[Home](/)/[Resources](/resources)/Security Camera CE Deep Dive EUCCTVDeep dive # Security Camera CE Compliance Deep Dive: Cybersecurity, EMC, and System Assessment Security cameras have quietly become one of the more demanding product categories in CE marking — not because any single directive is unusually strict, but because a wireless IP camera stacks RED (including its newer cybersecurity delegated act), EMC, LVD, RoHS, and often GPSR, with edge cases in each that generic consumer-electronics test plans routinely miss. This deep dive goes past the directive checklist into the specific technical decisions — cybersecurity standard selection, EMC test scope, system-versus-component assessment — that determine whether a CCTV product's technical file actually holds up. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Fce-compliance-for-security-cameras-deep-dive) At a glance Core directives RED, EMC, LVD, RoHS, GPSR Cybersecurity trigger Any radio-connected camera Cybersecurity standards EN 18031-1 / -2 / -3 System assessment Per-component or bundled GDPR relationship Separate from CE marking On this page * [1\. Why security cameras stack more directives than most electronics](#why-cameras-are-hard) * [2\. The RED cybersecurity delegated act: the requirement most cameras miss](#red-cybersecurity) * [3\. EMC edge cases specific to surveillance hardware](#emc-edge-cases) * [4\. Power topology: mains, PoE, battery, and solar](#power-topology) * [5\. System-level vs component-level assessment for CCTV bundles](#system-vs-component) * [6\. Where GDPR sits — and does not sit — relative to CE marking](#gdpr-boundary) * [7\. Outdoor and durability considerations that affect the technical file](#outdoor-durability) * [8\. Common compliance pitfalls in surveillance hardware](#pitfalls) ## 1\. Why security cameras stack more directives than most electronics As [the base security camera guide](/guides/ce-compliance-for-security-cameras) covers, most surveillance products touch RED, EMC, LVD, RoHS, and increasingly GPSR simultaneously. What that overview does not have room to unpack is why cameras in particular tend to surface more compliance edge cases per directive than comparable consumer electronics: they combine RF transmission, sensitive video processing, often an infrared illumination subsystem, and — for most of the market — persistent internet connectivity that captures and transmits personal data by design. That combination is exactly the profile that regulators have been tightening requirements around. The RED cybersecurity delegated act specifically targets internet-connected radio equipment, and a camera is close to the textbook case for why that requirement exists: it is a networked device that, by its core function, processes personal data continuously. The rest of this deep dive works through the specific technical decisions that separate a compliant camera technical file from a generic one copied across products — starting with the cybersecurity obligation that is newest, least understood, and most frequently missing. ## 2\. The RED cybersecurity delegated act: the requirement most cameras miss Delegated Regulation (EU) 2022/30 activated three additional essential requirements under RED Article 3(3): network protection (3(3)(d)), personal data and privacy protection (3(3)(e)), and fraud protection for equipment processing virtual money (3(3)(f)). For any camera with a radio module — Wi-Fi being the overwhelming majority case — the first two are directly relevant, and the harmonised standards written to satisfy them are the EN 18031 series. Trigger Standard What it covers Any internet-connected radio-equipped camera EN 18031-1 The network-protection cybersecurity baseline under RED Article 3(3)(d) — applies broadly to any connected radio device, cameras included, once the delegated act's obligations became mandatory. Cameras handling personal data over a network connection EN 18031-2 Addresses the privacy-protection limb of the RED cybersecurity delegated act — directly relevant to cameras, which by their nature capture and transmit personal data (video of identifiable people). Cameras that process virtual money or monetary value EN 18031-3 Rarely triggered by cameras specifically, but relevant for integrated camera-payment terminal hybrids or access-control systems with embedded payment functions. The reason this is the single most commonly missed requirement on camera technical files is timing: many manufacturers built their RED compliance process around the original 2014/53/EU essential requirements and never revisited it once the cybersecurity delegated act's obligations became mandatory. A camera design that was fully compliant three years ago can be non-compliant today purely because the cybersecurity layer was never added to the test plan — the underlying hardware has not changed, but the legal requirement it has to satisfy has. ## 3\. EMC edge cases