Stadium Security: What FIFA and UEFA Require

What actually binds a stadium security design: FIFA and UEFA stadium CCTV requirements at a glance

Four layers commonly shape a football stadium security plan. Only one of them comes from a governing body, and it is the layer most often quoted in isolation.

FIFA or UEFA requirements do not replace national law. A stadium may also face stricter competition rules or event-specific directions from football authorities, police, fire services and other public bodies.

The obligations in one table

The stadium CCTV requirements and the operational obligations around them fall into five areas.

These are minimums, not a complete design brief. A compliant venue security plan also depends on risk assessment, stadium geometry, national legislation and the requirements of the event being hosted.

What the regulations oblige you to cover

The obligations below are grouped by design domain rather than by governing body, because that is how they reach a specification. Each statement keeps its source: the two bodies overlap in subject but differ in wording and in how they bind a venue.

Coverage: which areas

Article 41 of the FIFA regulations requires an adequate and effective CCTV system, with monitors and control consoles in the VOC. It identifies the areas the system should cover:

• all entry and exit points
• approaches to the stadium grounds
• spectator accommodation inside the stadium
• stairways and passageways
• concession and refreshment areas
• the broadcast and TV compound
• player and official drop-off and pick-up points
• corridors to dressing rooms
• the player entrance to the field of play
• other key facilities, including on-site power generators

Article 41 of the UEFA Safety and Security Regulations sets a narrower scope in the same direction: the system should monitor spectators, approaches, entrances and viewing areas.

Together these lists give the coverage baseline. They do not establish how many stadium cameras are needed or what resolution each camera should use. Those decisions depend on the task at each location, the field of view, lighting, crowd conditions and the evidence the venue may need to produce.

Live monitoring and the control room

FIFA defines the primary purpose of CCTV as helping personnel in the VOC identify incidents or potential problems, assess the situation and inform the response. Recording for investigation and evidence is the secondary purpose. The regulations also make clear that CCTV does not replace stewarding or safety and security management.

That distinction matters. A stadium CCTV system designed only for post-event review does not meet the operational intent. Operators need usable live views, reliable communications and procedures for turning an observation into action.

FIFA treats the VOC as the operational centre of stadium security. It must be secure, have an overall view of the stadium interior and remain operational from before the public gates open until the venue has been cleared and returned to normal operations. The minimum posts listed for the VOC include:

• the stadium security officer
• the police commander
• representatives of the medical and fire services
• the chief steward
• CCTV operators
• communications operators and log keepers
• the ticketing coordinator

The room must support proactive and reactive video monitoring. It also holds the plans and information needed to manage an incident, including emergency and contingency plans, deployment plans, stadium maps and CCTV camera positions.

UEFA approaches the same room from the operating model rather than the post list. Its Article 41 calls for an integrated approach to safety, security and service through a stadium control room, CCTV, monitoring and communications, managed from the control room by the police commander, the safety and security officer and their staff.

This is where VMS and PSIM become relevant. The regulations do not require a named platform, but the operating model benefits from bringing video, maps, access events, alarms, communications and incident records into a controlled workspace.

Recording and evidence retention

FIFA requires CCTV recordings to be stored securely for 60 days after a match. If an incident or accident occurs, the relevant recording must be retained securely for two years in a reviewable format.

In practice, this creates two archive workflows:

• a rolling match archive sized for the 60-day requirement
• a protected evidence store that prevents relevant footage from being overwritten and preserves it for two years

National data-protection and evidential rules still apply. They may affect access, disclosure, export, deletion and whether other footage may be retained for the full FIFA period.

Resilience: trained operators and backup power

FIFA requires the CCTV system to have an uninterruptible power supply. Backup power should be sufficient to keep it operating at full load for up to three hours during an emergency such as a fire or mains failure.

The resilience design therefore needs to consider cameras, recording servers, network infrastructure and the operator environment — not just control-room displays.

People and procedures

FIFA states that CCTV personnel should be suitably trained and, where appropriate, qualified. Their training should cover operation of the system and the interpretation, use and storage of data.

Because the regulations name specific control-room posts on both sides, permissions and workflows in the security system should reflect those operational responsibilities rather than a generic administrator-and-operator split. This requires granular access control within the VMS or PSIM to assign distinct permissions for each regulated post, ensuring operators interact only with the video, maps, access events, alarms, communications, and incident records relevant to their designated role.

UEFA stadium categories 1 to 4 and what each one requires

The UEFA stadium categories are an infrastructure classification, and they are where UEFA's CCTV obligations become concrete. The 2025 UEFA Stadium Infrastructure Regulations set requirements by category:

An n/a entry in the UEFA infrastructure table does not mean that CCTV is unnecessary. National law, the safety certificate, FIFA rules where applicable, competition requirements and the venue risk assessment can still require it.

UEFA's requirement to show live ticket-control data alongside CCTV is particularly relevant to integrated security operations. It allows the control room to compare entry activity with visual conditions at gates and circulation areas instead of treating ticketing and video as separate systems.

