Insights

AI in CCTV and Video Surveillance: What UK Organisations Need to Know

Artificial intelligence is changing what CCTV and video surveillance systems can do. Modern platforms can distinguish between people and vehicles, search recorded footage, monitor occupancy, detect predefined activity and alert operators when particular events occur.

These capabilities can improve situational awareness, reduce unnecessary alerts and help organisations investigate incidents more efficiently. They can also introduce additional responsibilities where footage, biometric information or analytical data relates to identifiable individuals.

For security, facilities, estates, IT and data protection teams, the challenge is not simply selecting the most advanced technology. It is ensuring that each function has a clearly defined purpose, is proportionate to the risk and is managed responsibly.

The key question is not simply whether AI can perform a particular task. It is whether using that capability is necessary, proportionate, reliable and appropriate for the environment.

What Is AI CCTV?

AI CCTV uses software, algorithms or machine learning to analyse live or recorded video. Rather than relying solely on an operator to monitor every camera, the system can identify defined objects, movements or events and bring them to an operator’s attention.

Depending on the system and its configuration, AI-assisted video surveillance may include:

• Person and vehicle classification
• Line-crossing and intrusion detection
• Loitering detection
• People counting and occupancy monitoring
• Automatic Number Plate Recognition (ANPR)
• Facial recognition
• Object removal or abandonment detection
• Crowd-density monitoring
• Intelligent video search
• Behavioural or activity analytics

Not every function carries the same level of risk. A system configured to distinguish a person from an animal at a secure perimeter is very different from one designed to identify a named individual or make an assessment about a person’s behaviour.

Not Every Video Analytic Is Artificial Intelligence

“AI CCTV” is a broad commercial term. Some functions use machine-learning models, while others rely on conventional video analytics, predefined rules or image-processing techniques.

Features such as basic line crossing, motion detection and virtual tripwires are not necessarily artificial intelligence, even when they are marketed as intelligent analytics. More advanced person and vehicle classification, natural-language video search and facial recognition are more likely to use machine learning or other AI techniques.

The appropriate assessment should therefore focus on what a feature actually does, what information it processes and how its output is used, rather than relying solely on the manufacturer’s description.

The UK Regulatory Position

The European Union has introduced the EU AI Act, but the UK has not adopted the same single legislative framework for regulating every use of artificial intelligence.

Depending on the organisation, deployment and purpose of the system, relevant legislation, regulatory guidance and good-practice frameworks may include:

• The UK General Data Protection Regulation
• The Data Protection Act 2018
• The Data (Use and Access) Act 2025
• ICO guidance on CCTV and video surveillance
• ICO guidance on artificial intelligence and data protection
• The Protection of Freedoms Act 2012, where applicable
• The Surveillance Camera Code of Practice, where the organisation or deployment falls within its scope, or as a voluntary good-practice framework
• The Equality Act 2010
• Employment and workplace-monitoring requirements
• The UK Government’s AI Cyber Security Code of Practice

The Data (Use and Access) Act 2025 amended aspects of the UK’s data protection framework rather than replacing the UK GDPR or the Data Protection Act 2018. Organisations should therefore continue to consider the wider data protection framework and monitor updated guidance from the Information Commissioner’s Office.

Some ICO guidance covering artificial intelligence, CCTV, workplace monitoring and biometric information is under review following the changes introduced by the 2025 Act. Organisations should check the latest regulatory guidance when planning a deployment.

Does the Surveillance Camera Code Apply to Every Organisation?

The Surveillance Camera Code of Practice does not impose the same statutory obligations on every CCTV operator. Relevant authorities identified under the Protection of Freedoms Act 2012 must have due regard to the Code when carrying out relevant functions.

Other organisations may choose to follow its principles as a voluntary good-practice framework. Its principles remain useful when considering purpose, transparency, governance, retention, access, security and regular system reviews.

Organisations should establish whether the Code applies directly to them rather than describing it as a universal legal requirement for every commercial CCTV system.

When Does CCTV Footage Become Personal Data?

