Cameras Going Global: RF, Privacy and Cybersecurity — Three Gates

Start with the conclusion: a camera is not a product you can sell just because the FCC / CE work is done. Beyond radio it carries an extra path — image capture. The lens points at faces, doorways and living rooms, and what it records has to be stored, transmitted, and made visible and controllable to the user. So this category never passes one gate, but three:

• Gate one, radio and electrical safety: FCC ID / CE-RED / UKCA / MIC / KC / SRRC, plus safety and EMC. What you hand over is test reports and an ID.
• Gate two, privacy: capture scope, storage location, transmission method, notices and the user manual. What you hand over is product design and text, not a report.
• Gate three, cybersecurity: default passwords, vulnerability disclosure, security update support period. The UK PSTI has been mandatory since 2024-04-29, the EU CRA is phasing in, and marketplace reviews will ask about it. What you hand over is processes and declarations.

The place these three gates go wrong is not technical difficulty but getting the order and the ownership wrong: engineering assumes certification means shipping samples to a lab, sales assumes the report closes the file, and then the goods reach the UK and get asked about PSTI, the listing goes live and gets asked for UL/ETL, and the manual never says where the data is stored. The lab stage only covers gate one; the material for gates two and three is written, not measured.

Below we break it down gate by gate: which gate, what it checks, what the evidence looks like. The timelines and costs quoted are common industry ranges only; the specific figures are subject to assessment by the certification body.

Three gates, three separate jobs: start with this comparison table

It is worth archiving this table as it stands. It makes one point: the three gates are not three chapters of one report, they are three sets of evidence that cannot replace each other. Opened up, a camera is an image sensor + processor + WiFi/Bluetooth module + IR LEDs + power module + SD card slot, and each block brings in the requirements of its matching gate — the IR LEDs bring in EMC radiated disturbance, the SD card slot and cloud storage bring in privacy, and the WiFi module and app provisioning bring in cybersecurity.

Gate one · Radio: dual-band cameras are not "one extra band" on the invoice

Camera wireless configurations usually come in three forms: 2.4G WiFi only, 2.4G + 5G dual band, and dual band plus Bluetooth provisioning. The test volume differs a lot between them.

• 2.4G band: FCC Part 15C in the US, EN 300 328 in the EU. The basic items are transmit power, occupied bandwidth, spurious emissions and frequency stability.
• 5G band: Part 15E in the US, EN 301 893 in the EU. Beyond power and spurious emissions, DFS (dynamic frequency selection) and TPC (transmit power control) are added — these two are the real cost driver in the 5G band, and the place where lab slots are hard to book.
• Antenna: antenna gain and radiation pattern must be submitted together. Many projects have no problem with the radio figures but stall because the antenna gain does not match the enclosure structure, and changing the structure costs far more than changing the circuit.

Certification for a dual-band unit usually runs at 1.5–1.8 times the single-band figure — not double, but do not budget it as single band either. On timing, FCC ID is commonly 2–4 weeks and FCC SDOC 1–2 weeks; EU CE-RED varies with lab availability and the number of rework rounds. Subject to assessment by the certification body, especially when Q4 schedules are tight.

Two other hardware details are easily overlooked: first, the US market requires a local agent (US Agent) — a process item rather than a test item, but missing it means missing it; second, an FCC ID remains valid long term (no update while the standard is unchanged), whereas UL/ETL requires a factory inspection every quarter, which is an ongoing cost and must be built into the quotation.

Gate one · Safety and EMC: outdoor units' IP protection is often underestimated

On safety, the complete unit is assessed to IEC 62368-1 (UL 62368-1 in the US), covering dielectric strength, insulation and temperature rise; units with a battery also follow the UL 2054 / UL 1642 line. The adapter separately follows DOE Level VI or the EU ERP, and DOE also requires registration. These are routine steps and need no further comment.

What really separates projects is EMC and the protection rating of outdoor units:

An outdoor unit is not "the same design with a housing added". IP rating, ESD and surge stack on top of each other, pushing both test items and cost up; any change to structural parts, seals or housing material means the data already tested has to be re-assessed. When planning a product line, give outdoor units their own line — do not hang them under the indoor project.