Where the regulations stop

Neither body sets a universal requirement for:

• camera resolution or pixel density
• frame rate, bitrate or codec
• a fixed number of cameras
• video analytics or facial recognition
• a particular VMS or PSIM product

These are design decisions, not governing-body requirements. They should be based on the documented risk assessment, the purpose of each view, required evidence quality, lighting and sightlines, anticipated crowd conditions, national law and applicable technical standards.

For example, a wide view used to detect congestion has a different purpose from a view intended to identify a person at an entrance. Calling both a "stadium camera" does not make their specifications interchangeable.

From obligation to a testable requirement

The regulations stop at coverage. The specification has to start there and produce a defensible number for every view. The derivation runs in one direction: the approved security plan gives you locations and obligations, an operational requirement gives each view a task, the task sets a target pixel density, and that density at a stated distance determines the camera and lens.

Write an operational requirement for every camera view

An operational requirement records what a single view is for, in terms that can be tested after installation. For each camera position, document:

• the location and the area the view must cover
• the purpose of the view and the decision it supports
• the target — a person, a vehicle, a face, an item of property
• the target plane or distance at which the requirement must be met
• the task level the operator or investigator needs
• scene conditions: lighting, crowd density, weather, sightlines
• who acts on the image, live or retrospectively
• the retention class, and whether the footage may become evidence

FIFA's coverage list tells you where cameras go. The operational requirement tells you what each one has to achieve. Typical pairings for a football venue:

This table is engineering guidance for translating a coverage obligation into a design task. It is not a FIFA or UEFA requirement. Neither body assigns a task level or a pixel density to any location.

What pixel density does the task require?

Neither FIFA nor UEFA specifies a pixel density; it follows from the task at each location. Measured in pixels per metre (px/m) across the target, IEC 62676-4:2014 sets four DORI levels: detection 25, observation 62.5, recognition 125, identification 250 px/m. IEC 62676-4:2025 replaces them with seven. Target pixel density determines the required camera and lens combination for a given installation distance.

Factors reducing achieved pixel density

The pixel density model is a simplified rule of thumb. It gives a target, not a guarantee. Real performance falls short of the specified figure for reasons the schedule has to anticipate:

• The edges of the target area. Density is highest on the optical axis and falls towards the edges of the field of view.
• Viewing angle. Steep downward angles across a stand compress the target and reduce usable detail.
• Light, optics and compression. Low light, lens quality and aggressive encoding all degrade the delivered image.
• The display chain. A view can only support the task if the operator's monitor, layout and workload allow the detail to be seen. This is engineering judgement rather than a requirement of the standard.

The same reasoning limits what a pan-tilt-zoom camera can be asked to do. Its achieved pixel density depends on where it happens to be pointed and how far it is zoomed, so it cannot deterministically satisfy an evidential requirement for a fixed area. UEFA's categories 3 and 4 require colour PTZ cameras with recording of moving images and still photographs; treat that capability as an addition to fixed evidential views, not a replacement for them.

What the specification hands to the archive design

Each row of a completed camera schedule exports five parameters into the storage and retention design:

• resolution
• frame rate
• codec
• retention days
• evidence-hold class — whether footage from this view may need protecting beyond the rolling archive

Those inputs meet the two retention obligations described above: a rolling archive sized for the 60-day requirement, and a protected store for incident footage held for two years. Sizing the archive itself — storage volume, bandwidth, server and network capacity — is a separate exercise driven by the completed schedule, not by any individual camera.

Proving the design meets the obligation

A defensible specification follows the operational plan, and each step produces a record that can be shown to the body that approves the venue:

1. Identify the FIFA, UEFA, competition, national and local requirements that apply.
2. Complete the venue and event risk assessment with the relevant authorities and emergency services.
3. Map mandatory coverage areas, operational sightlines and control-room blind spots.
4. Define the purpose and required evidential quality of every camera view, using the operational requirement and pixel density method described above.
5. Calculate live-viewing, recording, retention, export and resilience requirements.
6. Define how video will interact with ticketing, access control, alarms, communications and incident management.
7. Validate the design with the bodies responsible for safety certification and event approval.

Responsibility does not transfer with the work. FIFA assigns production of match risk assessments to the stadium security officer, with input from local and, where required, national authorities and emergency services. Consultants can support the work, but responsibility and approval remain with the designated organisations and officials.

How VMS and PSIM support stadium security compliance and carry the obligation

A VMS manages live and recorded video. A PSIM coordinates information and workflows across multiple security systems. Depending on the venue, these functions may be delivered by separate platforms or as part of an integrated architecture.

These functions can support compliance, but they do not certify it. The stadium operator and relevant authorities remain responsible for the safety and security plan, staffing, procedures and approval of the final system.

How AxxonSoft can support the operating model

Axxon One VMS provides live and recorded video management, role-based permissions, maps, event-driven automation, export and evidence-management functions. Its documented failover functions can maintain uninterrupted live video and recording, while user actions — including video export — can be recorded in the system log.

For projects that require broader physical security coordination, Axxon PSIM can integrate security subsystems and support centralised event handling. The required architecture and licences depend on the stadium's systems, risk assessment and operational procedures.

AxxonSoft software should therefore be presented as part of a compliant design, not as proof of FIFA or UEFA compliance by itself. Stadium operators can use a requirements-led assessment to map the regulation, venue plan and existing security infrastructure to an appropriate solution.

FAQ