Russian-Origin Software in EU CCTV Projects (2026): Compliance, Sanctions & Procurement Review

Why this question matters in 2026 EU procurement

Since 2022 the EU has adopted multiple successive sanctions packages targeting Russia, alongside parallel evolutions in member-state public-procurement rules. The cumulative effect on software procurement has been substantial: contracting authorities that did not previously ask about software origin now routinely include origin-disclosure requirements at the qualification stage, and bids that cannot evidence non-sanctioned origin are commonly filtered out before commercial review.

CCTV design software sits in a particular category of risk because the artefacts it produces — floor plans, camera placement, network topology, BOM — are sensitive from both a security and an operational standpoint. Even where a sanctions instrument does not on its face cover a particular CCTV planning tool, contracting authorities tend to apply a precautionary stance, especially in defence, public administration, critical infrastructure and large healthcare or transport projects.

This article is the explainer we wished existed when integrator clients first started asking us about software origin in tender responses. It is descriptive, not prescriptive — its purpose is to lay out the framework in plain language so a CCTV designer can ask their procurement counsel the right questions, rather than to substitute for that conversation.

The current EU sanctions framework — high-level summary

EU restrictive measures against Russia are implemented through Council Regulations published in the Official Journal of the European Union and updated through successive amendment packages. The framework operates on three broad pillars relevant to software procurement.

In addition to the EU-level framework, member states such as Germany, France, Poland, the Nordics and the Baltic states have introduced their own public-procurement language with stricter criteria. The result is that the same vendor can be acceptable in one EU jurisdiction and filtered out in another even when no instrument explicitly names them. Procurement teams therefore tend to apply the strictest member-state language as their internal benchmark.

US side: NDAA §889 and ICTS executive orders

On the US side, two instruments are routinely cited even by EU procurement officers as informal benchmarks. NDAA §889 (the John S. McCain National Defense Authorization Act for Fiscal Year 2019) prohibits federal agencies and federal contractors from buying or using covered telecommunications and video-surveillance equipment from certain named Chinese manufacturers. The Information and Communications Technology and Services (ICTS) executive orders, principally Executive Order 13873 and successors, give the US Department of Commerce broad authority to review transactions involving foreign adversaries.

Neither instrument applies as a matter of law to a typical EU procurement. They are, however, frequently used as procurement-template language. A 2026 EU contracting authority drafting a CCTV tender will commonly require the vendor to declare that their software, hosting and personnel would not be excluded under §889-equivalent rules even when §889 itself is irrelevant to the contract. Vendors that cannot make that declaration are at a competitive disadvantage regardless of the underlying legality of their offer.

Direct procurement impact on CCTV design software

The categories below are the four where we see software-origin questions arise most frequently in 2026 EU CCTV projects.

How buyers verify software origin

A procurement officer running an origin check has a fairly standard toolkit. None of these checks individually proves origin — they assemble a triangulated picture from public information.

For higher-risk procurement (defence, critical infrastructure) the assessment can extend to source-code provenance, third-party security testing and an independent legal opinion. The marginal cost of the higher-tier assessment is non-trivial and contracting authorities typically only commission it where the value or sensitivity of the contract justifies it.

GDPR third-country transfer angle

GDPR Articles 44 to 49 govern personal-data transfers to countries outside the European Economic Area. The default rule is that such a transfer is prohibited unless one of the specified safeguards applies: an adequacy decision by the European Commission, an approved transfer mechanism such as standard contractual clauses with appropriate supplementary measures, or a derogation for specific situations.

The European Court of Justice in Schrems II (Case C-311/18, 2020) made clear that standard contractual clauses must be supplemented by a transfer-impact assessment that takes into account the laws of the destination country and whether they provide essentially equivalent protection. Russia is not on the European Commission's adequacy list, and the prevailing reading is that achieving "essentially equivalent" protection for transfers to Russia is difficult given the legal landscape there. The practical consequence is that any CCTV design tool that transmits personal data to servers in Russia, or to entities under Russian jurisdiction, faces a meaningful transfer-impact-assessment burden that EU-hosted tools simply do not.

For CCTV projects this matters because design tools touch personal data more often than people realise — project metadata, end-customer site information, account email addresses, support-ticket content. A buyer who treats GDPR seriously will want assurance that none of that data leaves the EU/EEA in a way that triggers Chapter V scrutiny.

Why CCTVplanner exists — EU-hosted, EU-developed

CCTVplanner is operated by DEFENSAR, registered in Poland, with the frontend hosted in Poland and the backend on EU-region cloud infrastructure. That is the meaning of the headline "100% Engineered and Hosted in EU" — the legal entity, the engineering, and the hosting are all inside the European Union, and there are no third-country sub-processors in the default architecture.

For procurement teams, this translates into a short, declarative answer to the origin-disclosure questions described above. There is no Russian, Chinese or US-jurisdiction sub-processor anywhere in the data path. There is no transfer-impact-assessment burden under GDPR Chapter V because the data does not leave the EU. There is no §889-equivalent disqualifier on the supply chain. Trusted by integrators from all over the world, the EU-by-default architecture is the single feature that comes up most often in procurement conversations in 2026.

The "Switching from JVSG" reality

A practical question we hear from integrators in 2026 is: "We are happy with our current CCTV design tool, but the procurement team has flagged software-origin disclosure as a risk. What does a transition look like?" The answer is mostly mechanical — export the floor plan to DXF, import it into CCTVplanner, re-place cameras from a 65,000+ model catalogue, match DORI thresholds, re-route cabling, export the multi-page PDF deliverable. We have written a step-by-step playbook in the migration guide linked below. None of the steps are particularly hard. The hardest part is generally the decision to make the switch, not the switch itself.

For procurement-driven switches specifically, our advice is to document the transition in writing — the trigger event, the alternatives evaluated, the chosen replacement, and the date the existing tool is retired from the workflow. Procurement counsel and ESG auditors both reward documented decisions, and a written transition log is a common artefact in due-diligence packs.

Closing disclaimer

This article is a factual review based on publicly available standards, regulations and case law as of May 2026. It is not legal advice and it is not a substitute for advice from qualified procurement counsel in your jurisdiction. Sanctions, export controls and procurement rules evolve frequently and are interpreted differently across EU member states. Every concrete procurement decision should be confirmed with counsel familiar with the specific contracting authority, sector and jurisdiction at hand.

No statement in this article is intended as a disparagement of any country, company or category of vendor. The intent is to describe the procurement framework as buyers experience it in 2026, so that integrators can prepare bid responses and design workflows that survive the qualification stage.

Frequently Asked Questions