Understanding eUICC for IoT: What It Is, How It Works, and Why It Matters

A practical guide to the SIM technology behind global IoT, including how it works, how the new SGP.32 standard changes things, and how to decide whether eUICC is right for your deployment.

What Is eUICC?

eUICC stands for embedded Universal Integrated Circuit Card. It is a software standard, not a physical thing, that lets a SIM store more than one mobile network operator (MNO) profile and switch between them remotely. The standard is defined by the GSMA, the industry body that governs mobile network specifications.

A traditional SIM card stores a single operator profile and is locked to that operator unless the physical card is replaced. An eUICC-enabled SIM stores multiple profiles, supports new ones being downloaded over the air, and can switch between them on command from a central management platform. The same SIM that connects to one carrier today can connect to a different carrier tomorrow, without anyone visiting the device.

That capability matters most for IoT devices, which are often deployed in places that are expensive or impossible to reach (smart meters in walls, sensors on remote infrastructure, EV chargers in car parks, telematics units inside vehicles). Sending an engineer to swap a SIM card across a fleet of thousands of devices is rarely a sensible answer when commercial, regulatory or technical conditions change. eUICC turns SIM management from a logistical problem into a software operation.

eUICC vs eSIM: What Is the Difference?

The two terms are often used interchangeably, but they refer to different things.

eSIM is a hardware form factor. Specifically, it usually refers to MFF2, the small soldered chip that lives inside a device, replacing the removable plastic SIM. Some sources also use eSIM more loosely to mean any SIM with embedded provisioning capability. eUICC is the software standard that allows multiple operator profiles to be stored on a SIM and managed over the air.

The key thing to understand is that the two are independent. You can have an eSIM (the physical chip) without eUICC (the software capability), and you can have eUICC capability on a removable plastic SIM in any of the standard form factors (mini, micro or nano). For IoT, the most common pairing is an eSIM (MFF2) with eUICC capability, because a soldered, eUICC-capable SIM is what lets a manufacturer build a single global product and configure connectivity at deployment.

How eUICC Works: The Components and the Flow

eUICC relies on a small set of standardised backend components that prepare, deliver and manage operator profiles on the SIM.

The exact components depend on which version of the standard the deployment uses. The original M2M standard (SGP.02), the consumer standard (SGP.22) and the newer IoT-specific standard (SGP.32) each define a slightly different architecture. The next section covers the differences in detail. The general flow is the same:

1. The device powers on with a bootstrap profile and connects to its initial network.
2. A management platform (controlled by either the operator, the user or the enterprise, depending on the standard) decides which operational profile the device should use.
3. The new profile is prepared on a profile server, encrypted, and delivered to the SIM.
4. The SIM activates the new profile and starts connecting to the new network.
5. Old profiles can be deactivated, retained or deleted as needed.

This entire process happens over the air. There is no need for a physical visit, a SIM swap or a re-flash of the device. For a fleet operator with devices scattered across the country or across borders, that is the difference between a manageable operational model and one that does not scale.

The Three eUICC Standards: SGP.02, SGP.22 and SGP.32

eUICC has evolved through three distinct GSMA specifications, each addressing a different set of requirements.

Understanding which standard a deployment uses (and which one it should use) is one of the most important decisions in an eUICC project. The three standards are not interchangeable, and SGP.32 is not backward compatible with SGP.02. Here is how they compare:

The short version: SGP.02 was built for the automotive industry and never fitted IoT well. SGP.22 was built for phones and never fitted unattended IoT devices. SGP.32 is the first eUICC standard purpose-built for IoT, and it is the one most new IoT eUICC deployments will adopt over the next few years.

SGP.32: The New IoT-Specific eSIM Standard

SGP.32 is the most significant development in eUICC for IoT in a decade. It addresses the specific problems that made SGP.02 and SGP.22 awkward for IoT and is becoming the default standard for new deployments.

SGP.32 was published by the GSMA in May 2023. Its goal was to combine the strengths of the M2M standard (server-driven provisioning, no user interface required) with the strengths of the consumer standard (a simpler architecture and the ability to switch operators without integration between platforms). The result is a new architecture designed for the realities of modern IoT: low-power devices, intermittent connectivity, narrowband networks, and fleets that cross borders and outlive operator contracts.

Three components define the SGP.32 architecture:

The practical consequences of this architecture are significant. SGP.32 removes the SMS dependency that made SGP.02 unworkable on NB-IoT and LTE-M. It removes the operator lock-in built into SM-SR. It moves control from the operator to the enterprise or device owner, so the company that deploys the IoT fleet decides which networks devices use, not the network providing the bootstrap profile. And it does all of this while reusing the proven security model of the earlier eUICC standards.

Why eUICC Matters for IoT

eUICC is not just a technical convenience. It changes the commercial and operational model for IoT in six concrete ways.

eUICC and Multi-IMSI: Complementary, Not Competing

eUICC is often discussed alongside multi-IMSI technology. The two solve different problems and are frequently deployed together.

