On October 6, Henrico County, Virginia (~330k residents, the second-largest jurisdiction in Virginia) terminated its four-year contract with Flock Safety — with no financial penalty to taxpayers, inside a 7-day window, while reviewing alternative options in parallel. Board of Supervisors Chair Rev. Roscoe D. Cooper III said verbatim: “As a county, we have listened as our residents have shared legitimate concerns about Flock Safety, the proliferation of its cameras across the nation and whether the data collected is sufficiently safeguarded to protect the privacy of individuals in our community” [1]. County Manager John Vithoulkas added: “The decision really comes down to the fact that it seems like every day, there’s another issue with another locality and how Flock cameras are used. Ultimately, the decision was that Flock may not be the tool that we need to put a county’s credibility behind” [2].

For any Mexican, Brazilian, or Argentine procurement office signing an enterprise ALPR contract in Q4 2026, Henrico’s numbers carry more weight than any position paper [1][2][3][4][5]:

  • 128 Flock cameras in use as of Aug 11, 2026 (122 stationary + 6 mobile, per Police Chief Eric English) [3] — 122 operational cameras as of October 6 [4]
  • Four-year contract (since November 2022) with annual renewal — the most recent authorized July 24 for the period beginning November 15 [3]
  • ~$1 million total spend over the period, at $2,500 USD per camera per year + $350 USD one-time installation [2][3]
  • 21-day cloud retention (the standing operational policy since the program started — not a new termination clause) [2][5]
  • Internal audit every 30 days to verify authorized use + compliance with Va. Code §2.2-5517 (data is never sold or shared with third parties, including federal agencies) [5]
  • 1.73 miles of coverage (0.05% of the county’s roadways, 9,150 total feet) [5]
  • No financial penalty even though the contract ran through November 14 — Vithoulkas told VPM News the county would exercise early termination without paying [2]
  • 7-day termination window from the October 6 announcement to the effective end of the contract [1][3]

Context that matters: in August, the county revoked access to the Flock system from 10 fire investigators after determining they had accessed it in violation of a Virginia state law [3]. That revocation was the operational prelude to the October 6 announcement.

The editorial question for a Mexican, Brazilian, or Argentine procurement office signing an enterprise ALPR contract in Q4 2026: if the question is no longer “what do we do if a data incident happens” but “what vendor-risk pre-emption clauses do we put in the RFP before signing,” what are the five clauses that Henrico’s case makes operational in the public record — and that any RFP signed in Q4 2026 inherits by default if you don’t request them explicitly.

Clause 1 — no-financial-penalty termination-for-convenience at the exit-cost level. No ALPR contract can impose an exit penalty that exceeds the value of the un-incurred remaining months of the contract [2]. Vithoulkas was verbatim: “there will be no financial penalty for the county” [2]. Henrico’s contract ran through November 14; the county exercised early termination without paying. In your RFP, this is a clause that says: “the contract may be terminated by the buyer at any time, with 30 days’ notice, without penalty, with proportional refund of any prepaid fees, and with the vendor’s obligation to cooperate with the transition.” If your RFP doesn’t have that clause today, your contract ties you to the vendor for the residual value of the contract year.

Clause 2 — data-retention-policy-attached at the already-captured-data level. The RFP must state the buyer’s data retention policy (not the vendor’s) — typically 21-30 days for non-evidentiary data, deletion-not-move at the end of the retention period (no export to another system, no sale to a data broker, no sharing with third parties) [5]. Henrico already operated under Va. Code §2.2-5517 with 21 days cloud + 30 days audit + zero federal sharing [5]. In your RFP, this is a clause that says: “data is the exclusive property of the buyer; at the end of the retention period data is deleted without copy, without export, without vendor access from the termination date forward.”

Clause 3 — hardware-removal-within-X-weeks at the physical-decommissioning level. The vendor must remove the physical infrastructure within an explicit window after termination — typically 14-21 days [1]. Henrico terminated the contract October 6; the 122 stationary cameras will be removed in the following two weeks. In your RFP, this is a clause that says: “within 21 calendar days after termination, the vendor removes all installed physical infrastructure, with a removal act signed by the buyer and the vendor.” If your RFP doesn’t have that clause, the vendor can claim the infrastructure is theirs and refuse to remove it, leaving you with the uninstall problem.

Clause 4 — vendor-due-diligence-pre-emption at the regulatory-conversations level. The RFP must allow the buyer to terminate the contract if the vendor becomes subject to a material regulatory investigation, sanction, federal-list exclusion (FCC Covered List, NDAA Section 889), or adverse judicial ruling — without the buyer having to demonstrate specific harm [1][2]. Cooper was verbatim: “we cannot ignore the potential for misuse of system data by others” [1]. Vithoulkas was verbatim: “every day, there’s another issue with another locality” [2]. In your RFP, this is a clause that says: “the buyer may terminate the contract with 7 days’ notice if the vendor becomes subject to (a) a federal or state investigation for data misuse, (b) an exclusion from any federal prohibited-equipment list, (c) a judicial ruling that finds misuse, or (d) any material change in the vendor’s data retention or sharing policies.” Cooper didn’t need a specific local incident; the national risk was enough.

