AI CCTV analytics runs in one of three places: inside the camera (edge analytics), in an AI recorder or appliance, or on a server with CPUs or GPUs. The UAE's 2026 National Manual for Surveillance Systems lists all three as approved. Choose by camera count, the analytics needed and who acts on alerts.
The choice decides what crosses the network, what you keep paying for and how much tuning the alerts need. This guide follows documents published by October 2026; for cameras, storage and approvals, see our guide to CCTV systems for UAE businesses.
What is AI CCTV analytics?
Software that watches the video so an operator does not have to, usually feeding alerts into the video management system (VMS). The National Manual for Surveillance Systems (version 3.0, 2026, published by the Monitoring and Control Centre, MCC) defines it as software algorithms that automatically analyse surveillance video to detect predefined events, identify objects or behaviours, and generate alerts or operational information in real time.
What separates it from basic pixel-change motion detection is classification: it decides what moved (the manual still lists motion detection among its features, for control rooms, cash vaults and restricted areas). Hikvision describes its AcuSense technology as deep learning that sorts targets into human, vehicle and other; Dahua describes WizSense as products with an independent AI chip that recognise people and vehicles and filter out animals. The manual defines fourteen analytics features, from face detection to camera tampering.
Where AI CCTV analytics runs: camera, recorder or server
The manual names three approved architectures: edge-based AI cameras with onboard processing, a dedicated AI appliance, and a centralised server-based platform using CPUs or GPUs. Automatic number plate recognition (ANPR) has its own list with the same three shapes: an on-premises central server, an edge AI device at the camera, or a smart camera with ANPR built in.
| In the camera (edge) | In an AI recorder or appliance | On a server (CPU or GPU) | |
|---|---|---|---|
| What crosses the network | Video to the recorder, plus small event messages | Video to the appliance | Video of every analysed camera to the server |
| Works with existing cameras | No, the camera needs the AI chip | Yes, if the appliance supports them | Yes, if the software supports them |
| How it grows | Each new AI camera brings its analytics | Up to the appliance's analytics channels | More licences, GPUs or servers |
| Examples from vendors UBM supplies | Hikvision AcuSense, Dahua WizSense cameras | Hikvision AcuSense NVRs, Dahua WizMind NVRs and IVSS | Digifort Advanced Analysis of Video, IPXAnalytics |
In the camera (edge analytics)
The camera's AI chip runs the model and sends events with its video. Nothing extra sits in the rack and the processing runs inside the camera's PoE budget (the classes are in our ELV systems guide). The limits: each camera runs what its firmware offers, rules are set camera by camera, and mixed brands need a native integration in the VMS or ONVIF Profile M on both sides to pass events.
In an AI recorder or appliance
A box with its own AI processor analyses video from cameras that have none. Hikvision lists AcuSense NVRs and DVRs, and Dahua's WizMind portfolio includes NVRs and IVSS units. This suits an existing estate that needs a few analytics; check how many channels the box can analyse at once.
On a CCTV analytics server (CPU or GPU)
Analytics software runs on servers you size and own. Digifort says its Advanced Analysis of Video module needs its own server, which can process up to 30 cameras, with licences sold per camera; its IPXAnalytics uses neural networks to detect more than 80 types of object, including people, vehicles, helmets and weapons. A server offers the widest choice of analytics, but it must receive the video of every camera it analyses; see when CCTV becomes a network problem for the bandwidth arithmetic.
The server decodes every stream and runs the model, and GPUs are built for both. NVIDIA's L4, a low-profile PCIe card positioned for video and AI, is rated at 72 W maximum with four hardware video decoders (NVDEC). Cameras per GPU depend on resolution, frame rate, model and software, so ask the vendor to size against your camera list. Residency and sizing work as for running AI on your own servers.
What the 2026 National Manual asks of AI video analytics
Section 5 applies to every entity that must provide an AI video analytics system:
- One of the three approved architectures, deployed within the surveillance network and not connected to other networks.
- Event recordings, analytics data and metadata stored on-premises; cloud storage or external hosting only with the concerned authorities' prior written approval.
- Integrated with the surveillance system and accessible through the VMS or CMS, with health diagnostics and redundancy according to the entity's category.
- Detection accuracy of at least 90% under standard operating conditions, effective operation in day, night, low-light and IR modes without performance degradation, and AI-based calibration such as sensitivity tuning and masking zones.
- A real-time notification for every event, carrying the date and time (synchronised with NTP), camera name and location, event type, and a snapshot or clip reference.
- Video and analytics data kept for at least 30 days, with AES-256, TLS 1.2 or higher, role-based access, multi-factor authentication for administrators, and immutable logs.
The Arabic text of the manual prevails where it differs from the English.