Gate two · Privacy: for products that can capture faces, the manual is a compliance document

Draw the boundary first: in many markets privacy is not a test — no lab will issue you a "privacy report". But it is a genuine market requirement, and it lands on product design and on text.

Take the EU: when a camera is sold to end consumers and may involve video and audio data collection, the product design and documentation should reflect data protection considerations — the two directions given in the source material are specific: local storage first, encrypted transmission. These are not slogans; once implemented they land on hardware and firmware: whether to keep the SD card slot, whether cloud storage is on by default, whether the out-of-box transmission channel is encrypted, and whether the app explains the data flow during first-time provisioning. None of this maps directly to a test clause, but the manual and the declaration of conformity should address it.

At the same time, the EU CRA merges privacy and cybersecurity at the text level: it explicitly requires data protection (encryption of storage and transmission) and collection of only necessary data. In other words, the material you write for gate three answers part of gate two along the way — which is why these two gates are well suited to being pushed in parallel.

On concrete actions, here are the things commonly seen in the industry, marked for whether they come from a regulation or from engineering and channel practice, so the two are not mixed up:

• Recording status indication (engineering practice): the device should let the user see that it is recording while it operates. This is not a test item listed in any regulation, but buyer factory audits, marketplace reviews and end-user complaints all point at it.
• First-time provisioning notice (engineering practice + text requirement): when the app connects for the first time, explain what is captured, where it is stored and who can access it. The wording has to match what the firmware actually does.
• Collect only necessary data (CRA text): do not collect data you do not use, do not default to long-term cloud storage, do not leave unused ports and permissions open by default.
• Encryption of storage and transmission (CRA text): encrypt local storage and encrypt the transmission channel, and state the default condition in the manual.
• Audio function description (text requirement): on models with a microphone, the recording capability must be explained in the manual, not only listed in the specification table.
• Choice between local and cloud (design direction): local storage first is the direction given in the source material, and it also lowers the explanation burden around cross-border data flows.

Gate three · Cybersecurity: the UK is already mandatory, the EU is counting down

This is the fastest-moving of the three gates, and the place where many camera projects actually get stuck. Look at it through two markets, then add the practical view from the factory side.

UK PSTI: three requirements, none optional

The UK Product Security and Telecommunications Infrastructure Act (PSTI) took effect on 2024-04-29 and covers "consumer products that can connect to the internet". Cameras are a typical product in scope; out of scope are medical devices and smart meters (each under its own regulation), enterprise IT equipment, and products that do not connect to the internet, such as pure Bluetooth earphones — which also explains why, although Bluetooth earphones and cameras are both wireless products, the weight of the cybersecurity gate is entirely different.

The three core requirements, listed as given in the source:

Compliance is lighter than many people assume: no third-party certification is required — a manufacturer's self-declaration (Statement of Compliance) is enough, with technical documentation kept available for inspection. A common timeline is about 1–2 weeks (document review plus product checks); there is no standalone mark, and the information is carried on the product or packaging. The regulator is OPSS (Office for Product Safety and Standards).

But "light" does not mean "loose". The consequence of non-compliance is withdrawal from the market and recall, with fines of up to £10 million or 4% of global annual turnover, whichever is higher. For a camera project with normal shipment volumes, that is enough to stop an entire product line.

Technically, PSTI is based on ETSI EN 303 645. The EU RED cybersecurity requirements (EN 303 645) overlap with PSTI but are not identical. If you export to both the EU and the UK, building to the higher standard is the recommended route — the lower-effort and lower-cost approach, with one set of underlying evidence serving both sets of documents.

EU CRA: the timeline is easier to misjudge than the requirements

The CRA is the Cyber Resilience Act, Regulation (EU) 2024/2847, in force on 2024-12-10 and fully mandatory on 2027-12-11. It covers all products with digital elements (PDEs) — hardware and software that can connect directly or indirectly to a network and can process, store or transmit digital data. Cameras fall within it as consumer IoT.

