Product Compliance And Certification For Security Camera In China

Scope and evidence must be confirmed before any paid tests or filings.

China does not operate one universal “security-camera certificate”. A wired IP camera, a Wi-Fi baby monitor, a 4G solar camera and an explosion-protected CCTV unit can have different market-entry gates. Resolve the actual China-market SKU and its accessories before ordering any certification.

Freeze the camera configuration before classifying it

Use the following five-field intake for each model and bundle. A marketing description such as “smart CCTV” is not a legal product classification. Keep the China domestic SKU separate from export-only models.

Exact model, OEM/brand and China packaging; wired, Wi-Fi/Bluetooth or SIM/eSIM
Power arrangement: PoE, mains adapter, standalone lithium battery, or bundled power bank
RF module, frequency bands, antenna gain and enabled firmware region
Use case: consumer home, enterprise facility, public-safety system or explosive atmosphere
Recording destination: SD/NVR, local server, China cloud or overseas cloud; app and biometrics

China security-camera regulatory decision matrix

An entry marked “check” is a classification trigger, not a conclusion that a licence applies. Multiple rows may apply simultaneously; a voluntary label cannot replace a mandatory approval.

Trigger / layer	Applicability question	Evidence and decision
CCC (mandatory only in catalogue)	Is the camera explosion-proof monitoring equipment (2309), or is an in-scope power accessory included?	Match physical construction and end use to SAMR catalogue definitions; confirm CCC for each in-scope item.
SRRC / MIIT radio type approval	Does the finished camera transmit over Wi-Fi, Bluetooth, LTE/5G or other licensed radio categories?	Frequency/antenna/module report, approved model conditions and CMIIT marking review.
Telecom NAL	Does a cellular-enabled configuration fall within the published public-telecom terminal directory?	Classify whole-device network functionality and obtain an equipment-category decision.
China RoHS	What hazardous-substance disclosure applies now; is this an image-capture camera covered by the 2027 gate?	Parts declarations, EFUP/marking; plan substance conformity and platform reporting if in scope.
Consumer cybersecurity label	Standalone consumer internet camera, and does the brand elect the voluntary scheme?	Security assessment level, eligible tests, producer filing, correct label use.
Public-safety video deployment	Will the equipment form part of a system defined by the 2025 State Council regulation?	Specify supplier versus system-operator duties; installation, signage, filing/retention by the correct party.
Video/data processing	Does a vendor, operator or app process identifiable images, voice or biometrics?	Privacy role map, notices, storage/access controls, cloud and transfer assessment.

When CCC is—and is not—the camera route

The SAMR/CNCA CCC catalogue is product-code and scope based. An ordinary indoor IP/CCTV camera is not automatically a CCC-listed item just because it is electronic or marketed for security. In contrast, explosion-proof monitoring equipment appears as category 2309; classify a camera intended for explosive atmospheres against that scope. Recheck catalogue updates and the precise model before stating CCC is required or exempt.

The CNCA page updated in August 2026 is an implementation-rule index, not a stand-alone replacement for the legal catalogue’s scope descriptions. Its summary lists 17 major classes and 106 product types, including explosion-proof monitoring equipment (2309). For a definitive CCC decision, read SAMR’s 2023 scope/delimitation notice together with the subsequent SAMR catalogue-extension notices identified in the CNCA index, and check the applicable product-specific implementing rule. Do not classify by the camera’s marketing name or treat a rule index as a certificate.

Assess accessories separately: an AC/DC adaptor, plug assembly, portable battery or packaged power bank may have its own CCC or other requirements depending on its defined scope. A camera’s own non-CCC outcome does not clear its charger, power supply or separately marketed battery. For the wider electronic-product boundary see China electronic-product classification; for separately sold power banks see China power-bank scope.

