NVR AI compatibility comes down to five tests: can software pull a stable RTSP or ONVIF stream, is there enough resolution on the target, is the codec H.264 or H.265, can the network carry the stream, and is the device secure and time-synced. If most cameras pass, you can add AI to existing security cameras and replace only those that fail the basics.
Key takeaways
- Many estates are retrofit candidates. If an NVR, DVR or camera exposes an RTSP stream in H.264 or H.265, AI software can usually analyze it.
- Pixels on target matter more than megapixels. Use the IEC 62676-4 DORI levels (25, 62, 125 and 250 pixels per meter) to check whether a camera supports the event you need.
- Do the bandwidth math before the pilot. Roughly 1.5 to 2.5 Mbps per 1080p H.264 stream adds up fast on a site uplink.
- Compatibility is not eligibility. Hikvision and Dahua equipment may work technically but face US federal procurement and FCC restrictions in some contexts.
- You can test a camera in one afternoon. A free tool like ffprobe confirms codec, resolution and frame rate.
Should you retrofit or replace your CCTV?
Retrofitting means keeping cameras and recorders in place and adding an AI layer that reads their streams. Replacing means swapping cameras, recorders or both, usually to get a vendor's own analytics platform. For the cost view, see our post on retail shrinkage prevention without new cameras.
This checklist gives the tests behind each pass/fail call, so you upgrade CCTV to AI where it works and replace only where justified. Key terms:
- NVR (network video recorder) is a recorder that stores video from IP cameras over a network.
- DVR (digital video recorder) is a recorder that digitizes and stores video from analog or HD-over-coax cameras.
- RTSP (Real Time Streaming Protocol) is the protocol most cameras and recorders use to hand a live stream to other software.
- ONVIF is an industry standard that lets cameras, encoders and video software from different manufacturers interoperate.
The NVR AI compatibility checklist
Work through each group per camera and recorder model, not per camera. Most estates repeat a handful of models, so a dozen tests can cover hundreds of cameras.
1. Can AI software access the stream?
- RTSP is exposed and authenticated. Confirm each camera or recorder publishes an RTSP URL with a username and password. Our sister guide on how to find a camera's RTSP URL covers URL formats by brand.
- ONVIF profile is known. ONVIF Profile S covers basic IP video streaming and configuration for cameras and video encoders. ONVIF is deprecating Profile S, with March 31, 2027 as the last date for product conformance submissions. Profile T adds H.264 and H.265 streaming, metadata, and motion and tamper events, so prefer it for newer devices.
- Decide: direct-to-camera or NVR re-stream. NVR re-streaming is simpler (one device, one credential set) but adds a hop. Check the recorder's limit on simultaneous remote streams.
- Separate service account. Use a dedicated, view-only user for the analytics connection so you can audit and revoke it.
2. Is the video quality good enough for the event?
AI detection depends on how many pixels land on the person or vehicle, not on headline megapixels. The common yardstick is DORI, from IEC 62676-4, which defines four levels in pixels per meter (ppm) at the target. The figures below are from the DORI explainer by Infiniti Optics, citing IEC EN 62676-4:2015.
- Detect. Pixels per meter: 25 ppm; What it supports: Something is present (person or vehicle).
- Observe. Pixels per meter: 62 ppm; What it supports: Some detail, such as clothing color or general activity.
- Recognize. Pixels per meter: 125 ppm; What it supports: Tell whether a person is someone seen before.
- Identify. Pixels per meter: 250 ppm; What it supports: Identify an individual beyond reasonable doubt.
How to apply it:
- Calculate ppm from scene width. Divide horizontal resolution by the scene width at the target distance. A 1080p camera (1,920 pixels wide) covering a 15-meter gate gives about 128 ppm; covering a 30-meter yard, about 64 ppm.
- Match the level to the event. Perimeter breach and after-hours activity usually need detect to observe. Equipment tampering and PPE checks need more, because the action is small in the frame.
- Frame rate. Fast actions (a vehicle at speed, a hand at a cabinet) need more frames per second than a person standing in a zone. Ask vendors what each detection needs.
- Main stream vs sub-stream. A low-resolution sub-stream may handle "person in zone" on a near view but fail at range. Test both.
3. Which codec and bitrate settings work?
- H.264 or H.265. Both are widely supported for AI ingestion. H.265 uses less bandwidth at similar quality but costs more compute to decode. Avoid MJPEG for continuous analysis, as bitrates are far higher.
- Watch proprietary "smart" codecs. Storage-saving modes with long gaps between keyframes (I-frames) can smear motion. Shorten the keyframe interval on the analyzed stream if quality drops.
- Capped bitrate. Set a ceiling so a busy or rainy scene does not flood the uplink.
4. Are placement, lighting and IR suitable?
- Angle. A moderate downward angle shows body shape better than a straight-down or near-horizontal view. Fisheye views suit counting more than behavior detection.
- Night performance. Check rated IR range against the real distance to the zone. A fence beyond IR range will be dark and noisy at night.