Clause 5 — alternative-vendor-evaluation at the no-abandonment level. The RFP must state that the buyer does not abandon security coverage when terminating the contract — during the transition window, the buyer will evaluate alternative options that continue operational effectiveness [1]. Henrico was verbatim: “officials also will review other options that will continue the division’s operational effectiveness” [1]. In your RFP, this is a clause that says: “during the 30 days after termination, the buyer may operate any alternative infrastructure (proprietary, another vendor, open-source) without restriction from the outgoing vendor; the outgoing vendor cooperates with the technical transition.” This closes the threat that the outgoing vendor argues security coverage is lost during the transition.

⚠️ The critical date is October 16, 2026: Senator Josh Hawley gave Motorola Solutions, Verkada, and Axon until that date to respond to his October 1 letters on retention, false-positive rates, and confirmed misuse cases since 2021. Combined with the FCC component-part rule taking effect October 13 and the July LAPD Inspector General audit that already suspended Flock — any RFP you sign between today and October 16 without Henrico’s five clauses inherits by default the regulatory + vendor + architectural risk chain that Henrico’s October 6 session made operational. If you sign without the five clauses, today is a good day to reconsider the contract before the window closes.

P.D. How many of these five preventative pre-emption clauses are already in your enterprise ALPR RFP right now? If the answer is fewer than three, the contract you sign in Q4 2026 inherits by default the risk chain that Henrico made operational on October 6 — and the first council member who asks “how much does it cost us to walk away?” puts you on the front page without a documented answer. ⚠️

📰 Source: Henrico County press release (Oct 6, 2026) + VPM News (Oct 6, 2026) + Henrico Citizen (Oct 6, 2026) + WRIC ABC 8News (Oct 6, 2026) + Henrico County Police Division ALPR official page.

Frequently Asked Questions

What exactly changed on October 6 in the U.S. ALPR regulatory framework that affects a LATAM RFP?

Henrico, Virginia (the second-largest jurisdiction in Virginia, ~330k residents) terminated its four-year contract with Flock Safety without financial penalty, inside a 7-day window, citing “privacy concerns” about the national proliferation of Flock cameras and the potential for misuse by others [1][2]. The announcement comes four months after Hispanic organization of Henrico and other resident groups raised concerns at the Board of Supervisors meeting. Henrico’s contract (originally signed November 2022, most recent annual renewal July 24, 2026) covered 128 ALPR cameras (122 stationary + 6 mobile as of August 11) for an approximate $1 million value over four years [2][3]. Your LATAM RFP with a US vendor (Motorola, Axon, Genetec, Flock) now carries the risk that the decision to continue with a vendor becomes subject to pressure from the “conversations happening at the national and state level” — not a specific local incident [1][2].

Why is Henrico different from the other 2026 Flock exits?

It’s the first Flock exit where (a) the decision was explicitly framed as “preventative, not reactive” [1][2], (b) the county had operated the system for four years without a material local misuse incident [2], (c) the decision was made within the pre-authorized annual review window without penalty [2][3], and (d) the county’s ALPR coverage (1.73 miles / 0.05% of roadways) was so marginal that the termination cost was absorbable within the operating budget [5]. The combination of the four factors changes the question for a LATAM procurement office: it’s no longer “what do we do if an incident happens?” but “what clauses do we sign NOW so that the exit decision doesn’t cost us a year of budget?”

What new clause should I add to my ALPR RFP to protect myself from vendor-risk bypass?

Five, not three. The 3 original (NDAA, data jurisdiction, retention) plus 2 new: (1) no-financial-penalty termination-for-convenience clause at the exit-cost level (Henrico verbatim: “no financial penalty” [2]), (2) data-retention-policy-attached clause at the already-captured-data level (Henrico: 21 days cloud + 30 days audit + zero federal sharing [5]), (3) hardware-removal-within-X-weeks clause at the physical decommissioning level (Henrico: 2 weeks for 122 cameras), (4) vendor-due-diligence-pre-emption clause at the regulatory-conversations level (Henrico: the decision was “preventative, not reactive” [1][2]), (5) alternative-vendor-evaluation clause at the no-abandonment level (Henrico: “officials will review other options” [1]). Clause 4 is the one no US vendor offers you by default — you have to ask for it in writing before signing.

Sources

[1] Henrico County press release (Oct 6, 2026). https://henrico.gov/news/2026/10/henrico-police-to-eliminate-flock-cameras/ [2] VPM News (Oct 6, 2026). https://www.vpm.org/news/2026-10-06/henrico-police-cancel-flock-safety-alpr-vithoulkas-cooper-newby/ [3] Henrico Citizen (Oct 6, 2026). https://www.henricocitizen.com/breaking-henrico-cancels-flock-safety-contract/ [4] WRIC ABC 8News (Oct 6, 2026). https://www.wric.com/news/local-news/henrico-county/police-discontinues-flock-camera-use/amp/ [5] Henrico County Police Division — Automatic License Plate Readers official page. https://henrico.gov/police/automatic-license-plate-readers/