On classification, consumer IoT such as cameras typically falls into the Default class, using Module A internal production control and self-assessment with no third party involved — that is the good news. Third parties are needed for Important Class I (browsers, password managers, antivirus, VPN, firewalls), Important Class II (general-purpose microprocessors, certain firewalls, requiring Module B+C or Module H) and the Critical class (core components of critical infrastructure, via EUCC). Determine the class first, then decide the budget — do not start by costing everything against a third-party quotation.

The requirements run along two lines. On the product design side (Annex I Part I): no known vulnerabilities when placed on the market, secure default configuration (force a change of the initial password at the factory, close unnecessary ports), support for security updates (free and timely), protection against unauthorised access (authentication, permission management), data protection and limits on collection scope, and a reduced attack surface (no hidden backdoors, no outdated dependency libraries). On the vulnerability management side (Annex I Part II): an SBOM software bill of materials (machine-readable), timely fixes and periodic security testing, public disclosure of fixed vulnerabilities, coordinated vulnerability disclosure (CVD), and a single point of contact for vulnerability reports.

Among the manufacturer obligations, the ones that bear directly on camera product-line planning are these: carry out a cybersecurity risk assessment before launch and on an ongoing basis; a support period of at least 5 years and security updates for at least 10 years; keep technical documentation (Annex VII) for 10 years; issue a CRA declaration of conformity (EU DoC) and apply the CE marking; report vulnerabilities and incidents to ENISA and CSIRT; and provide user security information (Annex II). Fines reach €15 million or 2.5% of global annual turnover for core obligations, €5 million or 1% for providing false information or obstructing supervision, and €10 million or 2% under the liability extension and market surveillance clauses.

Factory side: these requirements flow down through contracts

"Manufacturer" in the CRA means the party placing the product on the EU market, usually the brand owner, not the contract manufacturer. In reality, though, the brand owner will not carry it alone and will pass the requirements down through contracts. The factory has to prepare four things: traceable firmware source code, a third-party component list (SBOM), security test records, and a vulnerability handling process.

These four share one trait: none of them can be assembled in two weeks. The SBOM has to follow the firmware version, the vulnerability process needs committed time limits and a contact person, and security testing needs reproducible records. The real risk scenario is plain — a European customer sends an email one day asking for CRA material, the factory cannot produce it within three days, and the order moves to the next supplier. This has already played out once during the GDPR years.

Marketplace review: the few fields that get opened on a listing

Once the goods clear customs, the channel gate remains. Marketplace review does not read your compliance narrative, it only checks what can be verified. The source gives several clear anchor points:

• Safety certification is "voluntary but effectively required": UL / ETL are voluntary in law, but retailers such as Amazon and Walmart nearly all require them. ETL carries the same legal weight as UL; brand recognition and price differ, so choose by budget.
• FCC IDs are publicly searchable: they can be checked on fccid.io. The consequences of having no FCC ID are concrete — customs can detain the goods, FCC fines apply, e-commerce platforms take listings down, and competitors file complaints.
• Prop 65 is a hard requirement on e-commerce platforms: warning labels are needed, and a missing label is more common than a missing report.
• PSTI information is carried on the product or packaging: there is no standalone mark, so the wording on packaging and in the manual is what gets reviewed.

Put together, a document pack that can pass marketplace review looks roughly like this: verifiable information from the reports and IDs, photos of nameplates and labels (FCC ID, CE, UKCA, warning statements, Prop 65), the declaration of conformity, the in-box manual, adapter energy-efficiency registration records (DOE / KEMCO / SASO by market), and the sentence in the listing copy about "how many years of updates are supported" — which has to match the period in the PSTI declaration, because a mismatch is a false declaration.

Multi-country packaging: which data can be reused, which cannot be used at all

A camera product line usually has to cover five or six markets at once, and whether the work can be packaged together determines the cost structure. In practice the dividing line looks like this:

There is a scheduling order worth following: fix the band configuration and the target-market list first, then book lab slots, and start the gate two and gate three documents at the same time. The reason is practical — gates two and three do not occupy the lab, they are pure text and process work, so they run in parallel with gate one without conflict. Do it the other way round and you will be stuck two weeks before shipment when you remember the PSTI declaration and the manual clauses.

