QCVN 11:2026/BCA: New cybersecurity regulations for IP cameras
Effective July 1, 2026, QCVN 11:2026/BCA will officially come into force, replacing QCVN 135:2024/BTTTT and establishing fundamental cybersecurity requirements for Internet Protocol (IP) surveillance cameras.
These new regulations are of particular importance to manufacturers, importers, and distributors of IP cameras in Vietnam.
1. To which cameras does QCVN 11:2026/BCA apply?
QCVN 11:2026/BCA applies to Internet Protocol (IP) surveillance cameras falling within the scope of the regulation.
The regulation’s requirements focus on various aspects of cybersecurity and device protection, such as:
– Account, password, and user authentication management;
– Access control;
– Data protection and encryption;
– Security vulnerability management and handling;
– Firmware updates and authentication;
– Activity logging;
– Device model identification capability;
– Requirements regarding data storage in Vietnam.
These aspects must be evaluated through technical documentation and actual testing, rather than relying solely on product specifications or datasheets.
2. Do cameras require conformity certification?
Under QCVN 11:2026/BCA, surveillance cameras classified as medium- or high-risk devices within the regulation’s scope must undergo a declaration of conformity and bear the conformity mark (CR).
Notably, Circular 125/2026/TT-BCA, effective from July 1, 2026, issued a list of products and goods classified as medium- and high-risk under the management of the Ministry of Public Security. This list includes the IP surveillance cameras covered by QCVN 11:2026/BCA.
Therefore, businesses should not merely identify a product as an “IP camera”; they must also determine its specific risk category and the corresponding conformity assessment method.
3. Testing and conformity certification for cameras under QCVN 11
For medium-risk cameras:
Declaration of conformity is based on the self-assessment results of the organization or individual, grounded in test results from a designated testing organization or conformity assessment results recognized in accordance with regulations.
For high-risk cameras:
Declaration of conformity is based on conformity certification results issued by a designated certification body.
4. What do businesses importing cameras need to prepare?
Businesses should prepare, at a minimum, the following:
01. Product information
02. Technical documentation
03. Manufacturer information
04. Determination of scope of application
05. Conformity assessment
It is particularly important to accurately identify the model, manufacturer, and firmware version, especially for OEM cameras or products imported from multiple factories.
5. How does Interlink Vietnam support businesses?
Compliance with QCVN 11:2026/BCA involves more than just submitting products for testing. Businesses must correctly determine the scope of application, technical requirements, documentation, and conformity assessment methods right from the start.
Interlink Vietnam provides consulting, testing, and certification solutions, supporting businesses with:
– Reviewing the scope of application of QCVN 11:2026/BCA;
– Advising on testing requirements for each camera model;
– Assisting in the preparation of technical documentation;
– Conducting testing/assessment in accordance with the Regulation;
– Advising on certification and declaration of conformity;
– Assisting importers in finalizing documentation to bring products to market.
If your business is preparing to import, manufacture, or distribute IP cameras in Vietnam, please verify product compliance with QCVN 11:2026/BCA before proceeding with the shipment.
