Skip to content
Safety Tech Review
Menu
The GuideIndustriesInsightsNewsVendorsGlossaryAboutSearchContact

Regulation

Who can sell safety tech where: a 2026 matrix by vendor country

A matrix of vendor origin (US, UK, EU, China, Israel, Japan and Korea) against six markets, with the law, ban, adequacy decision or funding fact behind each cell.

By · Updated · 10 min read · 40 sources

A safety technology vendor's home country now decides more than its accent. It decides which public tenders it can enter, how easily it can move worker video across borders, and which governments pay customers to buy it. This article maps those rules as a matrix: six vendor origins against six markets, with the mechanism behind every cell.

The matrix shows legal and funding mechanisms only. It says nothing about product quality, and it does not rank vendors. Company names are examples. For one camera brand family in detail, see Hikvision and Dahua restrictions by country. For UK and US vendors at EU sites, see AI safety cameras in Europe.

Three kinds of rule decide who can sell where

Security and procurement bans. These follow public money. In the US, Section 889 bars federal agencies from buying covered Hikvision, Dahua and Hytera equipment for listed security purposes and from contracting with companies that use it [1]. From October 13, 2026, the FCC will not authorize new devices containing logic-bearing components from Covered List entities [2]. The UK restricts such cameras on sensitive government sites [3] and allows suppliers to be excluded from public contracts on national security grounds [4].

Data transfer rules. These decide where worker video can be processed. The EU recognizes the UK, Israel, Japan, the Republic of Korea and certified US companies under the Data Privacy Framework (DPF) as providing adequate protection [5]. The DPF is the only one of those now on appeal at the Court of Justice of the EU [6].

Product law and home-market policy. EU product law applies to all non-EU suppliers alike, including the revised Product Liability Directive from December 9, 2026 [7] and the Cyber Resilience Act, whose main duties apply from December 11, 2027 [8]. China gives qualifying domestic products a 20% evaluated-price advantage in government procurement from January 1, 2026 [9] and requires a contract, certification or security assessment for most exports of personal data [10]. Some governments create demand directly: Singapore has required video surveillance at high-risk areas of construction sites with contracts of S$5 million or more since June 1, 2024 [11], and Korea subsidizes up to 80% of approved smart safety equipment for small workplaces [12].

The matrix

Each cell names the mechanism, its source and a short "so what" for buyers. "No specific mechanism found" means our research found none.