Which sites must have AI video analytics?
The manual's category table makes it mandatory for the categories below and optional for the rest; the concerned authorities may add to or modify these requirements. ANPR is mandatory only where the site has a designated parking area.
| Category | Group | AI analytics | ANPR | Retention (days) |
|---|---|---|---|---|
| Educational entities (except nurseries) | A | Mandatory | Mandatory | 90 |
| Entertainment venues | A | Mandatory | Mandatory | 30 |
| Football stadiums | A | Mandatory | Mandatory | 30 |
| Public and private hospitals | A | Mandatory | Mandatory | 30 |
| Fuel and EV charging stations | A | Mandatory | Mandatory | 90 |
| Exhibition halls; labour accommodation | A | Mandatory | Mandatory | 90 |
| Shooting ranges | A | Mandatory | Mandatory | 180 |
| Museums; public transport and ports | B | Mandatory | Mandatory | 90 |
| Hotels and hotel apartments; shopping malls | B | Mandatory | Mandatory | 180 |
| Banks | B | Mandatory | Optional | 180 |
Parking buildings, and residential compounds, buildings and commercial buildings, must have ANPR, with AI analytics optional. ANPR has its own floors: at least 99% vehicle detection and 98% plate recognition for GCC plates, day and night.
Which analytics hold up, and which need care
Ask what the analytic has to work out. The ordering below is UBM's rule of thumb, not an official scale; the areas are examples from the manual.
| Analytic | What it has to decide | Areas the manual lists |
|---|---|---|
| Intrusion detection (vendors also offer line crossing, which the manual does not list) | A person or vehicle entered a zone or crossed a line | Building perimeter, from outside |
| People counting | How many people passed a point | Main entrances |
| Unauthorised parking, wrong-way driving | A vehicle stopped, or moved against the set direction | Drop-off areas, parking, ramps |
| ANPR | The characters on a plate | Vehicle entrances and exits |
| Face detection | That a face is present, and where | Main entrances |
| Loitering, violent behaviour, slip and fall, dangerous objects | What a person is doing or carrying | Staircases, lobbies, auditoriums, dining areas |
| Face recognition | Who the person is | Not in the manual's list |
Position and count are the easiest to prove: a test walk shows whether "person entered this zone" works. Plate reading is narrow but depends on angle, shutter speed and night-time IR. Behaviour analytics depend far more on camera height, lighting and crowding, so they need a tuning period and someone reviewing alerts. Digifort's documentation makes the same point: analytics need properly trained personnel and the right camera height, positioning, lighting and rules.
The 90% floor applies "under standard operating conditions", so measure again on your own cameras and keep the results. For ANPR the manual already requires documented model and version information, accuracy testing records, alert logic and change history, with material changes tested and approved before deployment. Keep the same records for every analytic.
Face detection is not face recognition
The manual asks for face detection at main entrances: finding faces in the video and where they are. Face recognition compares a face with stored faces to say who the person is; it is not in the manual's list, and in law it is a different thing.
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) defines biometric data as personal data from processing a person's physical, physiological or behavioural characteristics that allows or confirms their unique identification, such as a facial image or fingerprint data, and lists it among sensitive personal data (Article 1). Article 21 requires an impact assessment before using new technologies likely to pose a high risk to privacy, and makes it necessary when processing covers a large volume of sensitive personal data. Article 2 excludes some cases, including government data and free zone companies with their own data protection legislation, such as those under DIFC Law No. 5 of 2020.
Accuracy is the other caveat. NIST's 2019 test of 189 mostly commercial face recognition algorithms, NISTIR 8280, found a wide range of accuracy between developers, and false positive rates that often varied by factors of 10 to beyond 100 times between demographic groups. If face recognition is considered at all, take legal advice, confirm with the concerned authority and document the impact assessment first. This article describes the law; it is not legal advice.
Metadata and ONVIF: Profile M, S and T
ONVIF Profile M (2021) standardises how analytics devices and services send metadata and events to clients such as a VMS: object classification, metadata for vehicles, licence plates, faces and bodies, counting and recognition events, delivered over the metadata stream, the ONVIF event service or MQTT. Profile M on both sides is the standard route for one brand's edge analytic to raise an alarm in another brand's VMS.
For video, ONVIF announced in October 2025 the end of support for Profile S, whose authentication no longer matches current cybersecurity recommendations, and recommends Profile T (2018). Deployed Profile S systems keep working; the June 2026 test tools, valid for nine months, are the last that allow Profile S claims. The manual still names Profile S, with alternatives after the authority's approval, so ask for Profile S and T, plus Profile M where analytics events must reach the VMS.
