Most product categories are decided by price, specification and lead time. Security and surveillance is decided by something that comes first: whether the hardware is allowed to be sold in the market you are aiming at.
That is not a compliance detail to be settled later. It is the first question, because the answer changes which factories you can buy from, which brands you can put on the product, and in some markets whether the product can be placed on the market at all. A quotation for a camera that cannot legally be installed is not a cheap quotation. It is not a quotation.
This is the category guide to that question. For the general certification file that applies to any electronic import, the marks, the issuers and how to verify them, our compliance guide covers that ground. What follows is specific to surveillance hardware, where the restrictions are written against named companies rather than against product types.
Eligibility Comes Before Price
The rules in this category do not ban a kind of product. They restrict equipment associated with particular companies, which is a harder thing to design around.
- · A camera is not restricted because it is a camera. It is restricted because of who produced it or who is related to the producer
- · That means two physically similar units, from two factories, can have entirely different market access
- · The restriction can travel with the brand rather than the factory, since the same production line supplies several brands
- · Once a market has restricted a company, units already installed can become a problem rather than just new purchases
- · The practical consequence for a buyer: the supplier questionnaire comes before the price comparison, not after
- · The commercial consequence: a slightly more expensive camera with clean provenance is cheaper than a slightly cheaper camera that cannot be listed or installed
The US Federal Rule: Section 889
The United States restricts this category through Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019, Public Law 115-232. The operative text is implemented in the Federal Acquisition Regulation, and the clause worth reading directly is FAR 52.204-25.
- · Section 889(a)(1)(A) prohibits the head of an executive agency, on or after 13 August 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system
- · Section 889(a)(1)(B) extends the prohibition, on or after 13 August 2020, to contracting with an entity that uses such equipment in its own operations, whether or not that use is in performance of work under a federal contract
- · Grant and loan recipients are covered through the provision added at 2 CFR 200.216, effective from 13 August 2020
- · The named companies are Huawei and ZTE for telecommunications equipment, and Hytera, Hangzhou Hikvision Digital Technology and Dahua Technology for video surveillance and telecommunications equipment, together with their subsidiaries and affiliates
- · The definition does not stop at those five names. It also reaches equipment or services produced by any entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation, reasonably believes to be owned or controlled by, or otherwise connected to, the government of a covered foreign country, which the clause defines as the People's Republic of China
- · That fourth limb is the one buyers underestimate. It means the covered list is open rather than closed, so avoiding five known names is not a compliance method
- · Note the phrase substantial or essential component, defined as any component necessary for the proper function or performance of a piece of equipment, system or service. It reaches equipment embedded inside a larger system, not only equipment sold under its own name
- · The representation and reporting obligations appear in FAR 52.204-24 alongside the prohibition in FAR 52.204-25. Where a contractor identifies covered equipment during performance, the clause requires a report within one business day, with further detail within ten business days, and the substance of the clause must be passed down to subcontracts
What Section 889 Actually Prohibits
- · Procuring or obtaining the covered equipment, and extending or renewing a contract that would procure or obtain it
- · Using the covered equipment in a contractor's own operations, which is the provision that catches buyers who are not themselves federal agencies
- · Using federal loan or grant funds to procure the covered equipment
- · It does not prohibit manufacturing the equipment, or selling it into markets outside the United States
The Certificate That Does Not Exist
This is the point where buyers most often lose money, so it is worth stating plainly.
- · Neither Section 889 nor the FAR clauses create an official certification scheme for products
- · There is therefore no such thing as an official certificate that a camera is compliant with Section 889
- · What exists instead is a representation made by an offeror, and for grant recipients a certification of compliance on accepting an award
- · Those obligations attach to the transaction and the organisation as well as to the equipment
- · A supplier document described as an NDAA certificate is therefore a supplier's own declaration with a strong-sounding name, not a government issued document
- · This does not make it worthless, but it changes what it is worth. The question to ask is which company produced the equipment, not which certificate accompanies it
- · A useful discipline: ask for the manufacturer chain in writing, from finished unit back to the module and chip suppliers, and treat the answer as a document you can rely on
The Brand Behind the Badge
A camera carries a brand on the housing. That brand is frequently not the company that produced the hardware.