- Backlight and glare. Docks and entrances facing the sun produce silhouettes. Enable WDR (wide dynamic range) and test at the worst time of day.
- Lens condition. Spider webs, dust and condensation cause false motion. Clean lenses before the pilot.
5. Can the network carry the streams?
Bandwidth is where many pilots stall, especially at remote sites. One stream vendor's recommended bitrate guide (updated March 2026) lists these ranges at 15 to 30 frames per second:
- 720p: 1 to 1.5 Mbps (H.264), 0.6 to 1.2 Mbps (H.265)
- 1080p: 1.5 to 2.5 Mbps (H.264), 1 to 2 Mbps (H.265)
- 4 MP: 3 to 4 Mbps (H.264), 2 to 3 Mbps (H.265)
- 4K (8 MP): 4 to 6 Mbps (H.264), 3 to 5 Mbps (H.265)
Worked example: 20 cameras sent off-site at 1080p H.264 need roughly 30 to 50 Mbps of sustained upload, before overhead. The same 20 cameras on 480p H.265 sub-streams (0.3 to 0.6 Mbps each in that guide) need about 6 to 12 Mbps.
- Ask where analysis happens. On-site analysis sends only events and clips off-site; off-site analysis puts every analyzed stream on the uplink. Ask each vendor what upload they need per camera.
- Measure at peak. Test sustained upload during busy hours, not a night-time speed test.
- Plan for degraded links. Sites on cellular, satellite or microwave backhaul need local recording that continues through drops.
- Segment camera traffic. Put cameras and recorders on their own VLAN and allow only the analytics connection out.
6. Is time synchronized?
- One NTP source. NTP (Network Time Protocol) keeps device clocks aligned. Point every camera and recorder at the same server; drift breaks correlation with access-control logs and alerts.
- Correct time zone per site. Multi-region estates often have recorders left on the installer's time zone.
- Spot-check the overlay. Compare the on-screen timestamp with a known clock.
7. Is the estate secure enough to connect?
Our threat detection deployment guide covers the general baseline. Camera-specific checks:
- No public exposure. Remove port-forwarding rules and disable UPnP so no camera or NVR is reachable from the internet.
- Firmware current. Old firmware carries known, exploited flaws. For example, CVE-2021-36260, a command injection flaw in some Hikvision products, scores 9.8 (critical) in the US National Vulnerability Database and was added to CISA's Known Exploited Vulnerabilities catalog in January 2022.
- No default credentials. CISA's Secure by Design alert (December 2023) calls on manufacturers to eliminate default passwords because attackers exploit them. On your side, change every default and remove unused accounts.
- Encrypted transport where supported. Profile T includes HTTPS streaming for devices that support it. Ask your vendor how streams are protected between site and platform.
8. Do procurement or regulatory restrictions apply?
This is eligibility, not technical compatibility: a camera can stream perfectly and still be a problem for a specific buyer. Confirm what applies with your legal or procurement team.
- US federal contracting (NDAA Section 889). FAR 52.204-25, which implements Section 889, prohibits federal agencies from procuring covered equipment and from contracting with entities that use it. For Hytera, Hikvision and Dahua video surveillance equipment, coverage applies to public safety, government facility security, physical security surveillance of critical infrastructure and other national security purposes.
- FCC Covered List. The FCC Covered List has included Hikvision, Dahua and Hytera video surveillance equipment, with the same purpose limits, since March 2021. Since February 2023, the FCC has not authorized new covered equipment; equipment authorized before then is not affected by that prohibition.
- Later FCC changes. In October 2025 the FCC adopted a procedure to limit existing authorizations of covered equipment, which can restrict further import and marketing in the US. The FCC stated this does not prohibit continued use of devices already in service.
- Outside the US. Other countries and large enterprises have their own procurement policies. Do not assume a US rule applies elsewhere, or that no rule means no restriction.
9. Does recording and retention meet policy?
- Keep the recorder as system of record. The NVR or VMS should hold the evidence copy and chain of custody, not the AI layer alone.
- Verify retention days per site. Confirm drives hold what policy or law requires, especially after bitrate changes.
- Ask what the AI layer keeps. How long clips and metadata are stored, where, and who can export them.
10. Can analog and HD-over-coax cameras be included?
- HD-over-coax DVRs. HD-TVI, HD-CVI and AHD cameras feed hybrid DVRs that usually re-stream each channel over RTSP. Test the DVR like an NVR.
- Video encoders. An IP video encoder converts an analog feed to a network stream; ONVIF Profile S lists encoders as conformant devices.
- Be realistic about resolution. Standard-definition cameras rarely reach recognize level but may support detect-level events such as after-hours presence.
11. Is naming consistent across sites?
An alert that says "Camera 14" is slower to verify than one naming the site, zone and view.
- Adopt a pattern before onboarding, such as SITE012-DOCK-N-CAM04 (site, zone, direction, camera).
- Match names across NVR, VMS and the AI layer, and record each view's purpose, such as perimeter breach on a fence camera.