What AI CCTV analytics costs to run
Prices move too fast to print, so here is what you pay for at each tier, including the running costs that quotes often leave out.
| Cost | In the camera | In a recorder or appliance | On a server |
|---|---|---|---|
| Hardware | An AI camera per analysed view | The appliance, and a spare | Servers and GPUs, with redundancy where required |
| Licences | Check which functions are licensed | Check the analytics channel count | Per camera or channel, per module |
| Power and cooling | Inside each camera's PoE budget | One box, 24 hours a day | Servers 24 hours a day, plus cooling |
| Tuning and records | Rules and firmware per camera | Rules per channel | Central, but every camera still needs a test |
Electricity never stops. A server runs 8,760 hours a year, so each watt of continuous draw is 8.76 kWh a year:
| Continuous draw (W) | Energy per year (kWh) |
|---|---|
| 72 (one NVIDIA L4 at its maximum rating) | 631 |
| 250 | 2,190 |
| 500 | 4,380 |
| 1,000 | 8,760 |
Multiply by your tariff and add the cooling that removes the same heat. These draws are worked examples; take real figures from the vendor's power calculator or a metered PDU. Regulated sites add the manual's own items: a UPS of at least 30 minutes for the monitoring and control system, 30 days of analytics data, encryption and logs. For ANPR, when new plates are issued, the manufacturer or service provider must add them and reach 98% recognition within 90 days; under the Arabic text, which prevails, the manufacturer or service provider bears that development cost (one line of the English text names the entity), so settle it in the supply contract.
How UBM handles it
UBM designs and installs IP CCTV with Hikvision, Dahua and Digifort, with analytics as part of the same design. We start from the site's category and the manual's list of required analytics and areas, then choose the tier per area: edge where a camera's chip can do the job, an appliance where existing cameras need a few analytics, a server where many cameras or several analytics share one VMS. Servers, GPUs, network and storage are sized with recording, and analytics data stays on-premises for the required period.
Cameras are aimed and verified on site, and computer-vision analytics is delivered for approved security use cases only. Whoever commissions your system, ask for every analytic rule to be walk-tested on site with the results kept alongside the model and firmware versions, and take legal advice and confirm with the authority before face recognition is considered. See our CCTV and physical security and AI infrastructure work, size a private language model for the same server room with the UBM AI infrastructure simulator, or talk to a UBM engineer about your camera list.
Questions people ask
Should AI analytics run on the camera, the NVR or a server?
On the camera for a few analytics on new cameras, on an AI recorder or appliance to add analytics to existing cameras, and on a CPU or GPU server for many cameras or several analytics in one VMS. The 2026 National Manual approves all three.
Is AI video analytics mandatory in the UAE?
For some categories in the 2026 National Manual, including schools, hospitals, hotels, shopping malls, banks, museums, public transport, fuel stations and labour accommodation. It is optional for the rest. Confirm with the concerned authority for your emirate which manual applies.
Can AI CCTV analytics run in the cloud?
Not without prior approval. The manual requires event recordings, analytics data and metadata to be stored on-premises, and cloud hosting or cloud analytics needs the concerned authorities' approval first.
Is face recognition allowed on business CCTV in the UAE?
The manual asks for face detection, not recognition. Face recognition produces biometric data, which the PDPL treats as sensitive personal data, so take legal advice and confirm with the concerned authority first.
How accurate does AI video analytics have to be?
At least 90% detection under standard operating conditions, and for ANPR at least 99% vehicle detection and 98% plate recognition for GCC plates. Test on your own cameras and keep the records.
Sources
- Monitoring and Control Centre: National Manual for Surveillance Systems, Version 3.0, category table and Sections 4 and 5, in English and Arabic (Regulations section) (MCC, 2026)
- Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, Articles 1, 2 and 21 (UAE Government portal, Arabic text, 2021)
- Data protection laws (UAE Government portal, 2026)
- NISTIR 8280, Face Recognition Vendor Test (FRVT) Part 3: Demographic Effects (NIST, 2019)
- Profile M and ONVIF Releases Profile M for Metadata and Events for Analytics Applications (ONVIF, 2021)
- ONVIF to End Support for Profile S; Recommends Profile T as Replacement (ONVIF, 2025)
- Profile T (ONVIF, 2018)
- Hikvision AcuSense Camera (Hikvision, viewed October 2026)
- WizSense and WizMind (Dahua Technology, viewed October 2026)
- Advanced Analysis of Video and Digifort Neural Network (IPXAnalytics) (Digifort, viewed October 2026)
- NVIDIA L4 Tensor Core GPU (NVIDIA, viewed October 2026)
Comments
Questions and experience from readers. A person reads every comment before it appears.
No comments yet. If something here does not match what you have seen on site, say so.