specific to surveillance hardware Generic EMC test plans built for consumer electronics tend to focus on the primary radio module and the main processing board. Cameras have several additional emissions and immunity sources that are easy to omit if the test plan is copy-pasted from an unrelated product category. ### Infrared (IR) illumination arrays Pulsed IR LED arrays for night vision are a documented emissions source that generic EMC test plans sometimes omit, because the illumination circuit is treated as a lighting accessory rather than part of the RF-relevant signal path. ### Video transmission and encoding circuitry H.264/H.265 encoding chips and the video transmission path — whether analog coax, IP over Ethernet, or wireless — generate switching noise that must be characterized separately from the camera's radio module emissions if one is present. ### PoE injector and PD circuitry Power-over-Ethernet introduces its own switching power supply inside the camera (the powered-device side), which is a distinct EMC emissions source from the radio transmitter and needs its own immunity and emissions evaluation. ### Outdoor surge and lightning exposure Outdoor-rated cameras connect to cable runs that can pick up induced surges from nearby lightning strikes; immunity testing for outdoor units typically needs to go beyond the baseline residential/commercial EMC levels to include surge immunity appropriate to an exposed installation. ## 4\. Power topology: mains, PoE, battery, and solar How a camera is powered changes which directives apply and how the technical file needs to characterise the power circuit — this is one of the areas where the base guide's directive list needs to be mapped onto the specific product variant rather than applied uniformly. ### Direct mains (100-240V AC) **Applicable directives:** LVD applies directly; the camera's internal power supply is assessed against IEC 62368-1 or the relevant safety standard for its equipment category. Less common for cameras themselves (more typical for NVR/DVR units) but still seen in older analog CCTV installations. ### Power over Ethernet (PoE/PoE+) **Applicable directives:** LVD still applies — PoE delivers power at levels that fall within LVD's voltage thresholds once stepped down inside the camera, and the PSE/PD interaction needs its own safety and EMC treatment. The dominant power topology for modern IP cameras; often the source of confusion about whether LVD applies at all, since the camera itself never plugs into mains. ### Battery-powered (wireless, doorbell-style) **Applicable directives:** The EU Battery Regulation applies alongside RED (for the wireless link) and RoHS; LVD generally does not apply if there is no mains-voltage circuit anywhere in the product. Battery due diligence, labelling, and — depending on battery category — carbon footprint disclosure obligations layer on top of the camera's other CE requirements. ### Solar-assisted / solar-trickle-charged **Applicable directives:** Combines the battery-powered product's obligations with additional considerations for the photovoltaic charging circuit's safety and EMC behaviour. A growing category for outdoor cameras; the solar charge controller is a switching circuit in its own right and needs inclusion in the EMC test plan. ## 5\. System-level vs component-level assessment for CCTV bundles A CCTV installation is rarely one product — it is typically a set of cameras, an NVR or DVR, cabling, and sometimes a dedicated monitor or access-control integration. Manufacturers who sell these components together face a genuine choice about how to structure conformity assessment, and the wrong choice creates either unnecessary duplicate testing or a technical file that does not match how the product is actually sold. Component-level assessment — each camera, the NVR, and any powered accessory tested and declared independently — is the right approach when any of the pieces can be purchased, replaced, or used standalone. This is the more common pattern and the more flexible one: it lets a manufacturer mix and match components across product lines without re-triggering conformity assessment for the whole bundle every time one part changes. System-level assessment, evaluating the interconnected whole as a single product, only makes sense when the components are genuinely fixed together — sold, installed, and used exclusively as one integrated system with no independent market for the parts. Even then, the individual electronic components inside the system still need to meet RoHS and their own applicable safety requirements; system-level assessment changes how the EMC and RED conformity is demonstrated, not whether the underlying component-level obligations exist. ## 6\. Where GDPR sits — and does not sit — relative to CE marking It is worth being precise about this because it is the single most common confusion in camera compliance conversations. CE marking and