Pitfalls and checklist: seven places to trip, and an action plan laid out by week

Seven pitfalls that hurt the moment you hit them

• Assuming a listing is possible once FCC / CE is done. Gate one only settles "can it transmit legally"; PSTI and the CRA are two other regulatory lines that the report will not mention.
• Quoting the 5G band at 2.4G prices. DFS and TPC are separate work, and a dual-band unit usually runs at 1.5–1.8 times the single-band figure — say so at quotation stage.
• Declaring outdoor units at indoor IP ratings. IP65+, stricter ESD, surge/lightning and UV ageing are all additional items; a change of structural parts can force retesting.
• Shipping with a universal password, or not forcing a change at first provisioning. The PSTI ban on universal default passwords is an explicit provision — there is no room to explain this one away.
• Writing the update period casually on the packaging. Whatever number of years you declare, you have to deliver; PSTI includes false declarations within the scope of penalties.
• Not stating where data is stored and transmitted in the manual. Gate two is not a test item, but a manual and declaration of conformity missing this section means the gate is left empty.
• Treating a certified module as an exemption for the unit. Complete-unit EMC, antenna influence and the unit ID normally still have to be done.
• Waiting until 2027 to move on the CRA. The vulnerability reporting obligation of 2026-09-11 is already in force, and the 24/72-hour and 14-day deadlines will not wait.

Action checklist: plan by week, not by mood

Decidable this week (no need to wait for a lab):

• List the target markets and align the gate one certification mix item by item across the US / EU / UK / Japan / Korea / China / Saudi.
• Determine the CRA class: cameras usually fall into the Default class, going through Module A self-assessment; confirm there is no case pulling you into the Important classes.
• Check three things: whether a universal password still ships from the factory, whether the website has a vulnerability reporting channel, and whether the packaging states an update period. These three decide whether PSTI means "top up" or "redo".

To be in place within 30 days:

• Build the SBOM so that it follows the firmware version rather than the project.
• Write the vulnerability handling process: receipt channel, committed response times, fix and disclosure paths, single point of contact.
• Set the update support period and put it into the packaging, the manual and the listing, with one consistent figure in all three places.
• Add three sections to the manual: what is captured, where it is stored, how it is encrypted; and state the recording capability on models with a microphone.

Required before launch:

• Gate one: RF/EMC/safety reports, FCC ID, declaration of conformity, US Agent, energy-efficiency registration, warning labels.
• Gate two: privacy-by-design description, manual clauses, the relevant statements in the declaration of conformity.
• Gate three: Statement of Compliance, update declaration, SBOM, vulnerability process records.
• Channel: verifiable screenshots of reports and IDs, photos of nameplates and labels, sample in-box manual pages.

For cameras, the competitive edge of the past decade was resolution, night vision and cloud services; over the next few years the dividing line will be the evidence chain — for the same hardware, whoever can hand over the material for all three gates in one go gets listed, stays listed, and takes the next order from a European customer. The other way round, however elegant the radio work, a project stuck on a default password or an update declaration still does not go global.

What we do every day is turn these three gates into an executable checklist for clients: which items need samples, which need documents, which can still be done in time, and which are already overdue. Cycles and costs vary widely with product configuration (single/dual band, indoor/outdoor, with or without battery) and the number of target markets, so the specific figures are subject to assessment by the certification body — do not apply someone else's quotation to your own product.

▍If this camera is being planned for export, send us the configuration and target markets and we will lay out a route through the three gates, marking where it is likely to stall.

▍One-line value proposition: we help you get export certification done and clear customs smoothly.

Further reading: Cameras / security global certification routes · UK PSTI: the three requirements explained · EU CRA timeline and class determination · USA FCC/UL certification guide · UK UKCA/PSTI knowledge base · EU CE/RED knowledge base · Certification quick lookup