Red flags: when replacing makes more sense
Replacement wins when the problem is the capture itself, because AI cannot analyze what was never recorded. Watch for:
- No stream access at all. Proprietary recorders with no RTSP or ONVIF output and no vendor path to enable it.
- Unpatchable firmware. End-of-life devices with known critical vulnerabilities and no updates.
- Pixels far below the event's needs. A wide view at under 25 ppm where you need to see tampering or PPE.
- Night scenes that are black or noise. IR range far short of the zone, and no option for supplementary lighting.
- Chronic hardware faults. Cameras that drop, reboot or lose focus repeatedly.
- Eligibility issues. Equipment that your buyer, regulator or contract does not allow, regardless of technical performance.
Often the answer is mixed: keep most cameras, re-aim or re-light some, and replace a few.
How to test NVR AI compatibility in one afternoon
Run these steps from a laptop on the camera network with FFmpeg installed, using a test account and one camera of each model.
- Get the RTSP URL from the camera or NVR (see our RTSP URL guide), such as rtsp://viewer:PASSWORD@192.0.2.10:554/<path>.
- Read the stream properties with ffprobe. Run ffprobe -v error -rtsp_transport tcp -select_streams v:0 -show_entries stream=codec_name,width,height,avg_frame_rate -of default=nw=1 "rtsp://viewer:PASSWORD@192.0.2.10:554/<path>". Expect codec (h264 or hevc), resolution and frame rate.
- Force TCP if UDP fails. The FFmpeg RTSP options let you choose tcp, udp or HTTP tunneling with -rtsp_transport. TCP is more reliable across firewalls.
- Measure real bitrate. Record 60 seconds without re-encoding: ffmpeg -rtsp_transport tcp -i "<rtsp-url>" -t 60 -c copy sample.mp4. Divide the file size in megabits by 60 to get Mbps, during a busy period.
- Repeat for the sub-stream and run one 10-minute capture (-t 600) to spot drops.
- Check ppm on a still. Grab a frame with ffmpeg -rtsp_transport tcp -i "<rtsp-url>" -frames:v 1 frame.jpg and measure a known object, such as a door, to estimate ppm at the zone.
- Log results per model: codec, resolution, frame rate, measured bitrate, ppm, firmware version, timestamp accuracy, pass or fail.
Never paste real credentials into shared documents or tickets, and rotate the test password afterward.
How Kotelab fits an existing CCTV estate
Kote by Kotelab is an intelligence layer for existing CCTV, not a camera replacement. It connects to existing IP cameras and RTSP-capable DVR/NVR streams, and Kotelab lists compatibility with Hikvision, Dahua, Uniview, Axis, Bosch, Hanwha Vision, Sony and Avigilon cameras. See the Kote platform for agentic physical security for how it monitors connected feeds and surfaces configured events, such as perimeter breach, restricted-zone entry and after-hours activity, with site, zone, camera, time and clip for human review.
Onboarding follows three steps: define the operational need (zones, events and owners), review the camera estate, then configure and evaluate with your operators. This checklist is the camera estate review, so running it first shortens the path to a pilot. For encryption and retention details, see the Kotelab security page.
Weighing retrofit against a platform switch? See our Kotelab vs Verkada comparison and the buyer's guide to AI video analytics software for existing cameras.
Frequently asked questions
Can I add AI to existing security cameras without replacing them?
Usually, yes. If your cameras or NVR/DVR can output an RTSP stream in H.264 or H.265, AI video analytics software can typically analyze it. Replacement is needed mainly where cameras lack stream access, have poor image quality for the event, or run unsupported firmware.
Is it better to connect AI to the NVR or directly to the cameras?
Through the NVR is simpler: one device and one credential set serve many channels. Direct connection avoids the recorder's stream limits and an extra hop. Mixed approaches are common.
What resolution do cameras need for AI detection?
It depends on pixels on target, not total megapixels. IEC 62676-4 sets DORI levels of 25 ppm to detect, 62 ppm to observe, 125 ppm to recognize and 250 ppm to identify. Most perimeter and restricted-zone events work at detect to observe levels.
How much bandwidth does an AI-connected camera use?
One published guide puts a 1080p stream at about 1.5 to 2.5 Mbps in H.264 and 1 to 2 Mbps in H.265. Uplink load matters most when streams are analyzed off-site, and sub-streams cut it substantially.
Do ONVIF Profile S cameras still work with AI software?
Yes, most do, because they still output standard RTSP streams. ONVIF is deprecating Profile S, with March 31, 2027 as the last date for product conformance submissions. Deprecation affects certification of new products, not installed cameras.
Can I keep using Hikvision or Dahua cameras with AI analytics?
Technically, many Hikvision and Dahua devices stream over RTSP and can be analyzed. Whether you should depends on context: NDAA Section 889 and the FCC Covered List restrict this equipment for certain uses in the US. Check the rules for your organization, customers and country.
Check your camera estate with Kotelab
Run the checklist on your highest-risk cameras first, then bring the results to us. We will review your camera estate, confirm which streams can connect, and set up an evaluation with your operators. Talk to the Kotelab team.