Origin / market United States United Kingdom European Union China Saudi Arabia and UAE Asia-Pacific (SG, KR, JP, AU)
US vendors Home market. Not covered by Section 889, which names Huawei, ZTE, Hytera, Hikvision and Dahua [1]. Deep capital: Voxel raised $61 million in total [13]. Barrier: Illinois BIPA, for example a $12.1 million timeclock settlement [14]. So what: default for federally linked buyers. UK adequacy regulations cover US companies certified to the UK Extension of the DPF [15]. Barrier: ICO proportionality, as in the Serco notice [16]. So what: competitive with non-biometric designs. DPF on appeal [6]; German works councils [17]. Mitigation: EU hosting, as Verkada has offered since 2023 [18]. So what: must sell EU processing, not only features. 20% domestic price advantage in government tenders [9]; personal data export rules [10]. So what: largely limited to multinationals' private sites. Saudi PDPL transfers need contractual safeguards and a risk assessment; no adequacy list yet [19]. So what: expect local hosting requests. Korea's AI Basic Act requires a local representative for foreign firms above thresholds [20]. So what: follow multinational customers.
UK vendors Not covered by Section 889 [1]. Barrier: smaller disclosed rounds; Reactec was sold to Ideagen in 2025 [21]. So what: niche products or acquisition. Home market. ICO enforcement shows what to avoid [16]. Not caught by the sensitive-site restriction, which targets companies subject to China's National Intelligence Law [3]. So what: credibility with public bodies. EU adequacy for the UK until December 27, 2031 [22]. Same product law as any non-EU supplier [7][23]. So what: easier data story than US vendors, same product burden. Same price advantage and data export barriers as US vendors [9][10]. So what: effectively closed. Same Saudi transfer rules [19]. So what: no structural edge found. UK adequacy regulations cover Korea [15]. So what: modest data advantage.
EU vendors Not covered by Section 889 [1]. Protex AI runs a Dublin European HQ and a Boston US HQ [24]. So what: EU origin is no handicap. UK adequacy regulations cover all EEA countries [15]. So what: near-home market. Home market. Works council co-determination [17] and AI Act dates [25] are known to local suppliers. So what: compliance is expected, not a differentiator. Same price advantage and data export barriers [9][10]. So what: hardware through local channels at most (not researched). Same Saudi transfer rules [19]. So what: no structural edge found. EU adequacy decisions for Japan and Korea [5]. So what: smooth data flows with both.
Chinese vendors Section 889 [1]; Covered List components barred from new FCC authorizations from October 13, 2026 [2]; Entity List since 2019 [26]. Private use not banned. So what: out of federal and critical uses. Sensitive-site restriction since 2022 [3]; national-security exclusion possible [4]. No private-sector ban found. So what: private sales continue. No EU-wide ban found; Cyber Resilience Act and product liability apply equally [7][8]. So what: price competes where buyers are private. Home market. Hikvision reported RMB 92.51 billion of 2025 revenue [27]; 20% domestic price advantage [9]; state targets for intelligent mines [28]. So what: dominant and partly protected. Hikvision and alfanar make security products in Riyadh under "Made in Saudi" (sponsored company news) [29]. So what: strongest local-content story found. Australia announced removal from Defence sites in 2023 [30]; Canada ordered Hikvision Canada to wind up in 2025 [31]. So what: closed in parts of the public sector, open elsewhere.
Israeli vendors Not covered by Section 889 [1]. Versatile says over 40% of leading North American general contractors use CraneView [32]. So what: strong in construction. UK adequacy regulations cover Israel [15]. So what: data story similar to UK vendors in the EU. EU adequacy decision for Israel [5]. So what: comparable to UK vendors. Same price advantage and data export barriers [9][10]. So what: effectively closed. No specific mechanism found beyond the Saudi transfer rules [19]. No specific mechanism found.
Japanese and Korean vendors Not covered by Section 889 [1]. Hanwha Vision says AI cameras were 49% of its network camera sales in late 2025 [33]. So what: benefit from Chinese exclusion. UK adequacy covers Korea fully and Japan's private sector [15]. Hanwha Vision says Omdia ranks it second in the UK [33]. So what: same benefit. EU adequacy for Japan and Korea [5]. Milestone is part of Japan's Canon Group [34]. So what: Japanese capital already inside EU video software. Same price advantage and data export barriers [9][10]. So what: effectively closed. Same Saudi transfer rules [19]. Not researched further. Korea: the Serious Accidents Punishment Act covers employers with five or more workers [35], and small workplaces get up to 80% equipment subsidies [12]. So what: subsidized home demand for Korean makers.

The six cells that matter most for buyers

1. Chinese vendors in the US. This is the most restricted cell. Section 889 applies to federal agencies and to any company that holds a federal contract and uses covered equipment [1]. The FCC component rule from October 13, 2026 will limit which new devices reach the US market, including devices that hide Covered List parts under another brand [2]. A private warehouse can still use installed cameras. Our article on the FCC component rule explains what to ask vendors.

2. US vendors in the EU. The DPF survived its first court challenge in September 2025, but the appeal is pending [6]. If it falls, transfers to the US would need standard contractual clauses and transfer assessments. US vendors answer with EU hosting [18]. In our assessment, a US vendor with real EU-only processing and an EU entity closes most of this gap.

3. UK vendors in the EU. The UK's adequacy decisions were renewed on December 19, 2025 and run to December 27, 2031 [22]. That is a genuine advantage on data, but it ends there. Product liability, the Machinery Regulation from January 20, 2027 [23] and the Cyber Resilience Act [8] treat UK and US suppliers the same. In the US market, the reverse holds: UK origin is legally neutral, and funding is the gap. US-based Voxel raised $44 million in 2025 [13] and Intenseye $64 million in 2024 [36], while we found no UK-headquartered AI video safety specialist with a comparable disclosed round. That is an absence of evidence, not proof.

