When the Crime and Policing Act 2026 Lands, Will Your CCTV Evidence Actually Be Usable?

Picture this: someone walks out with £180 of stock, twice in the same week. Under the old rules, that is a summary-only matter, dealt with quietly if at all. The Crime and Policing Act 2026 is meant to change that. Theft becomes theft, whatever the value on the receipt. Assaulting a shop worker gets its own criminal offence.

None of that is live yet. And even once it is, the Act does not do the hard part for you. It only makes prosecution possible. Whether it actually happens still depends on one thing: can your CCTV identify the person who did it?

Three checks are worth running against your own CCTV this week – before an incident forces the question, not after.

The Big Picture

• Not yet in force on the shop floor. Sections 45 to 47 received Royal Assent in April 2026 but were left out of the first commencement order. Assault and low-value theft are still charged under the existing law until a further regulation names a date.
• The evidential bar is about to matter more, not less. Once the £200 theft threshold repeal commences, far more incidents become chargeable as either-way theft. But only where you can produce footage that identifies the person.
• Camera placement should follow your incident pattern, not habit. Where cameras point should track where abuse and theft actually cluster on your premises, not just where a default installation happened to put them.
• There is no legal retention period to hide behind. UK GDPR sets no fixed number of days. You decide, document and defend your own retention window.
• Test the system before you need it. Ask us to check the export format, timestamps and footage detail against what your local force’s evidence system actually needs – that is worth more than another spec sheet.

What the Act Changes and When

The Crime and Policing Act 2026 received Royal Assent on 29 April 2026. Part 3, headed “Retail Crime,” contains three sections that matter to anyone running CCTV in a retail setting.

Section 45 creates a standalone offence of assaulting a retail worker. It carries a maximum penalty of six months in prison and/or an unlimited fine, according to the Home Office’s retail crime factsheet on gov.uk. Section 46 requires a court to impose a Criminal Behaviour Order on first conviction, unless a custodial or other order already applies. A CBO – a civil order – can bar someone from named premises. Breaching a CBO is itself a criminal offence.

Section 47 repeals the £200 threshold that let low-value shop theft be tried only in a magistrates’ court. Once in force, all shop theft becomes an either-way offence, meaning it can go to the Crown Court, with a maximum of seven years.

Here is the part that gets missed in most of the coverage. The Crime and Policing Act 2026 (Commencement No. 1 and Saving Provision) Regulations 2026 brought a first tranche of the Act into force on 29 June 2026. That tranche covered anti-social behaviour powers, firearms offences and several others. It did not commence sections 45, 46 or 47. Today, assault on a shop worker is still charged as common assault or ABH and low-value theft is still triaged as summary-only. The retail provisions are enacted, but they are not yet in force – and a further commencement regulation is what will change that.

Why the Evidential Burden Is Shifting to You

The £200 threshold was widely treated as a “licence to steal,” and the government has said as much. But repealing it does not, by itself, put more offenders in front of a court. It removes a technical barrier to charging. What determines whether a case actually proceeds hasn’t changed. It still comes down to usable evidence, a coherent incident record logged with a crime reference number and a statement that stands up.

The scale of the problem is not in dispute. The British Retail Consortium (BRC) Crime Report 2026 recorded around 1,600 violence and abuse incidents against shop workers a day in the year to August 2025. That is down roughly 20% on the year before. Physical violence itself barely moved, at 118 incidents a day. Thirty-six of those a day involved a weapon. The BRC also recorded 5.5 million detected theft incidents, costing close to £400 million. Separately, the Office for National Statistics recorded 509,566 police-recorded shoplifting offences for the year ending December 2025 – a fraction of the BRC figure. The two measure different things. ONS counts what reaches police records; the BRC counts what retailers detect.

“Retail theft is a significant challenge for retailers, with our own figures showing 5.5m detected incidents of theft last year… the rise in organised crime is particularly worrying as gangs systematically target one store after another across the country.” – Lucy Whing, Crime Policy Adviser, British Retail Consortium

That pattern – the same offenders, the same stores, repeatedly – is exactly why blanket camera coverage is the wrong starting point. Scotland offers an honest preview of what happens next. Its equivalent standalone offence has been in force since 2021 and Police Scotland logged over 10,000 reported cases with a detection rate above 60%. Yet according to the Scottish Grocers’ Federation, only around 11.6% of reported cases resulted in a conviction. A new offence drives reporting and recording up quickly. Conviction still depends on the quality of the evidence and on court capacity – neither of which the legislation itself supplies. The same imbalance opens up for English retailers the moment section 47 commences: a chargeable offence with no matching improvement in the evidence base underneath it, unless that evidence base is fixed first.