- · Companies named under Section 889 have produced hardware sold under many other brand names, a point repeatedly raised by compliance advisers working in this category
- · Because the restriction follows the producer and its subsidiaries and affiliates rather than the label, a clean-looking brand is not evidence of clean provenance
- · OEM and ODM arrangements make this structural rather than accidental. A factory that supplies several brands may supply units from the same line to different programs
- · The risk is inherited downstream. The importer who receives the goods carries the consequences of a restriction that was created further up the chain
- · The practical control is documentary: a manufacturing chain disclosure, a factory audit that includes a supplier list, or both
Why a Factory's Order Book Matters to You
- · If a factory's principal customers include companies named under a restriction, some of its production capacity is dedicated to those programs
- · That does not automatically taint other programs, but it means the factory has the capability and the relationships to produce covered equipment
- · It also means the factory's own component sourcing may be shared across programs, which is where a substantial or essential component question can arise
- · A supplier that can describe its customer segmentation clearly is easier to rely on than one that cannot
- · Worth asking directly: does any line in this factory produce equipment for a company named under Section 889, and if so is the production physically segregated
The FCC Equipment Authorisation Route
The second US gate is different in kind. It does not restrict who may buy the product. It restricts whether the equipment can be authorised for sale at all.
- · Radio frequency devices placed on the US market generally require an equipment authorisation from the Federal Communications Commission, obtained through the certification or supplier declaration routes
- · The FCC has acted to remove equipment authorisations for video surveillance equipment from named Chinese manufacturers on national security grounds
- · The consequence is a device that cannot lawfully be marketed in the United States regardless of who the intended customer is
- · This is a market access restriction rather than a procurement restriction, so it reaches consumer and commercial sales, not only federal projects
- · For a buyer, the verification point is the equipment authorisation record rather than a supplier statement. A certification route device carries an FCC identifier that can be checked in the Commission's public database
- · Where a supplier cannot produce an authorisation record for the specific model, that is the answer, regardless of what the specification sheet says
India's STQC Requirement
The third gate is the newest, and it shows how quickly this category can change.
- · From 1 April 2026, only models holding STQC certification may legally be sold or installed in India
- · The requirement is reported to cover certification of components together with security testing, rather than a self-declaration
- · Internet connected CCTV cameras from Hikvision, Dahua and TP-Link are among those affected
- · The measure has been reported as a market reset for the category in India rather than a minor administrative change
- · For a buyer, the practical reading is that a market which accepted unrestricted imports can close within a single certification cycle
- · The strategic reading is that market access in this category is a moving target, so a supplier relationship that cannot document the manufacturing chain will keep producing this problem in new markets
What This Means for Which Markets You Can Serve
The three gates do not apply uniformly, and that produces a market map rather than a single answer.
- · United States federal and federally funded projects: Section 889 applies to procurement and to use, so both new purchases and existing installations are caught, and the organisation as well as the equipment
- · United States commercial and consumer sales: Section 889 does not apply, but the FCC equipment authorisation requirement does, which is a separate and independently binding gate
- · India: the STQC certification requirement applies to sale and installation, so it binds commercial channels as well as public projects
- · European Union and United Kingdom: no equivalent named-company prohibition of the Section 889 type at present. The ordinary requirements apply, including conformity marking, and procurement terms set by individual buyers and public bodies may add conditions
- · Middle East, Africa, Latin America and much of Southeast Asia: generally open on the named-company question, though public sector tenders increasingly carry their own security conditions
- · The pattern to notice: the restriction usually arrives first through public procurement, then through certification, then through commercial channels in that order
- · The practical consequence for a supplier relationship: provenance documentation is worth having before it is required, because it is much harder to reconstruct after a restriction appears
The Market Read
- · Selling into US federal or federally funded work requires equipment with a documented manufacturing chain and no association with the named companies, and that documentation must survive scrutiny
- · Selling into US commercial channels requires a valid equipment authorisation for the specific model, and the identifier can be checked independently
- · Selling into India requires STQC certification for the model, so the supplier must be able to hold that certification rather than merely pass a test
- · Selling into markets without a named-company rule is a legitimate business, and the same hardware often qualifies, which is why the category is viable rather than closed
- · The mistake to avoid is buying once for one market and assuming the same purchase order can later be pointed at another market
Technical Questions That Decide the Order
Once eligibility is settled, the technical questions are the ones that determine whether the installation works and whether the buyer can expand it later.