4. Any foreign vendor in China. China's state is a large buyer of safety technology. A 2024 policy from seven agencies set 2026 targets of at least 60% intelligent coal mine capacity and intelligent equipment or robots in at least 30% of dangerous coal-mine positions [28]. China reported 1,066 intelligent coal mines covering more than 65% of capacity by the end of 2025 [37]. Foreign vendors face the 20% evaluated-price advantage for domestic products [9]. Exports of personal data need a security assessment above 1 million people (or 10,000 for sensitive data) a year, with exemptions including HR management [10]. Facial recognition rules in force since June 1, 2025 require face data to be kept within the collecting device where possible [38]. In our view, this is a market for local vendors and local hosting.

5. Chinese vendors in the Gulf. Hikvision's Riyadh manufacturing with alfanar is tied to Saudi Arabia's local-content program [29]. We found no comparable local-content story for any Western analytics vendor. Saudi data transfer rules apply to every foreign vendor equally [19], so local hosting is a likely ask whatever the origin.

6. Korean vendors in Korea. Korea's Serious Accidents Punishment Act has reached employers with five or more workers since January 27, 2024 [35]. The government's smart safety equipment program covers up to 80% of the assessed cost, capped at KRW 30 million per workplace, for workplaces with fewer than 50 workers, and its eligible items include AI human-detection systems [12]. Foreign vendors can sell there too, but must appoint a local representative under the AI Basic Act if they meet its thresholds [20].

Rules that apply whatever the origin

Some rules bite on the buyer, not the vendor, and no vendor nationality avoids them. In Illinois, collecting face geometry without written consent risks BIPA claims [14]. California's rules on automated decision-making for significant decisions apply from January 1, 2027 [39], and Colorado's replacement AI law takes effect the same day [40]. In Germany, a works council has a say over any system objectively capable of monitoring behavior or performance [17]. The guide chapter on privacy law and workers covers these in depth, and the vendor landscape chapter profiles vendors by category.

What to do next

  • For each site, list which rules apply: worker privacy, procurement or security, and product law.
  • Ask every vendor where it is incorporated, where it processes data and which entity will sign the contract.
  • Ask camera, recorder and edge box suppliers for a parts statement naming the makers of logic-bearing components.
  • At EU sites, ask US vendors for an EU-only processing option, and ask all non-EU vendors for their product liability and Cyber Resilience Act plans.
  • In Korea and Singapore, check whether the purchase qualifies for a subsidy or meets a legal mandate.
  • Recheck this matrix in 2027: the DPF appeal, the FCC's further rulemaking and the EU product law dates could change several cells.

Frequently asked questions

+Does a vendor's home country matter if I am a private company?

Less than it does for public bodies. For private buyers the vendor's country matters mainly through data transfers, local support and what your own customers require. Procurement bans mostly apply to government work, federal contracts and critical infrastructure.

+Is a UK vendor easier to use in the EU than a US vendor?

On data transfers, yes: the EU's adequacy decisions for the UK run to December 2031. On product law, no: both are non-EU suppliers under the same EU rules.

+Can a foreign safety analytics vendor sell into China?

Mostly to private multinational sites. Government buyers get a 20% evaluated-price advantage for qualifying domestic products, and exporting personal data such as worker video needs a contract, certification or security assessment above set thresholds.

+Where is this matrix weakest?

Israeli and Japanese vendors in the Gulf, and all vendors in China's private market, are thinly documented. Cells marked 'no specific mechanism found' mean we did not find one, not that none exists.