Video footage is likely to constitute personal data when an individual can be identified directly or indirectly from the footage or from other information available to the organisation.

This can include conventional CCTV images, vehicle registration information and analytical data associated with identifiable people. Additional requirements may apply where a system processes biometric data for the purpose of uniquely identifying an individual.

Installing an AI-enabled camera does not automatically make every use unlawful or unusually intrusive. The compliance implications depend on what information is collected, what the technology does with it and how the resulting information is used.

Facial Recognition Technology

Facial recognition is among the more intrusive applications of AI-enabled surveillance.

Where biometric data is processed for the purpose of uniquely identifying an individual, the organisation will generally need both an appropriate lawful basis under Article 6 of the UK GDPR and a valid condition under Article 9 for processing special-category biometric data.

An organisation considering facial recognition should clearly document why the technology is needed, what objective it is intended to achieve and why a less intrusive method would not adequately meet that objective.

Important considerations include:

• Identifying an appropriate lawful basis
• Identifying a valid special-category condition where biometric data is used for unique identification
• Completing a Data Protection Impact Assessment where required
• Assessing necessity and proportionality
• Understanding the source and suitability of reference or watchlist data
• Testing false acceptance and false rejection performance
• Considering potential bias and equalities implications
• Providing clear information to people who may be captured
• Ensuring meaningful human review where decisions could significantly affect an individual
• Documenting decisions, testing, safeguards and ongoing performance

Not every analysis of a facial image necessarily constitutes special-category biometric processing. The important question is whether specific technical processing is being used to allow or confirm the unique identification of an individual.

Law-enforcement processing is subject to a separate data protection regime under Part 3 of the Data Protection Act 2018. Commercial and educational organisations should not assume that practices used by law-enforcement bodies provide an appropriate model for their own deployment.

Automatic Number Plate Recognition

ANPR can be used for vehicle access control, parking management, site security and incident investigation. A vehicle registration mark can be personal data when it identifies or can be connected to an individual.

An organisation using ANPR should clearly define why registration information is being collected and avoid reusing it for unrelated purposes without a separate and appropriate assessment.

The deployment should consider:

• A clear and documented purpose
• An appropriate lawful basis
• Visible and understandable signage
• Appropriate retention periods
• Secure storage and transmission
• Role-based access to searches and reports
• Accuracy and procedures for correcting errors
• Rules governing information sharing
• Controls over exported number-plate data

Behavioural Analytics and Object Detection

AI analytics may be configured to identify events such as loitering, line crossing, crowd formation, abandoned objects or movement within restricted areas.

These functions can help security teams prioritise events for review. However, organisations should be cautious about systems that claim to determine aggression, emotion, suspicious intent or other subjective characteristics from video footage.

Video analytics may detect defined visual or movement patterns, but they do not reliably establish a person’s intention, emotional state or whether wrongdoing has occurred. An alert should be treated as information requiring contextual human assessment.

Appropriate safeguards may include:

• Clearly defined detection rules
• Human review before consequential action is taken
• Testing under realistic site conditions
• Procedures for managing incorrect alerts
• Regular accuracy and operational-performance reviews
• Recording missed detections and false alerts
• Controls preventing gradual expansion beyond the original purpose

Does Every AI CCTV System Need a DPIA?

A Data Protection Impact Assessment is required where processing is likely to result in a high risk to people’s rights and freedoms.

Systematic monitoring, biometric identification, large-scale monitoring of publicly accessible places, workplace monitoring and surveillance involving vulnerable individuals are among the factors that can increase the likelihood that a DPIA will be required.

Organisations should assess the need for a DPIA and document that decision. Where the threshold is met, the DPIA should be completed before the system is deployed.

Even where a DPIA is not legally mandatory, a proportionate assessment can help an organisation document its purpose, risks, safeguards and decision-making.

A DPIA should not be treated as a box-ticking exercise completed after equipment has already been purchased. It should inform the specification, design, configuration and operation of the solution.