A multi-IMSI SIM stores multiple International Mobile Subscriber Identities and can switch between them, giving the device access to several networks under different identities. The switch happens at the SIM level and is generally faster than an eUICC profile swap. Multi-IMSI is excellent for resilience, especially across borders, where a device can adopt a local IMSI to avoid roaming charges or coverage gaps.

eUICC adds a deeper capability: the ability to download a complete new operator profile, not just switch between IMSIs that were loaded at manufacture. That matters for long-term network changes (an operator going out of business, a regulatory move, a 2G or 3G sunset) and for adopting an entirely new connectivity provider mid-deployment. The two are complementary: a well-specified IoT SIM often combines multi-IMSI for fast network resilience with eUICC for long-term flexibility.

When to Use eUICC

eUICC is powerful but not always necessary. The decision depends on deployment scale, geography, device lifecycle and operational model.

eUICC is usually the right choice when one or more of these apply: the device fleet is global or crosses borders frequently, the device lifecycle exceeds five years, sites are physically hard to reach, the deployment crosses regulatory boundaries that restrict permanent roaming, the device runs on networks at risk of sunset (legacy 2G or 3G), or the operator wants the freedom to change connectivity providers mid-deployment without touching hardware.

eUICC is often unnecessary when the deployment is single-country with stable network coverage, the device lifecycle is short, the connectivity provider already offers a multi-network IoT SIM that meets coverage needs without profile swapping, or the cost of the eUICC infrastructure outweighs the operational savings. For many UK-only IoT deployments, a multi-network IoT SIM without eUICC is the simpler and more cost-effective answer.

The right way to decide is to map the actual deployment requirements (geography, lifecycle, regulatory exposure, network risk) against the cost and complexity of eUICC adoption. Millbeck can help work through that decision rather than defaulting to either side of it.

IoT Use Cases That Benefit Most From eUICC

The use cases where eUICC adoption is strongest tend to share a common profile: long-life assets, dispersed geography, regulatory exposure, or all three.

Smart Metering

Smart meters are deployed for fifteen to twenty years, often built into walls or basements, and are subject to network sunsets across that lifecycle. eUICC lets the meter migrate to new networks without a costly site visit.

Telematics and Fleet Tracking

Vehicles cross borders, and permanent roaming restrictions or commercial considerations may require a switch to a local operator profile in certain markets. eUICC handles this dynamically.

Healthcare and MedTech

Connected medical devices are regulated, expensive to maintain, and often deployed across multiple jurisdictions. eUICC supports compliant connectivity without site visits and is well suited to mission-critical applications.

Industrial and Manufacturing

OEMs producing industrial equipment for global markets benefit from a single global SKU configured with eUICC, then provisioned with local connectivity when the equipment reaches its destination.

Logistics and Asset Tracking

Containers, trailers and high-value assets move across borders unpredictably. eUICC, often combined with multi-IMSI, gives trackers a path to local operator profiles without physical access.

Energy and EV Charging

Long-life infrastructure assets where uptime is commercially critical. eUICC reduces the risk that an operator change or a network sunset takes equipment offline. See our use case on EV charging connectivity for related considerations.

Deployment Considerations

A successful eUICC deployment is part technical and part commercial. Both sides need to be specified at the outset, not bolted on later.

On the technical side, the device needs an eUICC-capable SIM and a modem and firmware that support the right RSP protocol (SGP.02 or SGP.32, depending on the deployment). For SGP.32 specifically, the device also needs an IPA, either on the device (IPAd) or on the eUICC (IPAe), depending on the device's processing power. The bootstrap profile strategy needs to be planned: what does the device come out of the factory with, and how does it transition to its operational profile? Power budget matters too, particularly for battery-operated devices, since profile downloads consume more energy than steady-state telemetry.

On the commercial side, the considerations are operator agreements (which networks the deployment will use), regulatory mapping (which markets require local profiles), eIM provider selection (whose platform will manage the fleet), and cost modelling (eUICC infrastructure has its own licensing and per-operation costs that need to be factored in alongside per-SIM data charges).

A well-designed profile strategy at the start saves significant operational costs and makes scaling much simpler later. A poorly-designed one creates technical debt that is hard to unwind once thousands of devices are in the field.

Glossary of Key Terms

How Millbeck Supports eUICC Deployments

Since 2002, Millbeck has been pairing cellular hardware with the right connectivity for the job. For eUICC-enabled IoT projects, we provide eUICC-capable IoT SIMs and eSIMs, multi-network global coverage, local profile options for regulatory compliance, lifecycle provisioning and management, APIs and integration support, and a single global SKU model that simplifies logistics for international deployments. Secure IoT SIM connectivity through VPN, fixed IP and private APN options is available across the same connectivity stack.

If you are planning an IoT deployment at scale, eUICC is one of several tools that can keep your devices connected, compliant and future-proof. Whether it is the right tool for your deployment depends on geography, lifecycle and operating model. We help you make that decision rather than defaulting to either side of it.

Frequently Asked Questions