Radio approval and public-network access are separate questions

A camera transmitting over Wi-Fi, Bluetooth or cellular radio triggers a radio-frequency assessment. MIIT Order No. 57 generally requires radio-transmitter model approval for listed transmitters other than qualifying micro-power short-range devices. Confirm bands, output power, antenna, approved module/host conditions and CMIIT ID marking before claiming any exemption. A pre-approved module does not automatically establish that every finished camera configuration is cleared.

MIIT's 2014 module notice distinguishes a complete non-standalone transmitter module from a restricted module. Where a camera integrates an approved complete module within its specified conditions, the notice requires the device label or instructions to identify the module's CMIIT ID; do not automatically demand a duplicate host approval on that fact alone. An independent camera containing a restricted module instead needs finished-device type approval under that notice, with specified reduced testing if the module is approved. Verify the module class, integration, antenna and any later applicable measures before signing off.

Telecom network-access permission (NAL) is a distinct catalogue test for equipment accessing public telecom networks; Ethernet or ordinary Wi-Fi alone does not establish that test. For an integrated SIM/eSIM 4G/5G camera, record the precise terminal category and obtain a written NAL scope decision for the finished product, rather than assuming approval of its cellular module is sufficient or that every LTE camera needs the same licence. Compare the mobile-terminal route at China mobile-terminal route.

A further downstream check belongs to the seller: MIIT Order 57 Article 23 requires a radio-equipment sales filing for equipment that must obtain type approval. MIIT guidance distinguishes OEM manufacture without direct sales from a manufacturer, importer or dealer actually selling a covered model. Record which entity will file; this is not a substitute for product approval.

China RoHS: the camera-specific 2027 transition

China RoHS information/marking duties under MIIT Order No. 32 apply to electrical/electronic equipment within its scope independently of whether a model is in the conformity-assessment catalogue. Collect a material-declaration table, environmental-use-period decision and correct Chinese markings for the camera and relevant supplied accessories.

The 2026 RoHS catalogue brings image/video/audio-capturing cameras within the “monitoring equipment” scope, with the additional substance-limit and conformity-assessment step scheduled for 1 August 2027 for those cameras. The 2026 rules and MIIT explanation distinguish this future gate from the existing marking duties. Plan for GB 26572—2025, ten controlled substances, approved exceptions and an appropriate certification or self-declaration with results uploaded to the China RoHS platform when applicable; do not claim that this 2027 requirement already applies to every camera sold today.

Voluntary cybersecurity star label for consumer internet cameras

The June 2026 CAC/MIIT/MPS cybersecurity-label rules cover standalone internet-connected consumer cameras, not cameras for the public-security field. Producer participation is voluntary. If chosen, evidence follows TC260-PG-20265A, a one-, two- or three-star level, assessment/filing and a three-year label term; this is not CCC, SRRC or mandatory certification for every network camera. Track firmware, chips, communications modules and access configuration against the voluntary scheme’s test-unit and re-filing rules.

Public-place camera deployments: installation, retention and privacy boundaries

The State Council public-safety video-system regulation, effective 1 April 2025, regulates defined deployments in public places, including system management, signs, filing and storage. Its 30-day minimum retention rule concerns qualifying public-safety systems; do not impose it as a blanket requirement on every consumer camera. Supplier obligations such as avoiding malware and fixing vulnerabilities may arise when serving those systems.

Installation authority is a separate go/no-go question. Under Article 7, only the designated government bodies or the management entities responsible for the listed venues may install the specified public-safety cameras; Article 9 restricts installations in other public places to parties that owe security duties for those places, where necessary for public safety. Article 8 prohibits cameras inside hotel/guest rooms, dormitory or employee accommodation rooms, public bathrooms, toilets, changing rooms, nursing rooms, fitting rooms and other privacy-intrusive positions. Identify the exact location and legally authorised installer before configuring or accepting a deployment.