If an assessment identifies a high risk that cannot be adequately reduced, the organisation may need to consult the ICO before proceeding.

Human Oversight and Automated Decisions

Not every automated CCTV alert constitutes a legally significant automated decision. A person or vehicle detection alert may simply prompt an operator to review a camera.

The legal and ethical implications become more significant where an analytical output contributes to disciplinary, safeguarding, access-control, employment or other consequential action affecting an individual.

Alerts that could contribute to legal, disciplinary, safeguarding or similarly significant action should receive meaningful human review, with a process for challenging or correcting inaccurate outputs.

Human review should involve more than automatically accepting the system’s recommendation. The reviewer should be able to consider the context, supporting evidence and limitations of the analytical output.

Who Is Responsible for Compliance?

The organisation deciding why and how a surveillance system is used will usually be the controller for the resulting personal information.

Installers, monitoring providers, cloud platforms and maintenance companies may have different responsibilities depending on their actual role, contractual arrangements and access to personal information.

Controller and processor responsibilities should be established contractually. The customer should also understand whether suppliers can access:

• Live video
• Recorded footage
• Facial-recognition or ANPR databases
• Analytical metadata
• System and user logs
• Exported footage
• Cloud management portals
• Remote support accounts

The involvement of an installer or technology provider does not remove the customer’s responsibility for defining the purpose of the system and ensuring that its use is appropriate.

Assessing Manufacturer Performance Claims

AI performance can vary considerably according to the camera, scene and operating conditions. A headline accuracy percentage should not be accepted without understanding how it was calculated and whether the test reflects the intended deployment.

Performance can be influenced by:

• Camera position and viewing angle
• Target distance and image detail
• Lighting and weather conditions
• Occlusion and scene density
• Image compression and frame rate
• Camera movement or vibration
• Analytical thresholds
• Changes to the model or software version
• The quality and suitability of reference data

Organisations should ask what evidence supports the claimed performance, under what conditions the product was tested and how accuracy will be validated within the intended operational environment.

There should also be a process for recording and reviewing false alerts, missed detections and changes in performance after deployment.

Where Does the Video Analysis Take Place?

Video analytics may run within the camera, on an NVR or VMS server, through an on-site analytical appliance or within a cloud service.

The processing location can affect:

• Network bandwidth
• Alert latency
• System resilience
• Cybersecurity
• Maintenance responsibilities
• Access to analytical data
• Cloud storage and data transfers
• Dependence on external connectivity

Processing analytics at the edge may reduce the amount of information sent externally, but it does not automatically make the system secure. Cameras and other edge devices still require secure configuration, controlled administration, firmware management and appropriate network protection.

AI CCTV in Schools

Schools and Multi-Academy Trusts may use intelligent video analytics to support perimeter security, safeguarding, visitor management, vehicle monitoring and incident investigation.

Potential applications include:

• Detecting people entering restricted perimeter areas
• Alerting authorised staff to out-of-hours movement
• Distinguishing people and vehicles from environmental movement
• Monitoring access to sensitive or restricted locations
• Searching footage more efficiently following an incident
• Managing vehicles at entrances and car parks

Because school systems may capture children, staff, visitors and members of the public, deployments require careful consideration. The presence of AI does not remove the need for human judgement, appropriate safeguarding procedures or effective governance.

Schools should be particularly cautious about using facial recognition, emotion analysis or behavioural categorisation unless the necessity, proportionality, accuracy and legal basis have been thoroughly assessed.

AI CCTV in Food Manufacturing and Industrial Environments

Within food manufacturing, warehousing and industrial sites, AI video analytics can support physical security, food defence and operational awareness.

Potential applications include:

• Perimeter intrusion detection
• Monitoring restricted production or ingredient areas
• Detecting unauthorised movement through controlled zones
• Monitoring vehicle movements
• Supporting investigations around vulnerable process points
• Identifying activity outside normal operating hours
• Reducing false alarms caused by wildlife or environmental movement

Security objectives should remain clearly separated from employee-performance monitoring unless there is a lawful, transparent and properly assessed reason for the additional use.

