The US market layers three requirements onto cameras: radio frequency, electrical safety, and data security, with FCC ID as the mandatory threshold.
IP cameras with Wi-Fi, Bluetooth, or cellular modules are intentional radiators and must obtain an FCC ID, tested under FCC Part 15 Subpart C (15.247 / 15.407). Cameras with only a wired Ethernet port are treated as unintentional radiators and follow the FCC Part 15 Subpart B SDoC (Supplier's Declaration of Conformity) path. The SDoC process takes 1-2 weeks. FCC ID certification typically takes 3-4 weeks and must be completed at an FCC-recognized certification body.
On electrical safety, power adapters and complete units connected to mains power need to comply with UL 62368-1; this is not mandatory but is commonly required by e-commerce platforms and buyers. On data security, the US currently has no federal mandatory cybersecurity regulation for consumer IoT, but state laws such as California SB-327 and Oregon's law require devices to have "reasonable security features" and unique preset passwords. For US carriers or government procurement projects, NIST IR 8259 and cybersecurity maturity questionnaires are also layered on.
The NDAA restricts US federal government procurement, not market access.
The relevant provisions originate from Section 889 of the John S. McCain National Defense Authorization Act, in two parts: Part A prohibits federal agencies from procuring, obtaining, extending, or renewing contracts for "covered telecommunications equipment"; Part B prohibits federal agencies from contracting with contractors that use such equipment. Covered scope includes Huawei, ZTE, Hytera, Hikvision, Dahua, and their subsidiaries and affiliates. Section 8 of the FY2021 NDAA further extended this to government procurement of video surveillance equipment.
The key point: these restrictions target federal agency procurement activities and federal contractors, and do not constitute an import ban on civilian retail channels. Products entering the US retail market do not need an "NDAA certificate," because no such certificate exists. Buyers typically require suppliers to issue declarations of origin and ownership structure, and supply chain due diligence questionnaires, as contract attachments rather than administrative access documents.
The EU runs three tracks in parallel: CE-RED, EN 18031, and GDPR; cybersecurity requirements become mandatory from August 2025.
CE-RED is the Radio Equipment Directive 2014/53/EU. From August 1, 2025, the network protection, personal data protection, and fraud prevention requirements of RED Article 3.3(d), (e), and (f) apply mandatorily, with the EN 18031 series (EN 18031-1/-2/-3) as harmonized standards. Cameras with cloud connectivity and mobile apps are typical applicable products and must complete a cybersecurity assessment included in the technical documentation. RED certification typically takes 4-6 weeks.
GDPR is not a product certification, but it directly affects product design: if a camera transmits video or metadata back to overseas servers, this involves personal data transfer and requires a legal basis and cross-border transfer mechanism. The European Data Protection Board has specific guidance on video surveillance scenarios, and facial recognition features are strictly restricted for use in public places.
Cloud storage architecture determines where compliance obligations fall, not just a technical choice.
When a camera uploads recordings to an overseas cloud platform by default, the exporting company simultaneously plays the role of device manufacturer and (potentially) data processor. For the EU market, privacy policy, privacy by default, and data minimization must satisfy the EN 18031-2 assessment items. US government procurement projects often require data to be stored domestically and to meet FedRAMP-type requirements.
The practical approach is to offer local storage (SD card / NVR) as the priority with cloud storage as an option, and to disable unnecessary data upload by default at the factory. This design simultaneously reduces pressure from GDPR and buyer questionnaires.
| Dimension | US FCC | US NDAA | EU CE-RED + EN 18031 |
|---|---|---|---|
| Nature | Mandatory market access | Government procurement restriction | Mandatory market access |
| Applicable to | Radio frequency and electromagnetic compatibility | Federal agencies and contractors | Radio equipment and cybersecurity |
| Main basis | FCC Part 15 | NDAA Section 889, etc. | 2014/53/EU, EN 18031 |
| Issues certificate | Yes (FCC ID / SDoC) | No | Yes (declaration of conformity + technical documentation) |
| Typical duration | FCC ID 3-4 weeks | No certification cycle | 4-6 weeks |
No. A wired camera without radio frequency transmission follows the FCC Part 15 Subpart B SDoC self-declaration and does not need an FCC ID. If the product contains Wi-Fi, Bluetooth, or a 4G module, an FCC ID is mandatory.
No. The NDAA is not a certification system, and no official certificate exists. What buyers require are supply chain declarations, statements of origin and ownership structure, and commitment documents on whether equipment from listed entities is used.
This cannot simply be circumvented. The scope of Section 889 includes "subsidiaries and affiliates," and regulators focus on substantive control relationships rather than trademark ownership. Rebranding through contract manufacturing without changing the actual control relationship may still be deemed a covered entity, and carries contract fraud risk.
The EN 18031 series are harmonized standards for RED Article 3.3(d), (e), and (f), applicable from August 1, 2025. Conformity with harmonized standards gives presumption of conformity with the corresponding essential requirements; if harmonized standards are not applied, conformity must be demonstrated by other means, significantly increasing the technical documentation burden.
Facial recognition involves biometric data, which is a special category of personal data under GDPR, and processing conditions are strictly limited. At the product level, it is recommended to disable the feature by default, provide clear notice and a separate consent mechanism, and reflect access control and data protection design in the EN 18031-2 assessment.
Send your product spec and target market — we reply with scope, timeline and cost within one business day.
Email Mr. TaoBeice Testing · Tao Gong · CNAS L5516 · CMA 202319013572 · NTEK Group Partner Lab · Shenzhen, China
+86 199-2684-3993 · taowushuang@ntek.org.cn · 中文站