The Three-Part CCTV Audit to Run This Week

None of this requires waiting for a commencement date. The three checks below are things you can run against your existing system now – the same checks we work through during an operational requirement (OR) survey, the document that specifies what your CCTV system needs to achieve.

Audit One: Camera Placement Against Your Local Incident Pattern

A familiar pattern: your best camera covers the car park, while your till point – where every confrontation actually happens – gets a wide-angle view from the ceiling that shows the top of everyone’s head.

The College of Policing’s Crime Reduction Toolkit rates targeted, hot-spot-led measures as having the strongest evidence base for reducing crime. It rates CCTV itself as moderately useful for property crime evidence, but weak on its own for deterring violence. The practical lesson: point your cameras at where incidents on your premises actually cluster, not at where a default installation happened to put them.

This is the same ground we cover on a site survey: walk your own incident log, till exceptions and any recent theft or confrontation reports, then check three things at each pressure point – entrances, the till or point of confrontation and stock or delivery access:

• Is the camera mounted low and angled enough to capture faces, not just the crown of the head?
• Is there a bright window or doorway behind the subject, silhouetting them against the light?
• Is the frame rate high enough to reconstruct a fast-moving incident rather than a slideshow of missed frames?

A site survey also checks pixel density against the standard your system was specified to. BS EN 62676-4:2015 is the older application-guidelines standard that many existing CCTV systems were designed to, using a four-step pixel-density scale measured in pixels per metre (PPM). Its successor, BS EN IEC 62676-4:2025, published in November 2025, supersedes it with a revised seven-step pixel-density model. Both editions currently sit alongside each other during a transition period. The key question for an existing site is which edition your operational requirement was written against, and whether your entrance and till cameras still achieve the required density at those exact points – not just “high definition” in general terms.

Audit Two: Retention Periods Against the New Evidential Expectations

Most CCTV retention settings get decided once, at installation and never revisited. Thirty days is a common default. It is worth knowing where that number actually comes from.

There is no statutory retention period for CCTV footage under UK law. The oft-quoted “30 days” is industry convention, not a legal requirement. UK GDPR and the Data Protection Act 2018 govern any footage that captures identifiable people. You need a lawful basis for recording and clear signage. Where the processing is high-risk, the Information Commissioner’s Office (ICO) expects a documented data protection impact assessment (DPIA) before you start. Under the storage limitation principle, your retention period should be one you can justify to the ICO – not one you inherited.

Once the threshold repeal commences, more incidents become worth pursuing and the gap between an incident and a formal evidence request can stretch out. A retention window set for convenience is not the same as one set for how long a report realistically takes to log, escalate and request. Get the two out of step and the footage may already be gone. Check your documented retention period against how your own reporting and escalation process actually runs, not against the number the installer defaulted to years ago.

Audit Three: Get Your Footage Export Tested Before an Incident Forces the Question

Then the moment comes: an incident happens and you pull the footage with confidence. The export turns out to be too compressed, in the wrong format or missing the timestamps the officer needs – and you find out at the worst possible moment.

Retailer satisfaction with police response has been low, but it is improving. The BRC Crime Report 2026 recorded just 13% of retailers rating the response good or excellent for the year to August 2025, up from 9% previously. Part of that gap sits with policing capacity – though the National Police Chiefs’ Council’s Retail Crime Action Plan commits forces to prioritise attendance where an offender has been detained by store security or where evidence needs securing on scene. Part of the gap sits with retailers supplying footage that is not actually usable. You can only influence the second one.

Before an incident, not after, this is exactly the kind of check we build into a proper site visit. Police forces increasingly handle CCTV submissions through a formal digital evidence platform – the College of Policing’s own guidance on schemes such as Operation Shopkeeper points to systems including NiCE Investigate – so “usable” has a specific, checkable meaning. When we test a sample export against that standard, we can confirm the file format opens without special software, the timestamps are intact, the footage is detailed enough at the entrance and till to support identification rather than just confirm something happened, and the file matches what your force’s digital-evidence or online crime-reporting portal will accept.

If your system is monitored and detector-activated, rather than passive recording, a different standard applies: BS 8418:2021. This is the British Standard for remotely monitored CCTV. It is what lets an NSI (National Security Inspectorate) Gold-approved or SSAIB (Security Systems and Alarms Inspection Board) Registered Firm register a system for a police unique reference number or URN. We can tell you whether registering for a URN is worthwhile for your site, and build it into the specification if attracting a live police response matters to you.

What CCTV Can Do and What It Cannot

Honesty here protects you as much as it protects our own reputation. CCTV is genuinely useful for identification evidence after the fact and in practice it works best alongside other evidence, not instead of it – a written incident account, witness statements and any other footage or images available all strengthen a file. The College of Policing rates CCTV’s evidence base as weaker for deterring violence in the moment. Evidence for retail tagging (EAS) is similarly mixed – a systematic review found no statistically significant overall deterrent effect, though visible tags outperform hidden ones.