When introducing AI analytics into a workplace, organisations should explain the purpose of the technology, what information it collects, who can access that information and how long recordings and event data will be retained.

AI CCTV and Workplace Monitoring

Where cameras capture workers, the organisation must consider employment-monitoring requirements as well as its general CCTV obligations.

Monitoring should be lawful, fair, transparent, necessary and proportionate to the stated purpose. Employers should consider the reasonable expectations of workers and whether a less intrusive method could achieve the required objective.

Footage collected for site security should not be routinely repurposed for productivity or performance monitoring without a separate assessment of the purpose, lawful basis, necessity, proportionality and information provided to workers.

Organisations should also consider consulting workers or their representatives where appropriate, particularly when introducing intrusive or unfamiliar technology.

Cybersecurity and AI Video Surveillance

Modern CCTV forms part of an organisation’s networked technology environment. Cameras, recorders, cloud platforms, mobile applications and AI services can introduce security risks if accounts, software, connectivity and permissions are not properly managed.

The UK Government’s AI Cyber Security Code of Practice is a voluntary framework setting out baseline cybersecurity principles for AI systems and the organisations developing or deploying them.

For an AI-enabled video surveillance deployment, practical security considerations should include:

• Changing all default credentials
• Using individual user accounts rather than shared administrator logins
• Enabling multi-factor authentication where supported
• Applying role-based permissions
• Reviewing firmware and software updates
• Protecting remote access
• Segmenting surveillance equipment from other network services where appropriate
• Encrypting communications and stored information where supported
• Reviewing supplier and cloud-service arrangements
• Maintaining appropriate audit logs
• Removing obsolete accounts and historic installer access
• Establishing an incident-response process
• Planning for maintenance and secure end of life

AI functionality should not distract from fundamental cybersecurity controls. An analytically advanced system can still expose an organisation to risk if it has weak passwords, excessive privileges, outdated firmware or uncontrolled remote access.

Cloud-Based AI Analytics

Some analytics operate on a camera or local recorder, while others send footage, images or event information to a cloud service for processing.

Before using cloud-based analytics, an organisation should establish:

• What information leaves the site
• Where that information is processed and stored
• Whether international data transfers are involved
• How the provider protects the information
• Whether customer information is used to train or improve other systems
• Who can access footage and analytical results
• How information can be exported or deleted
• What audit information is available
• What happens to the information when the service ends
• How the system operates during a loss of internet connectivity

These points should be established during procurement rather than after the platform has been deployed.

Compliance Priorities for Security, Facilities and IT Teams

1. Define the objective.
   Be precise about the security or operational problem the technology is expected to address.
2. Consider less intrusive options.
   Establish whether the objective could reasonably be achieved without collecting or analysing as much personal information.
3. Identify the lawful basis.
   Document the purpose and lawful basis for each distinct processing activity.
4. Assess the need for a DPIA.
   Complete one before deployment where the proposed processing is likely to result in a high risk to people’s rights and freedoms.
5. Separate different functions.
   Do not assume that permission to record conventional CCTV automatically justifies facial recognition, ANPR or behavioural analytics.
6. Minimise collection and retention.
   Avoid collecting or retaining footage and analytical information for longer than is necessary.
7. Be transparent.
   Use appropriate signage and privacy information explaining what the system does.
8. Maintain meaningful human oversight.
   Ensure consequential action is not taken merely because an algorithm generated an alert.
9. Secure the system.
   Control accounts, remote access, updates, integrations and network exposure.
10. Validate performance.
    Assess accuracy under the actual lighting, positioning, environmental and operational conditions of the site.
11. Document changes.
    Review the assessment if new analytics, integrations or purposes are introduced.
12. Audit the deployment.
    Check periodically that the system remains necessary, proportionate, secure and aligned with its stated purpose.