GDPR are governed by entirely separate legal instruments, assessed through separate processes, and enforced by separate authorities. CE marking is a product-conformity regime — it certifies that the physical product meets the essential requirements of the directives that apply to it. GDPR is a data-processing regime — it governs how personal data captured by the camera is collected, stored, transferred, and disclosed once the camera is in use. The practical dividing line: a manufacturer's CE technical file needs to address the RED cybersecurity delegated act's network- and data-protection essential requirements (see Part 2) — these are product-design obligations. GDPR compliance for how footage is actually retained, who has access to it, and how data subject requests are handled is an operational obligation that sits with whoever deploys and operates the camera as a data controller, which in most B2B and consumer contexts is not the manufacturer. Manufacturers selling into markets with strict video-surveillance-specific privacy rules sometimes build GDPR-supportive features (local storage options, encryption, retention controls) into the product as a market-positioning decision — but that is a product-design choice made in response to customer demand, not a CE marking obligation, and it belongs in a separate part of the product documentation from the CE technical file. ## 7\. Outdoor and durability considerations that affect the technical file Outdoor security cameras carry compliance obligations beyond the core electronics directives, and these frequently get treated as marketing specifications rather than technical-file evidence. An IP rating (IP65, IP66, IP67, and so on) is not itself a CE marking requirement, but if a manufacturer claims an IP rating on packaging or in marketing material, that claim needs to be substantiated with test evidence — GPSR's general safety requirements and consumer-protection expectations around truthful claims both bear on this. The CE mark itself also has to remain durable and legible for the expected lifetime of the product under its intended conditions of use — a requirement that is easy to satisfy for an indoor consumer device with a printed label, and considerably less trivial for a camera housing that will sit in direct sun and rain for years. Manufacturers typically address this with an engraved, embossed, or otherwise weather-resistant marking method rather than a printed sticker for outdoor-rated products. As covered in Part 3, outdoor units also generally need EMC immunity evaluation appropriate to their exposed installation environment, including surge immunity — this is a technical-file gap that is easy to miss if the same generic EMC test report is reused across a product family's indoor and outdoor variants. ## 8\. Common compliance pitfalls in surveillance hardware ### Treating the RED cybersecurity delegated act as optional or future work As covered in Part 2, this is now a mandatory essential requirement for any radio-connected camera, not an aspirational feature — its absence from a technical file is a compliance gap, not a roadmap item. ### Reusing an indoor camera's EMC test report for the outdoor variant Different power topology, IR illumination configuration, and exposure to surge events mean the outdoor variant needs its own EMC evaluation — see Parts 3 and 7. ### Assuming PoE-powered cameras fall outside LVD because there is no mains plug As covered in Part 4, LVD's applicability turns on voltage levels present in the equipment, not on whether the product plugs directly into a wall socket — PoE circuits fall within LVD's scope once stepped down inside the device. ### Folding GDPR obligations into the CE Declaration of Conformity As covered in Part 6, these are separate legal regimes with separate documentation — conflating them creates a technical file that misrepresents what CE marking actually certifies. ### Bundling components into a system declaration when they are also sold standalone As covered in Part 5, if any component can be purchased or replaced independently, it needs its own component-level Declaration of Conformity regardless of how it is bundled in some sales channels. ## Frequently asked questions ### Does the RED cybersecurity delegated act apply to a wired-only security camera? No — the RED cybersecurity delegated act (2022/30) applies to radio equipment, meaning it is triggered by wireless connectivity (Wi-Fi, Bluetooth, cellular, or similar). A camera with no radio transmitter at all — pure wired Ethernet or analog coax — falls outside RED entirely and does not need EN 18031 series testing, though it still needs EMC, LVD (if mains or PoE powered), and RoHS. ### If a camera is wireless but sends unencrypted video, does it still need cybersecurity assessment? Yes. The cybersecurity delegated act's requirements — network protection under EN 18031-1 and personal data protection under EN 18031-2 — are conformity obligations independent of what encryption choices the manufacturer happens to make. A camera that fails to implement adequate network and data protection measures does not meet the RED essential requirements, regardless of whether it was designed with encryption in mind from the start. ### Do I need to test the NVR/DVR separately from the cameras, or can I test them as one system? Both approaches are valid, but they produce different technical files. Testing each product as a standalone item (each camera, the NVR, each accessory) means each carries its own Declaration of Conformity and can be sold independently. Testing as an integrated system is appropriate only when the components are genuinely sold and used exclusively as a fixed bundle — see Part 5 for the distinction and why most CCTV manufacturers end up doing both. ### Are outdoor security cameras held to a different EMC immunity standard than indoor ones? The underlying EMC directive and general standards are the same, but the actual test levels and configurations applied typically differ because outdoor equipment is exposed to a harsher electromagnetic environment — surge events from nearby lightning, for instance. A camera qualified only to indoor/residential immunity levels but sold as an outdoor product is a mismatch between the technical file and the product's actual use case that a market surveillance authority can flag. ### Does GDPR compliance need to be referenced in the CE technical file? No. GDPR is a data protection regulation entirely separate from CE marking's legal basis, and the two obligations are assessed, documented, and enforced independently. A camera's CE technical file addresses product safety, EMC, RoHS, and (where applicable) RED — GDPR compliance for how captured footage is processed, stored, and disclosed is the responsibility of whoever operates the camera as a data controller, generally not the manufacturer, and is documented separately. ### Can I use a family declaration across camera models with different lens or housing variants? Yes, provided the underlying electronics — the radio module, the power circuitry, the processing board — are identical or the differences are demonstrably immaterial to the EMC, safety, and RED test outcomes. Cosmetic housing changes or different lens options rarely justify separate full test campaigns, but a documented technical rationale explaining why the untested variants are covered is expected in the technical file. ### Do PTZ (pan-tilt-zoom) cameras with motorised mechanisms trigger the Machinery Regulation? Generally no — the motorised mechanism in a PTZ camera is a low-risk, low-power mechanism that does not typically meet the risk thresholds that pull a product into Machinery Regulation scope. The relevant safety consideration is usually addressed within LVD's general electrical and mechanical safety requirements rather than as a separate machinery assessment, though very large or high-torque pan-tilt systems used in industrial or broadcast settings are worth reviewing against Machinery Regulation criteria specifically. **Disclaimer:** This page is an educational resource only and does not constitute legal or engineering advice. RED cybersecurity requirements, harmonised standard status, and EMC test scope depend on your product's specific configuration — always verify current requirements against the applicable delegated acts and consult a qualified test lab or Notified Body before finalising a compliance strategy. 🇪🇺 CE Marking roadmap for your product Every standard, document, and test that applies — free, no account required. See your free roadmap[ Want an expert to take your product through 🇪🇺 CE Marking compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Learn this properly In-depth course that teaches the full process, not just this one answer. [Start the course — $149](/courses/01-ce-marking-for-electronics-engineers)[Prefer to read? Get the book — $24.99](/books/01-ce-marking-for-electronics-engineers) Related guides * [CE Compliance for Security CamerasComplete guide to CE marking for security cameras, CCTV systems, and surveillance equipment.](/guides/ce-compliance-for-security-cameras) * [CE Certification for IoT DevicesComplete CE compliance guide for IoT devices: RED, EMC, RoHS, GPSR, and cybersecurity requirements for connected products enter…](/guides/ce-certification-for-iot-devices) * [CE Compliance for Connectors Deep DiveA deep dive into CE compliance for connectors, adapters, and interconnect hardware: how to classify a connector against RoHS, LVD, and EMC, when it counts as a standalone product versus a component, and the standards that decide the outcome.](/guides/ce-compliance-for-connectors-deep-dive) * [CE Compliance for DisplaysCE marking guide for displays, monitors, and digital signage: applicable directives (LVD, EMC, RoHS), ErP energy efficiency req…](/guides/ce-compliance-for-displays)