The 30-day minimum is more narrowly scoped than a general 'public-place camera' rule. Article 17 applies to the public-safety systems covered by the regulation, but Article 9 expressly removes Article 17's mandatory requirement for cameras installed in other public places outside Article 7 under that article's conditions. For Article 7 systems, Article 14 generally requires filing by the managing unit within 30 days after activation; Article 17 also requires deletion after 30 days once the processing purpose is achieved, absent a different statutory period. Establish the venue, Article 7/9 route and responsible operator before prescribing storage or filing.

Under the Personal Information Protection Law, the party processing identifiable video must assess its lawful basis, notice, access controls, storage, and where relevant a cross-border data route. Article 26 particularly restricts image capture in public places and requires prominent signage. A device certificate cannot legalise unlawful placement or data processing; map cloud hosting and mobile-app roles separately.

In public places, PIPL Article 26 also limits the use of captured personal images/identification information to public-safety purposes, unless the individual gives separate consent. This does not override the installation prohibitions or other requirements; a commercial analytics use needs its own legal assessment.

Release dossier: evidence, owner and go/no-go gate

Before the first China shipment or domestic listing, obtain a signed classification memo and a model-specific release pack. “Not applicable” should be documented with the facts and catalogue version used, not left blank.

Release gate	Document to retain	Decision owner
SKU and CCC scope	Photo/nameplate, BOM, power-bundle list, catalogue-code reasoning; supplier certificates only where relevant	Manufacturer + China importer
Wireless / NAL	RF test design, module-to-host mapping, CMIIT evidence; NAL directory memo for SIM models	Radio lead + telecom reviewer
RoHS and marking	Materials/hazardous substances table, EFUP label artwork, 2027 gap plan and exceptions	Quality / materials owner
Cloud / deployment	Data-flow diagram, video retention settings, operator roles and public-place use controls	App provider + deploying operator
Launch sign-off	Chinese nameplate/instructions, variant register, evidence links, open issues and release decision	Accountable market operator

Keep approvals aligned with variants and foreign markets

For each change, ask whether RF parameters, antenna/module, chip, firmware, encryption, storage/cloud destination, power source or intended installation alters an earlier conclusion. Record the decision and seek reassessment where required; certification and labelling cannot safely be copied across unexamined variants.

RF band, antenna or transmitter module changes
New SoC, firmware, cloud endpoint or access-control scheme
Switch between PoE, mains adapter, battery or bundled accessories
Repositioning from domestic consumer use to regulated public-security or explosive-area deployment

This is a China-specific cross-regime route map, not a generic electronics certificate tutorial or an export checklist. Review the wider China electronic-product classification page for broad device scope, the China mobile-terminal route page for telecom-terminal boundaries and the UK security-camera route page if the same camera will be sold in the UK; none of those pages substitutes for a China SKU decision.

Security-camera compliance FAQ

Does a wired PoE CCTV camera need CCC?

Not solely because it is a security camera. Test its specific catalogue entry and included power accessories; explosion-proof variants may trigger a separate CCC category.

Is the SRRC approval of a Wi-Fi module enough?

Not by itself and not always insufficient. Under MIIT's module notice, an approved complete module integrated within its conditions can follow the module-ID labelling route, whereas a restricted module generally requires type approval of the finished camera. Check module class, antenna and integration evidence.

Does adding a 4G SIM create a telecom licence requirement?

It triggers a separate check against the NAL equipment directory and whole-device function, alongside radio approval; the SIM alone is not a legal classification.

What changes for cameras on 1 August 2027?

The 2026 China RoHS catalogue schedules substance-limit conformity assessment for image/video/audio-capture cameras in the monitoring-equipment category; existing RoHS information marking should already be assessed.

Is the new China cybersecurity star label compulsory?

No. Under the 2026 consumer connected-camera rules producer participation is voluntary, and the scheme excludes public-security cameras. If used, test, filing and label claims must follow the published rules.

Must every camera store footage for at least 30 days?

No. Article 17's 30-day minimum applies to covered public-safety systems, while Article 9 excludes that specific duty for qualifying installations in other public places. Ordinary home cameras have no blanket 30-day duty under this regulation; assess the venue and separate privacy rules.