Take a look at the code for Objective-See’s “OverSight” utility; it is a good example of how to detect AV events system-wide. It’s also a really great app…
Their FAQ gives a sketch of how they detect AV events on Mac OS:
Q: Why does it take OverSight, a few seconds to display the webcam/mic usage notification?
A: There is not easy way to determine what process is using the webcam or mic, when either is activated. Worse, there is no direct indication that a new process is accessing an existing a webcam session. Thus OverSight has to perform various tests and has to poll the system (only when the camera/mic is active) in order to determine what process(es) is/are accessing the device. This takes a few seconds...mahalo for your patience!
https://objective-see.com/products/oversight.html