Questions to Ask Before Purchasing AI CCTV

• What specific problem will the AI function solve?
• Is the feature genuinely AI or a conventional rule-based analytic?
• Does the system identify individuals or classify objects and events?
• What personal or biometric information will it process?
• Where does the analysis take place?
• What footage or metadata is sent to the cloud?
• What evidence supports the claimed performance?
• Under what conditions was the technology tested?
• How will accuracy be validated within the intended environment?
• How will false alerts and missed detections be recorded and reviewed?
• Can an operator review and override an alert?
• How will people be informed about the system’s use?
• Who will have access to footage, searches and analytical results?
• How long will the information be retained?
• What cybersecurity controls does the platform support?
• Can unnecessary analytical functions be disabled?
• Who is the controller and which suppliers act as processors?
• What happens to the information when the contract ends?

Frequently Asked Questions

Is AI CCTV legal in the UK?

AI-enabled CCTV is not automatically unlawful. Its use must comply with the data protection and surveillance requirements applicable to the particular organisation and deployment.

Compliance depends on the purpose of the system, the technology being used, the information being processed and the effect the processing may have on individuals.

Do we need a DPIA for AI CCTV?

A DPIA is required where the proposed processing is likely to result in a high risk to people’s rights and freedoms.

Systematic monitoring, biometric identification, workplace surveillance and monitoring involving vulnerable people can increase the likelihood that a DPIA will be needed. The decision should be assessed and documented before deployment.

Is facial recognition treated differently from ordinary CCTV?

Yes. Where facial recognition processes biometric data for the purpose of uniquely identifying an individual, additional data protection requirements apply.

The organisation will generally need both an appropriate lawful basis and a valid condition for processing special-category biometric data.

Is ANPR personal data?

A vehicle registration mark can be personal data where it identifies or can be linked to an individual. Its collection, use, retention, security and disclosure should therefore be appropriately managed.

Can CCTV automatically identify suspicious behaviour?

Some platforms can detect predefined movements or events, but an analytical alert should not automatically be treated as proof of wrongdoing or intent.

Human review, effective testing and appropriate operational procedures remain important.

Can AI CCTV be used in schools?

AI analytics can support school security and safeguarding, but the purpose and proportionality of the deployment must be carefully assessed.

Additional care is required because school surveillance systems may capture children and other potentially vulnerable individuals.

Can AI CCTV monitor employees?

Workplace monitoring requires a defined and lawful purpose, transparency and a proportionate approach.

A security system should not gradually become an employee-performance monitoring system without a separate assessment, appropriate justification and clear information for workers.

Does an AI camera replace a CCTV operator?

AI can help filter events and direct an operator’s attention, but it should not be assumed to understand context, intent or the full circumstances surrounding an event.

Human judgement remains important, particularly where an alert could lead to action affecting an individual.

Does the Surveillance Camera Code apply to private businesses?

The statutory duty to have due regard to the Surveillance Camera Code applies to defined relevant authorities under the Protection of Freedoms Act 2012.

Other organisations may choose to follow the Code’s principles voluntarily as a good-practice framework.

Final Thoughts

AI-enabled CCTV can help organisations detect incidents earlier, reduce avoidable alerts and investigate events more efficiently. However, advanced capability brings additional responsibility.

A successful deployment begins with a clearly defined operational requirement, not a list of impressive product features. Organisations should select only the functions that address a genuine need, understand how those functions process information and implement appropriate privacy, cybersecurity and human-oversight controls.

The most effective AI surveillance system is not necessarily the one with the greatest number of analytics. It is the one that addresses a genuine risk, performs reliably in its intended environment and is operated with appropriate transparency and accountability.

Use AI to help people make better-informed security decisions, not to remove human judgement from those decisions.

---

---

Important Information

This article provides general information about AI-enabled CCTV and video surveillance. It is not legal advice and does not determine whether any particular deployment complies with data protection, employment, equality or surveillance law.

Organisations should assess their own circumstances and obtain advice from an appropriately qualified data-protection or legal professional where required. ICO guidance referenced in this article may be updated following changes introduced by the Data (Use and Access) Act 2025.