Infrastructure
Buying Security Cameras? What the FCC's 2026 Covered List Rules Mean for Your Business
Businesses that already own Hikvision or Dahua cameras are not required by the FCC to remove them, but since July 16, 2026 the FCC prohibits importing and marketing older, previously authorized models for certain purposes, and an October 2026 rule defined critical infrastructure. This guide covers what the rules restrict, what they leave alone, how federal contracts and grants add a second layer, and what to check before you buy.
Direct answer: if your business already owns security cameras made by Hikvision or Dahua, the Federal Communications Commission's 2026 actions do not require you to remove them, and the FCC says you may keep using equipment you legally bought. What changed is the supply side. The FCC has not authorized new equipment from those manufacturers since November 2022, and since July 16, 2026 it also prohibits importing and marketing their older, previously authorized models for certain purposes. Separate federal purchasing rules apply if your business holds federal contracts or spends federal grant or loan money.
This guide explains what the rules say, who they restrict, what they leave alone, and what to check before you buy, expand, or replace a camera system.
What the Covered List Is
The FCC's Public Safety and Homeland Security Bureau publishes the Covered List under the Secure and Trusted Communications Networks Act of 2019. It names communications equipment and services that have been determined to pose "an unacceptable risk to the national security of the United States or the security and safety of United States persons."
Three entries dated March 12, 2021 matter for camera buyers. They cover video surveillance and telecommunications equipment produced or provided by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, and Dahua Technology Company. Each entry carries the same limit: the equipment is covered "to the extent it is used for the purpose of public safety, security of government facilities, physical security surveillance of critical infrastructure, and other national security purposes."
That limit is the part most summaries skip. These three entries are tied to how the equipment is used, not to the brand alone.
What Changed in 2026
Three dated developments are worth knowing.
In November 2022 the FCC adopted rules that stop it from authorizing equipment on the Covered List, but it left earlier authorizations in place. Older models that already had an FCC authorization could still be imported and sold. In its June 2026 notice, the FCC said equipment from the 2021 listing "has not received authorization since November 11, 2022," and that it had yet to approve any of the compliance plans those manufacturers would need before new equipment could be authorized.
On June 26, 2026 the FCC released a public notice, published in the Federal Register on July 6, that closed much of that gap. Effective July 16, 2026, it prohibits the continued importation and marketing of previously authorized covered equipment that was added to the Covered List in 2024 or earlier. For the three use-based entries, the notice applies the prohibition only when the equipment is imported or marketed for the listed purposes. It also held back one of those purposes, physical security surveillance of critical infrastructure, until the FCC adopted a definition of "critical infrastructure," and said the prohibition would reach that purpose on the effective date of an order adopting one.
That definition arrived in a final rule effective October 13, 2026. The same rule requires any company named on the Covered List to go through full recertification for any change to its equipment, treats listing a device on an online marketplace (together with services such as warehousing or fulfillment) as marketing, and will require online marketplaces to show a certified device's FCC ID at the point of sale, with compliance dates of March 1, 2027 and June 1, 2027 depending on the marketplace's role.
What the Rules Do Not Change
The prohibition falls on importing and marketing, which means on the companies that bring this equipment into the country and sell it. It does not fall on the business that already owns a system. The June notice says the prohibition "does not affect the continued use or operation of previously authorized covered equipment," and that people "may continue to use any device or equipment that they currently possess, if the equipment was legally purchased and maintains an existing equipment authorization."
There is a practical catch. One manufacturer asked the FCC to exempt equipment used for "spare parts, updates and replacements" for existing devices, and the FCC declined, saying that allowing replacements for existing covered equipment "would defeat the entire purpose of this prohibition." Where the prohibition applies, a failed camera may not be replaceable with the same model, so a system that depends on like-for-like spares has a shorter planning horizon than its hardware age suggests.
Whether Your Business Counts as Critical Infrastructure
This is the question that decides how much of the prohibition reaches your purchases, and it is a legal question, not a brand question.
The new rule uses the definition in federal law (42 U.S.C. 5195c(e)): systems and assets "so vital to the United States that the incapacity or destruction of such systems would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters." The FCC's rule says this encompasses systems and assets used in the provision of services or functions in the 16 critical infrastructure sectors to provide any of the 55 National Critical Functions published by the Department of Homeland Security.
The 16 sectors are broad. They include Healthcare and Public Health, Financial Services, Commercial Facilities, Food and Agriculture, Critical Manufacturing, Energy, and Water and Wastewater. Working in one of those sectors does not settle the answer by itself, because the definition also asks whether the systems and assets are used to provide one of the National Critical Functions. The FCC removed earlier "connected to" wording that a federal appeals court had called "unjustifiably broad."