No CCTV System can guarantee a police response. Attendance depends on factors outside our control, including local policing capacity. For monitored systems, it also depends on whether a URN is active – police can withdraw one under the long-standing “three strikes” false-alarm rule. No system stops a determined offender outright. What a well-specified, correctly retained and pre-tested system does is put the evidence in place for a prosecution to happen. That is the one part of this picture the legislation itself cannot supply.

Frequently Asked Questions

Have Sections 45 to 47 of the Crime and Policing Act 2026 come into force yet?

Not yet. The Act received Royal Assent on 29 April 2026, but sections 45 to 47 – the retail worker assault offence, the Criminal Behaviour Order requirement and the repeal of the £200 theft threshold – were left out of the first commencement order. The Crime and Policing Act 2026 (Commencement No. 1 and Saving Provision) Regulations 2026 brought a first tranche into force on 29 June 2026, covering anti-social behaviour powers and firearms offences among others, but not the retail provisions. Until a further commencement regulation names a date, assault on a shop worker is still charged as common assault or ABH and low-value theft is still triaged as summary-only.

What does Section 47 actually change once it commences?

Section 47 repeals the £200 threshold that currently lets low-value shop theft be tried only in a magistrates’ court. Once in force, all shop theft becomes an either-way offence, meaning it can be sent to the Crown Court, with a maximum sentence of seven years. That removes a technical barrier to charging, but it does not by itself put more offenders in front of a court. Whether a case actually proceeds still depends on usable evidence, a coherent incident record, and a statement that stands up – none of which the legislation supplies. Scotland’s equivalent standalone offence shows the gap: over 10,000 reported cases but only around 11.6% resulting in conviction.

What is the difference between Section 45 and Section 46 of the Act?

Section 45 creates a standalone criminal offence of assaulting a retail worker, carrying a maximum penalty of six months in prison and/or an unlimited fine. Section 46 requires a court to impose a Criminal Behaviour Order, or CBO, on first conviction under Section 45, unless a custodial or other order already applies. A CBO is a civil order that can bar a named individual from specified premises, and breaching a CBO is itself a criminal offence. Like Section 47, neither section is in force yet – both received Royal Assent in April 2026 but were left out of the first commencement order, so assault on a shop worker is still charged as common assault or ABH for now.

How long should CCTV footage be retained under UK GDPR?

There is no statutory retention period for CCTV footage under UK law. The commonly used 30 days is industry convention, not a legal requirement. UK GDPR and the Data Protection Act 2018 govern any footage capturing identifiable people. You need a lawful basis for recording and clear signage telling people they are on camera. If the processing counts as high-risk, which most retail CCTV does, you also need a data protection impact assessment that follows Information Commissioner’s Office (ICO) guidance. Under the storage limitation principle, the retention period should be one that can be justified to the ICO, not one inherited from an installer’s default. It should also be checked against how long a report realistically takes to log, escalate and request, since a gap between an incident and a formal evidence request can mean the footage is already gone.

What is BS 8418:2021 and when does it apply?

BS 8418:2021 is the British Standard for remotely monitored, detector-activated CCTV – as opposed to passive recording that is only reviewed after the fact. It is what lets an NSI Gold-approved or SSAIB Registered Firm register a system for a police unique reference number or URN, which is a prerequisite for attracting a live police response to an alarm activation. A URN is not permanent: police can withdraw one under the long-standing “three strikes” false-alarm rule. Whether this standard is relevant to a given site depends on whether the system is monitored and detector-activated rather than simply recording and whether a live police response to an incident in progress matters.

Before You Go

The Crime and Policing Act 2026 is enacted but not yet in force on the retail provisions. Sections 45 to 47 await a further commencement regulation and until then the existing law applies. That gives you a genuine window to get ready rather than react.

The three checks are worth running this week, in order:

• Check camera placement, angle and pixel density against your actual incident pattern – not just where the cameras happen to be.
• Check your documented retention period against your real reporting and escalation timeline, not against a number nobody chose deliberately.
• Get a sample export tested by your installer before an incident forces the question and fix whatever they flag.

Wait for a commencement date and you are reacting under pressure instead of preparing on your own schedule. Run the three checks now and the difference is far more likely to show on the day it matters: the face stays in frame, the footage is still there when the report is filed and the export opens without a scramble. We can review your camera coverage, retention settings and evidential export workflow in a single site visit, and confirm your system is actually ready to produce evidence, not just record it. Get in touch and we’ll book it in while it is still a planning exercise rather than a scramble.