefit is that it pushes projects toward clearer definitions:

  • what image quality is required (detection/recognition/identification style outcomes)

  • how the system will be tested and signed off

  • how performance is maintained over time

That reduces disputes later, because “good enough” is agreed and measured.

Supply-chain compliance is now a buying decision: NDAA and restricted equipment

Even UK-based projects are increasingly influenced by US-linked procurement rules, global supply chain policies, and client requirements. “NDAA compliant” often comes up when a customer has US funding, US contracts, or policies that mirror US restrictions.

NDAA Section 889 is widely referenced in relation to restrictions on certain covered telecoms and video surveillance equipment in US federal procurement contexts.

For installers, the key point is not the politics — it’s the risk: if NDAA compliance is required and the wrong kit is specified, it can mean replacement, not repair. FVS CCTV addresses this area directly via its NDAA Compliant CCTV ↗ guidance. 

Cybersecurity expectations are rising (default passwords are under the microscope)

Cameras and recorders are network devices, and more customers now ask about:

  • password policies and credential management

  • firmware update support and lifecycle

  • vulnerability reporting and patching

  • remote access security

In the UK consumer space, government-backed requirements have pushed minimum security expectations around default passwords, vulnerability disclosure, and transparency about security updates.

Even where a site isn’t strictly “consumer”, these expectations spill over into commercial procurement policies — because nobody wants a cheap camera becoming the weak point in the network.

What installers are doing to stay ahead

The firms seeing fewer call-backs and fewer compliance headaches tend to follow a simple playbook:

CCTV specs and compliance are moving in the same direction: better evidence, smarter searching, stronger security, and clearer accountability. Installers who adapt early don’t just “tick boxes” — they deliver systems that perform properly, get signed off faster, and create fewer headaches later.

For installers planning a large rollout, the safest route is to spec a stable, compatible build from the start — IP CCTV Cameras ↗, IP CCTV NVRs ↗, POE Switches ↗, Surveillance Hard Drives ↗, plus the right CCTV Accessories ↗.

If a big install is coming up and the kit list needs tightening, FVS CCTV can help installers choose the right products, avoid compatibility surprises, and deliver a system that works first time — and keeps working.