Commercial CCTV Buyer's Guide UK: What to Look for in 2026

Commercial CCTV is one of those markets where the price of a system can vary by a factor of five for what looks, on paper, like the same product. This guide is written for anyone specifying, procuring or replacing a CCTV system for a UK business in 2026, and covers what actually matters when you compare quotes.

Camera resolution — 4K is the new baseline

Every business camera worth installing in 2026 is at least 4K (8 megapixel). Anything lower — 2 MP or 4 MP — is now legacy tech that costs pennies more to install at the higher resolution. If a quote lists 2 MP or 4 MP cameras, either the installer is clearing old stock or they are working to a tight margin and hoping you do not notice.

Higher-resolution cameras give you more digital zoom without losing usable detail — which matters when you are trying to identify a face, read a number plate or check a badge from footage after the event.

Cameras types and when to use each

• Bullet cameras — long, cylindrical bodies. Best for outdoor perimeter, car parks, walkways. Weatherproof, long IR range.
• Dome cameras — discreet, tamper-resistant. Best for indoor coverage where you do not want the camera to dominate the space.
• Turret cameras — squarer than dome, better night vision, easier to aim. A good default for indoor and covered outdoor.
• Panoramic multi-sensor — 180° or 360° in one housing, replaces 3–4 fixed cameras in wide areas.
• PTZ (pan-tilt-zoom) — operator-controlled or auto-tracking. For large sites where somebody is actively watching.
• ANPR — dedicated number-plate recognition on car park entrances and forecourts.
• Thermal — perimeter security in low-light, fog, or industrial hot-spot monitoring.

Positioning — the thing that separates a good system from a waste of money

A camera in the wrong place is worse than no camera at all. It gives you a false sense of coverage without any of the evidence. Common mistakes: cameras aimed straight into afternoon sun, cameras above eye height that only capture the tops of heads, cameras "covering" a car park from too far away to read a number plate, cameras on the "wrong" side of a doorway so you only ever see backs.

A proper site survey — not a floor-plan exercise, an actual visit — is the single biggest determinant of whether a CCTV system will do its job. If a supplier will quote without visiting, or wants to survey after the order is placed, walk away.

Cabling and infrastructure

• Cat6a is the standard for new installs. Cat5e is legacy — do not accept it on a new job.
• PoE+ (30W) minimum for standard fixed cameras. PoE++ (60W) for PTZs and heated outdoor cameras.
• Cable containment (dado trunking, conduit or basket tray) — not stapled to the ceiling.
• For runs over 90m, fibre with a local media converter.
• A business-grade managed switch — not a consumer PoE switch.
• Network segmentation — CCTV on its own VLAN, firewalled from the business network.

Recording — on-site, cloud or both

For small sites (up to 16 cameras) and short retention (30–60 days), cloud-recorded CCTV can be the simplest option. No NVR to buy, resilient to on-site theft, easy remote access. Expect to pay £4–£15 per camera per month for cloud storage.

For larger sites (32+ cameras) or longer retention, an on-site NVR is usually more cost-effective. A 32-channel NVR with 24TB of RAID storage in 2026 costs about £2,000–£3,500 and holds 60–90 days of 4K footage across all cameras. For the most important cameras — high-value stock, cash points, dock entrances — a cloud-backup layer gives you the best of both worlds.

Analytics that add real value

Modern camera-side AI is genuinely useful — not the vague "smart detection" of five years ago. Line-crossing and intrusion-zone alarms cut false positives dramatically compared to old-style motion detection. ANPR with white/black-list matching flags known vehicles automatically. People-counting turns retail cameras into a footfall data source. PPE detection catches safety-compliance issues before they become accidents.

The important thing: analytics run on the camera itself, so no footage leaves the site unless you choose to send it. That matters for GDPR and it means the system keeps working when the internet goes down.

GDPR, ICO and the legal bits

• You need documented lawful basis (usually "legitimate interest" for security) with a risk assessment.
• Signage at every entrance stating that CCTV is in operation and giving contact details.
• A retention policy — how long you keep footage and why. 30–60 days is typical, longer for regulated sectors.
• A subject-access process — someone asking for footage of themselves must be responded to within one month.
• A data protection impact assessment (DPIA) for any high-risk use — face recognition, workplace monitoring, sensitive areas.
• ICO registration if you are not already registered.

Red flags in CCTV quotes

• No site visit before the quote.
• Cameras listed by count only — no positions, no specification.
• Consumer-brand cameras (Ring, Google Nest, off-brand IP) in a commercial spec.
• "Cloud only, no local NVR" for a site over 16 cameras.
• One shared admin password for remote access.
• No handover documentation, no camera map, no training.
• No maintenance contract mentioned.

What good looks like

A quote from a proper commercial installer will include: a site survey report, a camera-position map, the exact model and specification of every camera, cable specification and routing, network segmentation and switch specification, NVR or cloud recording specification with retention, handover documentation, training, and a maintenance contract. It will be more expensive than the cheapest quote you get. It will also still be working in five years without anyone tripping over the cabling.