From Selling Boxes to Selling Closed Loops: RaaS, Recurring Service and 50 Overseas Buyers Ask the Same Question

The questions asked most often on the show floor were not about specifications: how much cheaper than a person, does it work in the rain, what happens when the network drops. Overseas buyers ask the same thing in a different vocabulary — can you stay accountable for the outcome.

A recurring pattern across Security China 2026 was that the hardest questions were commercial and legal, not technical. That is a useful signal for an industry that still mostly sells hardware.

The Three Questions Buyers Actually Asked

A robotics vendor in the E1 embodied-intelligence hall ran live demonstrations on all four days and recorded the three most frequent questions from professional visitors: cost — how much cheaper is this than a person; reliability — does it run in rain, see at night, keep working offline; and coordination — will it replace my security team. Its answer was Robot-as-a-Service: pay by service period, with the unit, deployment, maintenance, cloud platform and insurance bundled, converting a one-off purchase into predictable operating expenditure.

The same vendor noted that front-line security staff now average over 52 years of age with high turnover, framed robots as filling gaps rather than replacing teams, and set a target of more than 10,000 units in service by 2028. Those are not robotics details; they are the shape of a service contract.

The Structural Shift

Second-hand summaries of a 2025-2026 industry survey put China's security industry output at 1.116 trillion yuan in 2025, up 4.3 percent, with operations and maintenance services at roughly 256.7 billion yuan or 23 percent of the total, and forecast that services grow 12-15 percent annually to exceed 28 percent by 2027. Those figures need primary verification, but the direction matches the show floor.

National policy points the same way. The State Council AI+ action opinion calls for application service providers and explicitly develops Model-as-a-Service and Agent-as-a-Service as an application service chain. The organiser's own framing for the next five years says overseas markets remain a key growth engine and that companies are moving from product export to localised operations and ecosystem co-building.

Export Is the Same Question With a Compliance Layer

The show set up a Global Procurement Lounge for Latin America, Africa, the Middle East, Southeast Asia and Central Asia, inviting more than 50 overseas buyers with requirements mapped in advance for one-to-one meetings. The China Security International Forum brought in government officials and industry association leaders from Brazil, the UAE (Dubai), Indonesia, Turkey, Pakistan and Mongolia, together with leading Chinese exporters and overseas compliance specialists, to discuss market opportunities and compliant operations. The organiser continues to push procurement leads after the show under a matchmaking plus long-term follow-up model.

For devices carrying cameras, positioning and driver-behaviour data, market access no longer hinges mainly on traditional certifications. It hinges on whether data classification is clear, whether video and location can be stored in-country, whether model training data can lawfully flow back, and whether the evidence chain holds up under the target country's law.

Compliance Hardware and Rules

Vimicro showed a useful piece of the answer: a Beidou module embedded in front-end capture devices, with spatiotemporal tags, video streams, IoT sensor data, control commands and AI results jointly signed under the SVAC national standard. The company's formulation is memorable — AI can generate data, but it cannot generate the same digital signature. Related exhibits covered GB 35114 compliance, the five-protection requirements of Decree 799, and private-deployment compute nodes that keep models and data separated.

On the regulatory side, eight ministries jointly issued the 2026 Automotive Data Export Security Guidelines on 3 February 2026, setting out nine exemption categories and refining important-data determination for R&D, manufacturing, automated driving, software upgrades and connected operations. On 20 October 2026 the equipment industry department of MIIT and the national automotive standardisation committee released a draft mandatory national standard, Automotive Data Security Requirements, for public comment until 19 December 2026. It is still a draft, not an enacted obligation, but its direction is clear: highly sensitive in-cabin information and external environment data are treated separately, and vehicle makers, driving-automation providers, component suppliers and cloud service providers are bound into a full-chain responsibility model.

Our Take

Servitisation and compliance are two faces of the same thing. RaaS looks like a payment method but is really a transfer of responsibility: the customer buys a continuously available outcome, and the supplier must underwrite reliability, maintenance and upgrades over time. That is why the questions were about rain, night and offline behaviour — they are about long-term cost and long-term availability, not one-off specs.

In fleet terms, what a customer needs after an MDVR is delivered is a chain that keeps holding: risk events identified, verified, handled, archived and retrievable by a regulator. The more complete the chain, the stronger the claim to subscription revenue. Break it — alert floods, untrustworthy evidence, non-compliant data — and cheap hardware will not renew. Once synthetic media makes footage contestable, verifiable originality becomes a product in its own right, and tamper-evident timestamps, location anchoring and signed evidence may become the hardest layer of a subscription.

Six Checks Before Subscription or Export

• Data inventory: classify video, location, driver behaviour, faces and plates; identify whether any of it counts as important data.

• Storage and processing locality: does the target country require in-country storage, and can the platform isolate data by region.

• Cross-border path: determine whether one of the nine exemptions under the 2026 guidelines applies, or whether a security assessment, standard contract or certification is needed.

• Evidence trustworthiness: spatiotemporal anchoring, tamper signatures and audit logs across capture through archive.

• Models and OTA: whether cross-border delivery of models or algorithms triggers data or software review, and whether rollback is auditable.

• Service commitment: SLA, local spares and maintenance, language and time-zone coverage — these decide whether RaaS or subscription can actually work.

Our Judgment

The next stage of Chinese security exports is not selling cheaper boxes into more countries. It is exporting an auditable data closed loop plus long-term operational capability. For MDVR vendors, insurance risk linkage, driver-behaviour scoring and evidence custody are ready-made subscription entries — but only after the compliance foundation is in place.

Sources: show-floor report from a robotics vendor, the organiser's secretary-general interview and international forum materials, the State Council AI+ action opinion, Economic Reference News coverage of Vimicro, Shenzhen municipal justice bureau compliance bulletin on the 2026 automotive data export guidelines, and the October 2026 draft standard notice. The Automotive Data Security Requirements document is a draft for comment and is not yet in force; the industry output and service-share figures are second-hand and require primary verification.