- · Sensor, lens and resolution: state the required resolution for identification rather than for viewing, since the two imply very different specifications
- · Low light performance: the minimum illumination figure and the shutter behaviour in low light determine whether night footage is usable
- · Power: PoE versus separate supply changes the cabling plan, and the number of ports becomes the limiting factor in an installation
- · Storage: on board card, network recorder or cloud, and the retention period the buyer actually needs
- · Ingress protection: the IP rating has to match the mounting position, since an indoor unit mounted outdoors fails quickly
- · Firmware and update policy: who issues updates, for how long, and whether a vulnerability response process exists
- · Spare parts and model continuity: whether the same model will still be supplied in a year, since mixed installations create support problems
Protocol Openness and the Lock-In Question
This is the specification item that most often decides whether a buyer can grow the system.
- · Open standards for IP cameras allow units from different manufacturers to work with a common recorder and management platform
- · Where the recorder accepts only units from the same vendor, the buyer has bought a system rather than a camera, and every future addition comes from one source
- · For an integrator this matters commercially as well as technically, because it determines what can be specified later
- · Worth confirming in writing: the recorder's supported device list, and whether the units will function with third party management software
Cloud, Storage and Data Jurisdiction
Where the footage is stored matters as much as where the camera was made, and it is often overlooked in the purchasing decision.
- · Cloud connected cameras send footage or metadata to a service, and the location of that service determines which law governs it
- · A buyer whose customers are public bodies or regulated industries will often be asked where the data resides
- · Local storage avoids the question entirely, which is one reason on premises recording remains common in sensitive settings
- · Where cloud is required, the supplier should be able to state the region of the service and whether local storage options exist
- · For an integrator, being able to answer this question in a tender is frequently the difference between qualifying and not
FAQ
Can I sell Chinese surveillance cameras in the United States
For federal and federally funded work, no, if the equipment is produced by a company named under Section 889 or its subsidiaries or affiliates. For commercial and consumer sales, yes, provided the specific model holds a valid FCC equipment authorisation. The two gates are independent, so passing one does not address the other.
Is there an official NDAA certificate for cameras
No. Section 889 and the associated Federal Acquisition Regulation clauses create representation and reporting obligations. They do not create a product certification scheme, so a document presented as an NDAA certificate is a supplier declaration, however official the wording appears.
How do I know whether a camera is produced by a restricted company
Ask for the manufacturing chain in writing, from the finished unit back through the module and chip suppliers, and treat the answer as a document you can rely on. Brand names are not reliable evidence, because restricted companies have supplied hardware sold under many other labels.
What changed in India in April 2026
From 1 April 2026 only STQC certified models may legally be sold or installed in India, with the requirement reported to cover component certification and security testing. Internet connected cameras from Hikvision, Dahua and TP-Link are among those affected.
Does Section 889 apply to my business if I am not a federal agency
It can. The prohibition at Section 889(a)(1)(B) reaches federal contractors using covered equipment in their own operations whether or not the specific project is federally funded, and grant and loan recipients are covered as well.
Should I avoid this category altogether
No. The category is viable, and the same hardware often qualifies for markets without a named company rule. What determines your position is documentation and market selection rather than the product itself.
What to Do Before You Order
- · Decide the destination markets first, because they determine whether the named company restrictions, the equipment authorisation requirement, or a local certification regime applies
- · Ask for the manufacturing chain in writing and keep it, rather than relying on a brand name or a supplier declaration dressed as a certificate
- · For the United States, verify the equipment authorisation record for the specific model rather than the product family
- · For India, confirm that the supplier holds STQC certification for the model rather than expecting to obtain it later
- · Confirm protocol openness and the recorder's supported device list before committing, so the installation can be expanded
- · Establish where footage will be stored and which law governs it, since this question arrives in tenders and audits rather than at the quotation stage
Our security and surveillance range covers the product families this applies to, and the sourcing process is described on our sourcing and purchasing service page. For the inspection checks worth building into a camera order, our quality inspection guide covers them.
If you want us to check a specific model or factory against your destination markets before you commit, contact our team with the model and the markets and we will work through the gates.