Related reading

Sources

  1. [1]Acquisition.gov, FAR 52.204-25 (2021)
  2. [2]Federal Register, Protecting Against National Security Threats to the Communications Supply Chain Through the Equipment Authorization Program, 91 FR 57798 (2026)
  3. [3]The Register, UK bans Chinese CCTV cameras on 'sensitive' government sites (2022)
  4. [4]DWF, The Procurement Act 2023: excluding suppliers on national security grounds (2025)
  5. [5]European Commission, Adequacy decisions (2026)
  6. [6]WilmerHale, European Court of Justice to review challenge to EU-U.S. Data Privacy Framework (2025)
  7. [7]EU Transition Pathways, New EU product liability rules will apply to online platforms and software from December 2026 (2026)
  8. [8]European Commission, Safer and more secure digital products (2026)
  9. [9]China Briefing, China's new procurement policy favors 'Made in China': an explainer (2025)
  10. [10]Freshfields, China introduces revised cross-border data transfer rules (2024)
  11. [11]Rajah & Tann Asia, New WSH measures from 1 June 2024 (2024)
  12. [12]Bizinfo, 2023 Smart Safety Equipment Support programme notice, second round (2023)
  13. [13]DC Velocity, Voxel raises $44 million for visual AI that prevents accidents (2025)
  14. [14]Duane Morris Class Action Defense Blog, Illinois federal court approves $12.1 million BIPA class action settlement (2025)
  15. [15]ICO, Is the restricted transfer covered by adequacy regulations? (2026)
  16. [16]ICO, ICO orders Serco Leisure to stop using facial recognition technology (2024)
  17. [17]Bitkom, Künstliche Intelligenz und Mitbestimmung (2026)
  18. [18]Verkada, Verkada launches Command fully hosted in European data center (2023)
  19. [19]Clyde & Co, Update on Saudi Arabia's cross border data transfers: risk assessment guidelines (2025)
  20. [20]Cooley, South Korea's AI Basic Act: overview and key takeaways (2026)
  21. [21]Edinburgh Innovations, Spinout Reactec acquired by Ideagen (2025)
  22. [22]Hunton Andrews Kurth, European Commission renews UK data adequacy decisions (2025)
  23. [23]TÜV NORD, Machinery Regulation (EU) 2023/1230 (2026)
  24. [24]Protex AI, Protex AI secures $36M Series B (2025)
  25. [25]Milestone Systems, Milestone grows net revenue to EUR 298 million in 2025 (2026)
  26. [26]European Commission, AI Act: regulatory framework for AI (2026)
  27. [27]Federal Register, Bureau of Industry and Security, Addition of Certain Entities to the Entity List (2019)
  28. [28]Hikvision via PR Newswire, Hikvision releases 2025 full-year and 2026 first-quarter financial results (2026)
  29. [29]Ministry of Emergency Management of China et al., Guiding opinions on deepening intelligent mine construction (2024)
  30. [30]Arab News, Hikvision, alfanar to locally manufacture security solutions (2024)
  31. [31]VOA, Australian Defense Department to remove Chinese-made cameras (2023)
  32. [32]Innovation, Science and Economic Development Canada, Investment Canada Act national security decisions (2025)
  33. [33]Globes, Israeli AI construction optimization co Versatile raises $80m (2021)
  34. [34]Asia Business Daily, Hanwha Vision 2025 results (2026)
  35. [35]Kim & Chang, Scope of the Serious Accidents Punishment Act expanded as of January 27, 2024 (2024)
  36. [36]SiliconANGLE, Intenseye raises $64M Series B (2024)
  37. [37]Xinhua, Smart technologies power high-quality development of China's mining industry (2026)
  38. [38]China Briefing, China's facial recognition regulations: key business takeaways (2025)
  39. [39]California Privacy Protection Agency, announcement (2025)
  40. [40]Epstein Becker Green, Inside Colorado's Senate Bill 26-189 (2026)

Get the free Safety Tech Buyer's Toolkit

A 15-page PDF: the public evidence checklist, a weighted vendor scorecard, 40 RFP questions and pilot acceptance criteria. Subscribe and download it straight away; then one email a month when we publish or update guidance. No vendor promotions. Unsubscribe any time.