Do not guess in either direction. If your business operates in one of those sectors, ask the seller in writing how the equipment may lawfully be marketed to you, and raise the question with your attorney before a large purchase.
Federal Contracts, Grants, and Loans Add a Second Layer
Section 889 of the fiscal year 2019 National Defense Authorization Act is a separate rule with a different trigger: federal money.
The federal contract clause that implements it, FAR 52.204-25, prohibits agencies from contracting with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, subject to limited exceptions and waivers, and states that this applies "regardless of whether that use is in performance of work under a Federal contract." For grant and loan recipients, 2 CFR 200.216 prohibits recipients and subrecipients from obligating or expending loan or grant funds to procure or obtain covered equipment.
Both rules define covered video surveillance equipment with the same purpose language as the Covered List, and both extend to subsidiaries and affiliates of the named companies. If your business holds a federal contract or subcontract, or receives federal grant or loan funds, treat your camera system as a compliance item and confirm your position with your contracting officer, grant administrator, or attorney.
What to Check Before You Buy or Expand
- Write down the manufacturer, model number, and FCC ID for every camera and recorder you own. The FCC ID is printed on the device label, and the brand name on the box is not always the company that built the device.
- Ask your installer in writing who manufactures each device, including any that are sold under another brand name.
- Confirm whether your business holds federal contracts or subcontracts, or uses federal grant or loan funds, and whether any facility you secure is a government facility.
- For any new purchase, ask the seller to confirm in the quote that the equipment holds a current FCC authorization and is not produced by a company named on the Covered List.
- Ask how replacement units and firmware updates will be supplied for the expected life of the system.
- Plan replacement on your own schedule. A phased swap budgeted over a year costs less disruption than an emergency replacement after a failed camera turns out to have no available equivalent.
- Keep the basics in place whatever the brand: unique administrator credentials, current firmware, a separate network segment, and no direct exposure to the internet. Our guide on why your camera system and door locks are now an IT decision covers those steps.
What to Watch Next
Two items are still open. Alongside the October rule, the FCC published a further proposal that seeks comment on additional measures, including how to address "white labeling" of covered equipment and whether to add streamlined procedures for revoking authorizations. Those are proposals, not rules. The June notice also recorded that Hikvision's court challenge to the FCC's 2025 order (Hikvision USA, Inc. v. FCC, No. 25-1274, in the U.S. Court of Appeals for the D.C. Circuit) was pending. Either could change the picture, so treat any purchasing decision as a point-in-time answer and recheck before a major expansion.
How Cyber One Solutions Helps
Cyber One Solutions designs, installs, and manages camera and door access systems through our physical security service, and we treat the equipment as part of your network, with its own segment, managed firmware, and documented credentials. For an existing system, we can inventory the cameras and recorders you have, record the manufacturer, model, and FCC ID for each one, and give you a replacement plan you can budget. Door hardware follows the same approach through our access control service. We are not a law firm, and questions about how these rules apply to your contracts or your sector belong with your attorney, but we can give you and your attorney an accurate list of what is installed. If you are planning a camera purchase or are unsure what your current system contains, contact us and we will review it with you.
Frequently Asked Questions
Do we have to remove Hikvision or Dahua cameras we already own?
The FCC rules do not require it. The June 2026 notice says the prohibition on importation and marketing does not affect continued use, and that equipment may keep being used if it was legally purchased and maintains an existing equipment authorization. A federal contract, grant, or loan can impose its own requirements under Section 889, so check those separately.
Can a business still buy these cameras?
It depends on the equipment and the purpose. The FCC has not authorized new equipment from the 2021 listing since November 11, 2022. For older, previously authorized models, the prohibition on importation and marketing applies when the equipment is imported or marketed for public safety, security of government facilities, physical security surveillance of critical infrastructure, or other national security purposes. Ask the seller to state in writing how the equipment may lawfully be sold to you.
Our cameras carry a different brand name. Does that settle it?
No. Cameras are sometimes sold under a brand that is not the company that built them, and the FCC is seeking comment on how to address "white labeling" of covered equipment. Ask your installer who manufactures each device, and record the FCC ID from the label.
We have no government work. Does any of this apply to us?
Section 889 is tied to federal contracts, grants, and loans, so it may not. The FCC prohibition is tied to how the equipment is used, and one of the listed purposes is physical security surveillance of critical infrastructure, which is defined by reference to 16 sectors and 55 National Critical Functions. If your business works in one of those sectors, get a clear answer before you buy.
Is our current system unsafe?
The FCC actions are based on national security determinations about the manufacturers, not on a finding about any one installed system. Every networked camera, whatever the brand, needs unique credentials, current firmware, and network segmentation. Those steps are worth confirming now.